amadey | 2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d.exe
Size

1.1MB
MD5

16817ed89f48b00338b8c62549fa0963
SHA1

47c6fd9ded9078b942325be7d330c0722c0c167b
SHA256

2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d
SHA512

db85cf2f0c6e3c1014982221586a6264c4431e305665c728f69555ad488e12ca3b084de723cb3bb410c846ff7bbf0e94578b3c96eb679ef0d065c717edd15b0f
SSDEEP

24576:yyzLfhZAtuzIM0+5WfWnZqN4Y592JNDvM7ET:ZzLfhZAozh5WfWEN4b1

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2428-28-0x0000000002370000-0x000000000238A000-memory.dmp	healer
behavioral1/memory/2428-30-0x0000000002530000-0x0000000002548000-memory.dmp	healer
behavioral1/memory/2428-54-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-58-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-56-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-52-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-50-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-49-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-46-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-44-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-42-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-40-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-38-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-36-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-35-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-33-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2428-31-0x0000000002530000-0x0000000002543000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	280842004.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	127577300.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	127577300.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	127577300.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	280842004.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	280842004.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	280842004.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	127577300.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	127577300.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	127577300.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	280842004.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/2676-112-0x0000000004CB0000-0x0000000004CEC000-memory.dmp	family_redline
behavioral1/memory/2676-113-0x0000000007180000-0x00000000071BA000-memory.dmp	family_redline
behavioral1/memory/2676-114-0x0000000007180000-0x00000000071B5000-memory.dmp	family_redline
behavioral1/memory/2676-119-0x0000000007180000-0x00000000071B5000-memory.dmp	family_redline
behavioral1/memory/2676-117-0x0000000007180000-0x00000000071B5000-memory.dmp	family_redline
behavioral1/memory/2676-115-0x0000000007180000-0x00000000071B5000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	370670290.exe

Executes dropped EXE 10 IoCs

pid	Process
4116	HJ133084.exe
4360	ZO065547.exe
4592	Ez623613.exe
2428	127577300.exe
3904	280842004.exe
4988	370670290.exe
2056	oneetx.exe
2676	401550721.exe
5716	oneetx.exe
1468	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	127577300.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	127577300.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	280842004.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	HJ133084.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ZO065547.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Ez623613.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	3904	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HJ133084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZO065547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	280842004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	401550721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	127577300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	370670290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ez623613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2428	127577300.exe
2428	127577300.exe
3904	280842004.exe
3904	280842004.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	127577300.exe
Token: SeDebugPrivilege	3904	280842004.exe
Token: SeDebugPrivilege	2676	401550721.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4988	370670290.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4116	548	2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d.exe	83
PID 548 wrote to memory of 4116	548	2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d.exe	83
PID 548 wrote to memory of 4116	548	2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d.exe	83
PID 4116 wrote to memory of 4360	4116	HJ133084.exe	84
PID 4116 wrote to memory of 4360	4116	HJ133084.exe	84
PID 4116 wrote to memory of 4360	4116	HJ133084.exe	84
PID 4360 wrote to memory of 4592	4360	ZO065547.exe	86
PID 4360 wrote to memory of 4592	4360	ZO065547.exe	86
PID 4360 wrote to memory of 4592	4360	ZO065547.exe	86
PID 4592 wrote to memory of 2428	4592	Ez623613.exe	87
PID 4592 wrote to memory of 2428	4592	Ez623613.exe	87
PID 4592 wrote to memory of 2428	4592	Ez623613.exe	87
PID 4592 wrote to memory of 3904	4592	Ez623613.exe	94
PID 4592 wrote to memory of 3904	4592	Ez623613.exe	94
PID 4592 wrote to memory of 3904	4592	Ez623613.exe	94
PID 4360 wrote to memory of 4988	4360	ZO065547.exe	98
PID 4360 wrote to memory of 4988	4360	ZO065547.exe	98
PID 4360 wrote to memory of 4988	4360	ZO065547.exe	98
PID 4988 wrote to memory of 2056	4988	370670290.exe	99
PID 4988 wrote to memory of 2056	4988	370670290.exe	99
PID 4988 wrote to memory of 2056	4988	370670290.exe	99
PID 4116 wrote to memory of 2676	4116	HJ133084.exe	100
PID 4116 wrote to memory of 2676	4116	HJ133084.exe	100
PID 4116 wrote to memory of 2676	4116	HJ133084.exe	100
PID 2056 wrote to memory of 1720	2056	oneetx.exe	101
PID 2056 wrote to memory of 1720	2056	oneetx.exe	101
PID 2056 wrote to memory of 1720	2056	oneetx.exe	101
PID 2056 wrote to memory of 992	2056	oneetx.exe	103
PID 2056 wrote to memory of 992	2056	oneetx.exe	103
PID 2056 wrote to memory of 992	2056	oneetx.exe	103
PID 992 wrote to memory of 4872	992	cmd.exe	105
PID 992 wrote to memory of 4872	992	cmd.exe	105
PID 992 wrote to memory of 4872	992	cmd.exe	105
PID 992 wrote to memory of 2188	992	cmd.exe	106
PID 992 wrote to memory of 2188	992	cmd.exe	106
PID 992 wrote to memory of 2188	992	cmd.exe	106
PID 992 wrote to memory of 2576	992	cmd.exe	107
PID 992 wrote to memory of 2576	992	cmd.exe	107
PID 992 wrote to memory of 2576	992	cmd.exe	107
PID 992 wrote to memory of 4424	992	cmd.exe	108
PID 992 wrote to memory of 4424	992	cmd.exe	108
PID 992 wrote to memory of 4424	992	cmd.exe	108
PID 992 wrote to memory of 3092	992	cmd.exe	109
PID 992 wrote to memory of 3092	992	cmd.exe	109
PID 992 wrote to memory of 3092	992	cmd.exe	109
PID 992 wrote to memory of 1452	992	cmd.exe	110
PID 992 wrote to memory of 1452	992	cmd.exe	110
PID 992 wrote to memory of 1452	992	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d.exe
"C:\Users\Admin\AppData\Local\Temp\2ee93fd3664d559b846e531c8f95d439063f372a5a27927092febfb78e20233d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HJ133084.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HJ133084.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZO065547.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZO065547.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ez623613.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ez623613.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\127577300.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\127577300.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\280842004.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\280842004.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1084
        6⤵
        Program crash
        
        PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\370670290.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\370670290.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2056
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1720
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\401550721.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\401550721.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3904 -ip 3904
1⤵
PID:2240

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:5716

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HJ133084.exe

Filesize
930KB

MD5
b6d090c222bf65113d99e85b093a07fe

SHA1
75b6989d0691ff45eaabf44c171e14ada1932730

SHA256
9abeab0e69544a5ba4977dd0ce24dd223dd008c751ff66309144601cc81cec8f

SHA512
196addab8d938f400217cb74ba54a373a357c819408806e44af82b2f1764fe5867cb39403159eff8de9bfabc1e974283536c507275145756487b990bc96bac78

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\401550721.exe

Filesize
341KB

MD5
eedffd35cee0d677dd3c516b0127cd67

SHA1
b1197841319f386d5a9725e4f07e8165c5760013

SHA256
0166b26edb267e597168a530a647dd9437c23b97834060e9cab8703ce08f172e

SHA512
932738ef3764b48bb7a865455f7e0811eb7e0de46de2e61cd5d98c84bc6b834ffe44c9023e3da525a56c969cb1c8a9aaad75ca2c943e3e6a44bf04c3c0c8ae2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZO065547.exe

Filesize
577KB

MD5
e5e46ecc42bb69adcaf553cc3290995a

SHA1
2679e89071e4b253ba41eef878f2362611823bcf

SHA256
8bf8e6b5295b9a5718080b73c40eb254cdd5dcf5373f8921b62fc9be7e418445

SHA512
15ac79c1ebc09a3450b57bb0accd0db86af3fbe847dba6d63c177b00096dcc2adac2c88fc2b4db152e0cadcd6b7dcd6a4407f9e90c910fcc31f2ecbf2b591beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\370670290.exe

Filesize
204KB

MD5
1304f384653e08ae497008ff13498608

SHA1
d9a76ed63d74d4217c5027757cb9a7a0d0093080

SHA256
2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

SHA512
4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ez623613.exe

Filesize
406KB

MD5
e642719b2845af4073ac95df7065edda

SHA1
fbb7ec00a9ddb305eaf20532605ce39ed3b20878

SHA256
8f66a24bbf8567ce430656c219dc3d75f26d1b7d62b755888c45ab9e889d5878

SHA512
a05d14c4cb68187924d9ea2e69f821de7f3e6a3831f153aded648725c3796579ec2c6079c145a88e32ba62b44633403cec263220f794f0ca562f30d9d022bca8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\127577300.exe

Filesize
176KB

MD5
2b71f4b18ac8214a2bff547b6ce2f64f

SHA1
b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

SHA256
f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

SHA512
33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\280842004.exe

Filesize
258KB

MD5
3f16c5110489a8226715d31d0303576e

SHA1
e3357dd6e4d2f271a26dc6e6616443c5f6ceb1d7

SHA256
c9fcbb0d155544164ac8eb90d418032b080fa3f9809f2c58e0afa90245a096f2

SHA512
d0aedaf52359d33b915a0b869b37da035b104624d717900f4fd4660c7262c1627331711e9813bd8d88226bb9f40831b8dcad286cd9d74b91e9906d4bce8cddcd

Download Submit
memory/2428-36-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-30-0x0000000002530000-0x0000000002548000-memory.dmp

Filesize
96KB

Download
memory/2428-56-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-52-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-50-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-49-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-46-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-44-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-42-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-40-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-38-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-54-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-35-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-33-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-31-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-58-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2428-28-0x0000000002370000-0x000000000238A000-memory.dmp

Filesize
104KB

Download
memory/2428-29-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/2676-117-0x0000000007180000-0x00000000071B5000-memory.dmp

Filesize
212KB

Download
memory/2676-112-0x0000000004CB0000-0x0000000004CEC000-memory.dmp

Filesize
240KB

Download
memory/2676-113-0x0000000007180000-0x00000000071BA000-memory.dmp

Filesize
232KB

Download
memory/2676-114-0x0000000007180000-0x00000000071B5000-memory.dmp

Filesize
212KB

Download
memory/2676-119-0x0000000007180000-0x00000000071B5000-memory.dmp

Filesize
212KB

Download
memory/2676-115-0x0000000007180000-0x00000000071B5000-memory.dmp

Filesize
212KB

Download
memory/2676-906-0x000000000A310000-0x000000000A928000-memory.dmp

Filesize
6.1MB

Download
memory/2676-907-0x0000000009D10000-0x0000000009D22000-memory.dmp

Filesize
72KB

Download
memory/2676-908-0x0000000009D30000-0x0000000009E3A000-memory.dmp

Filesize
1.0MB

Download
memory/2676-909-0x0000000009E50000-0x0000000009E8C000-memory.dmp

Filesize
240KB

Download
memory/2676-910-0x0000000004B10000-0x0000000004B5C000-memory.dmp

Filesize
304KB

Download
memory/3904-92-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download
memory/3904-94-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download