Malware Analysis Report

2024-11-15 09:56

Sample ID 241110-btj49swgne
Target bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751
SHA256 bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751
Tags
amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751

Threat Level: Known bad

The file bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751 was found to be: Known bad.

Malicious Activity Summary

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Detects Healer an antivirus disabler dropper

RedLine payload

RedLine

Modifies Windows Defender Real-time Protection settings

Healer

Healer family

Amadey

Redline family

Amadey family

Executes dropped EXE

Windows security modification

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-10 01:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-10 01:26

Reported

2024-11-10 01:28

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3548 set thread context of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3312 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe
PID 3312 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe
PID 3312 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe
PID 1572 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe
PID 1572 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe
PID 1572 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe
PID 4288 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe
PID 4288 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe
PID 4288 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe
PID 1348 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe
PID 1348 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe
PID 1348 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe
PID 1348 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe
PID 1348 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe
PID 1348 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe
PID 4288 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe
PID 4288 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe
PID 4288 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe
PID 3288 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
PID 3288 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
PID 3288 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
PID 1572 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 1572 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 1572 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 1080 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 1080 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 1080 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 1080 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\cmd.exe
PID 1080 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\cmd.exe
PID 1080 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 4568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 4568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 4568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 2204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 2204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 2204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1084 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 3792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 3792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1084 wrote to memory of 3792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3548 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 3548 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 3548 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 3548 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 3548 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 3548 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 3548 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 3548 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 3548 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe
PID 3312 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe
PID 3312 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe
PID 3312 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe

"C:\Users\Admin\AppData\Local\Temp\bd05f1aabb282e649812df8d9e30363a76b00bf400756fd419a31cb4808d6751.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3624 -ip 3624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 1080

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb7ae701b3" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\cb7ae701b3" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
RU 193.3.19.154:80 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 193.3.19.154:80 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
RU 193.3.19.154:80 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 193.3.19.154:80 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CQ358647.exe

MD5 6d4c69e485cda470e0e520484bdf8ffc
SHA1 8f0fd745a678be9d1f26e6e749be129bead771b1
SHA256 f4d386660fa1295364b0c62216bdb9ab9765b176774c59380764ed5fde617bb8
SHA512 ba7fe6386ddccc583a54dd72758a15d803f22f93bcf35540dd61550637c1f5a2fc1a45712600a9173737b31345fcee78c23c654aeb8e589d4a66facd87c2b566

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jl333720.exe

MD5 18a3145a836714106a300a27a17b9d6c
SHA1 7a29a99e32eabfae1f0c6de903f87809e92ac149
SHA256 dcebde37a04a6abe051556d8ea7d02c7c983dfebb71b8eff8aa797f489c04bce
SHA512 6fe9fd407f206df13d6102c73d9d1fe173d7e96ca58469c03e7edbbbf51d303539040cadb8e49a3ebf591c5e4d0914bb2e94ccc33cb9c2445b38f7309b070273

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GM344696.exe

MD5 44468af881a4a93a83da9027fd3c4754
SHA1 f121ec469716330080b8333cb85d1f86502a8135
SHA256 f7db511644ef5d27641297993ee32ce1a29a0895c6b038d6f8ceea7984b4e9ce
SHA512 67f6eb9e0f2139083b4694da618cb41b322ba877f13785627fa352a1057005b3c8467a89b76cd9f66bb18819e02a8fcbe3e03697934ff46fb09562e7bec97a7f

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\173531645.exe

MD5 3d10b67208452d7a91d7bd7066067676
SHA1 e6c3ab7b6da65c8cc7dd95351f118caf3a50248d
SHA256 5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302
SHA512 b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

memory/1580-28-0x0000000002100000-0x000000000211A000-memory.dmp

memory/1580-29-0x0000000004AE0000-0x0000000005084000-memory.dmp

memory/1580-30-0x0000000004980000-0x0000000004998000-memory.dmp

memory/1580-56-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-54-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-52-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-50-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-48-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-46-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-45-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-42-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-58-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-40-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-39-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-36-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-34-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-31-0x0000000004980000-0x0000000004993000-memory.dmp

memory/1580-32-0x0000000004980000-0x0000000004993000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241387287.exe

MD5 ad2967beee518632cb84139f9a634aa2
SHA1 654a336303389ea74f1ee0b26bbb9761f57a6a20
SHA256 d1815f9bc574917de2b60df1f3cea67924c43552e3dfff174640295689b44476
SHA512 b4ddf71652e6167ce1f9c7c8c79f6b39ad713f07714da51cd526af325bf73523be470226fa5df66f788c8334d8f43a582505b9ab7771e535cabb973f93de0b84

memory/3624-92-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3624-94-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\371786097.exe

MD5 1304f384653e08ae497008ff13498608
SHA1 d9a76ed63d74d4217c5027757cb9a7a0d0093080
SHA256 2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa
SHA512 4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\417106916.exe

MD5 87ae6e0ec4e835d5a476b312a62dcdc3
SHA1 9bfa479bc59a8153901c766bc2dc3e7faa4b993d
SHA256 948b51d0b7b480000ecf0f9634f2112d0c940a6277fedacf697bf21ac7c58293
SHA512 1b75194daf0909b14dee53b5c518dbdbe1bbf337edaf80fc2e785d581a8c07b1206cf4c4d408a4b962c534eb2ae9cb89f86d99f13f095d84a9d3f28342a0c127

memory/4764-112-0x0000000000400000-0x0000000000449000-memory.dmp

memory/4764-116-0x0000000000400000-0x0000000000449000-memory.dmp

memory/4764-114-0x0000000000400000-0x0000000000449000-memory.dmp

memory/4764-117-0x00000000022C0000-0x00000000022FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\592905642.exe

MD5 100a9d616da8dbb82fd696af48f1891e
SHA1 ca5011879625e02ef42b732232885c736d30fbd0
SHA256 307c15e07a61de6f9d9c4cbf949504460d8f1725e812c97ca2aa8656180bd18e
SHA512 0f8f3271c8a466502da57f6f2e126f96e3cca594334242f700d900dafad856120206353e77896e49b3f12a50193e4e4b78c6a8ba7529cb4dfea18e97909a70c5

memory/4764-123-0x0000000002560000-0x0000000002595000-memory.dmp

memory/4764-124-0x0000000002560000-0x0000000002595000-memory.dmp

memory/2176-122-0x0000000000BB0000-0x0000000000BD8000-memory.dmp

memory/4764-121-0x0000000002560000-0x000000000259A000-memory.dmp

memory/2176-613-0x00000000078D0000-0x00000000078E2000-memory.dmp

memory/2176-612-0x0000000007E60000-0x0000000008478000-memory.dmp

memory/2176-614-0x0000000007A40000-0x0000000007B4A000-memory.dmp

memory/2176-892-0x0000000007970000-0x00000000079AC000-memory.dmp

memory/2176-919-0x0000000002CF0000-0x0000000002D3C000-memory.dmp