amadey | 28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e.exe
Size

1.1MB
MD5

7df4b8ce7b5ac615eab5d1cacd154392
SHA1

0dadda3cfdb252fac95f1930e3188f9f04dc2a34
SHA256

28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e
SHA512

925fa6e8209baf662e04160184fb7357e0b6500e78fe1472dafbb1139256f17fac4d8d882f07365d846df3794b0ae9dba4b1cce3528714310ff0158b9bd442d2
SSDEEP

24576:tyrOqE7qJFAqzvXq4XQvZH9HbTU+PtN4YtnDy:Iaa8C/ZXsdHbQ+PT4gD

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4116-28-0x00000000023D0000-0x00000000023EA000-memory.dmp	healer
behavioral1/memory/4116-30-0x0000000004980000-0x0000000004998000-memory.dmp	healer
behavioral1/memory/4116-40-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-58-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-56-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-54-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-52-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-50-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-48-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-46-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-44-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-42-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-38-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-36-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-34-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-32-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/4116-31-0x0000000004980000-0x0000000004993000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	195443687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	195443687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	195443687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	247575834.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	247575834.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	195443687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	195443687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	195443687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	247575834.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	247575834.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	247575834.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/3188-112-0x00000000023B0000-0x00000000023EC000-memory.dmp	family_redline
behavioral1/memory/3188-113-0x0000000002620000-0x000000000265A000-memory.dmp	family_redline
behavioral1/memory/3188-119-0x0000000002620000-0x0000000002655000-memory.dmp	family_redline
behavioral1/memory/3188-117-0x0000000002620000-0x0000000002655000-memory.dmp	family_redline
behavioral1/memory/3188-115-0x0000000002620000-0x0000000002655000-memory.dmp	family_redline
behavioral1/memory/3188-114-0x0000000002620000-0x0000000002655000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	338716686.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
2336	NA562378.exe
2236	Ka228980.exe
1040	Fc335770.exe
4116	195443687.exe
3920	247575834.exe
1352	338716686.exe
1212	oneetx.exe
3188	418710688.exe
1000	oneetx.exe
2764	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	195443687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	195443687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	247575834.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Fc335770.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	NA562378.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Ka228980.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4740	3920	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ka228980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	247575834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	338716686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	418710688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	195443687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NA562378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fc335770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4116	195443687.exe
4116	195443687.exe
3920	247575834.exe
3920	247575834.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	195443687.exe
Token: SeDebugPrivilege	3920	247575834.exe
Token: SeDebugPrivilege	3188	418710688.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1352	338716686.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2336	4828	28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e.exe	84
PID 4828 wrote to memory of 2336	4828	28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e.exe	84
PID 4828 wrote to memory of 2336	4828	28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e.exe	84
PID 2336 wrote to memory of 2236	2336	NA562378.exe	86
PID 2336 wrote to memory of 2236	2336	NA562378.exe	86
PID 2336 wrote to memory of 2236	2336	NA562378.exe	86
PID 2236 wrote to memory of 1040	2236	Ka228980.exe	87
PID 2236 wrote to memory of 1040	2236	Ka228980.exe	87
PID 2236 wrote to memory of 1040	2236	Ka228980.exe	87
PID 1040 wrote to memory of 4116	1040	Fc335770.exe	88
PID 1040 wrote to memory of 4116	1040	Fc335770.exe	88
PID 1040 wrote to memory of 4116	1040	Fc335770.exe	88
PID 1040 wrote to memory of 3920	1040	Fc335770.exe	94
PID 1040 wrote to memory of 3920	1040	Fc335770.exe	94
PID 1040 wrote to memory of 3920	1040	Fc335770.exe	94
PID 2236 wrote to memory of 1352	2236	Ka228980.exe	98
PID 2236 wrote to memory of 1352	2236	Ka228980.exe	98
PID 2236 wrote to memory of 1352	2236	Ka228980.exe	98
PID 1352 wrote to memory of 1212	1352	338716686.exe	99
PID 1352 wrote to memory of 1212	1352	338716686.exe	99
PID 1352 wrote to memory of 1212	1352	338716686.exe	99
PID 2336 wrote to memory of 3188	2336	NA562378.exe	100
PID 2336 wrote to memory of 3188	2336	NA562378.exe	100
PID 2336 wrote to memory of 3188	2336	NA562378.exe	100
PID 1212 wrote to memory of 3124	1212	oneetx.exe	101
PID 1212 wrote to memory of 3124	1212	oneetx.exe	101
PID 1212 wrote to memory of 3124	1212	oneetx.exe	101
PID 1212 wrote to memory of 1136	1212	oneetx.exe	103
PID 1212 wrote to memory of 1136	1212	oneetx.exe	103
PID 1212 wrote to memory of 1136	1212	oneetx.exe	103
PID 1136 wrote to memory of 856	1136	cmd.exe	105
PID 1136 wrote to memory of 856	1136	cmd.exe	105
PID 1136 wrote to memory of 856	1136	cmd.exe	105
PID 1136 wrote to memory of 1932	1136	cmd.exe	106
PID 1136 wrote to memory of 1932	1136	cmd.exe	106
PID 1136 wrote to memory of 1932	1136	cmd.exe	106
PID 1136 wrote to memory of 3500	1136	cmd.exe	107
PID 1136 wrote to memory of 3500	1136	cmd.exe	107
PID 1136 wrote to memory of 3500	1136	cmd.exe	107
PID 1136 wrote to memory of 2024	1136	cmd.exe	108
PID 1136 wrote to memory of 2024	1136	cmd.exe	108
PID 1136 wrote to memory of 2024	1136	cmd.exe	108
PID 1136 wrote to memory of 1852	1136	cmd.exe	109
PID 1136 wrote to memory of 1852	1136	cmd.exe	109
PID 1136 wrote to memory of 1852	1136	cmd.exe	109
PID 1136 wrote to memory of 4472	1136	cmd.exe	110
PID 1136 wrote to memory of 4472	1136	cmd.exe	110
PID 1136 wrote to memory of 4472	1136	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e.exe
"C:\Users\Admin\AppData\Local\Temp\28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NA562378.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NA562378.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ka228980.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ka228980.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fc335770.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fc335770.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\195443687.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\195443687.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\247575834.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\247575834.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1084
        6⤵
        Program crash
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\338716686.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\338716686.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1212
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3124
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\418710688.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\418710688.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3920 -ip 3920
1⤵
PID:5036

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:1000

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NA562378.exe

Filesize
940KB

MD5
6a1af5165932044a74e9009f058c522b

SHA1
37524c854b804e832fcbbfc4d28ad4ad7705f478

SHA256
128371cdb25248c8a26fecfad82fb39f5430c7a2e0a4ca1ec24dc3e0a16c6f0b

SHA512
5bdff020d9eb6d993b3bf9280dba8de44dece1e3999a7988d57b1da77d88833e71cfa8226c84f25e7e5431fcc85e75b0667a02b165266a7aa265fdd50189f44d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\418710688.exe

Filesize
341KB

MD5
e0694a3f040e98ff0b46ff8302aa33ff

SHA1
eff26f0c0d2e67ed52e4e98bf80fe03d8804f197

SHA256
7557ccabcd339640e251ff12811bb349389b87b8a1f7084bb992bc1c721d386e

SHA512
720a58788caefa6fd3d35d28f34aa285e5c99e8d52247f39abbdf4133b1a38bc8921094d113be5f9292d57289d65d5467bf24d03fbdcd882dabc0b57939502ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ka228980.exe

Filesize
586KB

MD5
e692b95ec3e2a19a0ed3f2a37af9b736

SHA1
c7412efb2bd87b8d96e433cd9eacb0ccb0de2a3b

SHA256
dd13d3e95bcd09d115977dd91205999b10669424c886cdafe783dfa337f4a2c2

SHA512
9a4046b5c3378a2cff59d55c02a3e1028bace7897611e76f2e191ffb7c075d03e2c81b430d158861771ef16e856789f4a2217cd115b2353264c7b48e2a6e9744

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\338716686.exe

Filesize
204KB

MD5
1304f384653e08ae497008ff13498608

SHA1
d9a76ed63d74d4217c5027757cb9a7a0d0093080

SHA256
2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

SHA512
4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fc335770.exe

Filesize
414KB

MD5
32363e8fbdcb38e10e40ab1f07e174c8

SHA1
37cfb128c0bcd3ed622bfd919d98ae94423c8ebe

SHA256
5b421103a7f24d36992098db53516317b9eef609b518ea64342156102966e962

SHA512
3bbe14058818127ffded01ccd852ea6a9e23923eec74b8bdd47ceb56322a7dc6741ddf4e992ffef5be51686d7c4692baadacc79cba509b226af5906b294b6c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\195443687.exe

Filesize
175KB

MD5
a165b5f6b0a4bdf808b71de57bf9347d

SHA1
39a7b301e819e386c162a47e046fa384bb5ab437

SHA256
68349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a

SHA512
3dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\247575834.exe

Filesize
258KB

MD5
9fe5a0563ef833cb99696410b640abdf

SHA1
668de7f3de3227cb7123c38a94160e493ee3057e

SHA256
0eb7d496cbf24b3bfaaf9bb737ad1e6c90f1018bcd5da9a2a7bf34c647356ffb

SHA512
74da163930ae90617d7e741140fa9abc364ce7ceaaf14075e8e10ec803b7a02c95f4d4aa4bda79395dfcf704e8a04cfbd2fc84ed608067ac4235ab186fa8973e

Download Submit
memory/3188-906-0x00000000075C0000-0x0000000007BD8000-memory.dmp

Filesize
6.1MB

Download
memory/3188-907-0x0000000007BF0000-0x0000000007C02000-memory.dmp

Filesize
72KB

Download
memory/3188-908-0x0000000007C10000-0x0000000007D1A000-memory.dmp

Filesize
1.0MB

Download
memory/3188-114-0x0000000002620000-0x0000000002655000-memory.dmp

Filesize
212KB

Download
memory/3188-115-0x0000000002620000-0x0000000002655000-memory.dmp

Filesize
212KB

Download
memory/3188-117-0x0000000002620000-0x0000000002655000-memory.dmp

Filesize
212KB

Download
memory/3188-119-0x0000000002620000-0x0000000002655000-memory.dmp

Filesize
212KB

Download
memory/3188-113-0x0000000002620000-0x000000000265A000-memory.dmp

Filesize
232KB

Download
memory/3188-112-0x00000000023B0000-0x00000000023EC000-memory.dmp

Filesize
240KB

Download
memory/3188-909-0x0000000007D30000-0x0000000007D6C000-memory.dmp

Filesize
240KB

Download
memory/3188-910-0x0000000002550000-0x000000000259C000-memory.dmp

Filesize
304KB

Download
memory/3920-93-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4116-56-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-32-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-31-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-34-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-36-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-38-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-42-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-44-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-46-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-48-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-50-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-52-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-54-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-58-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-40-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/4116-30-0x0000000004980000-0x0000000004998000-memory.dmp

Filesize
96KB

Download
memory/4116-29-0x0000000004A50000-0x0000000004FF4000-memory.dmp

Filesize
5.6MB

Download
memory/4116-28-0x00000000023D0000-0x00000000023EA000-memory.dmp

Filesize
104KB

Download