amadey | 05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7.exe
Size

1.2MB
MD5

8e139135f36e5af2a7ca65c4ae6564fb
SHA1

622fd40835303c6e659aa7dcc5e8c051e19939ed
SHA256

05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7
SHA512

5396b51adab443fb6417ac51ba474a67d41ac51ded537f5a115d3e7d968390732fc23f533478a3b52c6e47782440154cd4cd8db5350af47b418bc93a731ebb27
SSDEEP

24576:pytl3ku+QDtGzpfrnM/sHUZ1fJ6xoSwEtAucM/+HG:cTUmtwTnis0ZJooS5tAucy4

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 34 IoCs

resource	yara_rule
behavioral1/memory/2276-28-0x00000000026A0000-0x00000000026BA000-memory.dmp	healer
behavioral1/memory/2276-30-0x0000000004AC0000-0x0000000004AD8000-memory.dmp	healer
behavioral1/memory/2276-58-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-56-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-54-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-52-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-50-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-48-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-46-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-44-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-42-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-40-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-36-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-34-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-32-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/2276-31-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4740-64-0x0000000000B00000-0x0000000000B1A000-memory.dmp	healer
behavioral1/memory/4740-65-0x0000000002570000-0x0000000002588000-memory.dmp	healer
behavioral1/memory/4740-71-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-87-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-93-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-91-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-85-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-83-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-81-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-79-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-77-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-75-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-73-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-89-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-69-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-67-0x0000000002570000-0x0000000002582000-memory.dmp	healer
behavioral1/memory/4740-66-0x0000000002570000-0x0000000002582000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	288150743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	288150743.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	176181181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	176181181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	176181181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	176181181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	176181181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	176181181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	288150743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	288150743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	288150743.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/3044-114-0x0000000000D40000-0x0000000000D7C000-memory.dmp	family_redline
behavioral1/memory/3044-115-0x0000000004E40000-0x0000000004E7A000-memory.dmp	family_redline
behavioral1/memory/3044-116-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/3044-121-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/3044-119-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/3044-117-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	351327853.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
4944	Cp321818.exe
4192	wZ928567.exe
5112	dp810068.exe
2276	176181181.exe
4740	288150743.exe
4276	351327853.exe
3284	oneetx.exe
3044	412835973.exe
5268	oneetx.exe
2724	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	176181181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	176181181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	288150743.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	dp810068.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Cp321818.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	wZ928567.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5396	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dp810068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	412835973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	176181181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cp321818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wZ928567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	288150743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	351327853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2276	176181181.exe
2276	176181181.exe
4740	288150743.exe
4740	288150743.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	176181181.exe
Token: SeDebugPrivilege	4740	288150743.exe
Token: SeDebugPrivilege	3044	412835973.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4276	351327853.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4944	4560	05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7.exe	83
PID 4560 wrote to memory of 4944	4560	05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7.exe	83
PID 4560 wrote to memory of 4944	4560	05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7.exe	83
PID 4944 wrote to memory of 4192	4944	Cp321818.exe	84
PID 4944 wrote to memory of 4192	4944	Cp321818.exe	84
PID 4944 wrote to memory of 4192	4944	Cp321818.exe	84
PID 4192 wrote to memory of 5112	4192	wZ928567.exe	85
PID 4192 wrote to memory of 5112	4192	wZ928567.exe	85
PID 4192 wrote to memory of 5112	4192	wZ928567.exe	85
PID 5112 wrote to memory of 2276	5112	dp810068.exe	87
PID 5112 wrote to memory of 2276	5112	dp810068.exe	87
PID 5112 wrote to memory of 2276	5112	dp810068.exe	87
PID 5112 wrote to memory of 4740	5112	dp810068.exe	97
PID 5112 wrote to memory of 4740	5112	dp810068.exe	97
PID 5112 wrote to memory of 4740	5112	dp810068.exe	97
PID 4192 wrote to memory of 4276	4192	wZ928567.exe	98
PID 4192 wrote to memory of 4276	4192	wZ928567.exe	98
PID 4192 wrote to memory of 4276	4192	wZ928567.exe	98
PID 4276 wrote to memory of 3284	4276	351327853.exe	99
PID 4276 wrote to memory of 3284	4276	351327853.exe	99
PID 4276 wrote to memory of 3284	4276	351327853.exe	99
PID 4944 wrote to memory of 3044	4944	Cp321818.exe	100
PID 4944 wrote to memory of 3044	4944	Cp321818.exe	100
PID 4944 wrote to memory of 3044	4944	Cp321818.exe	100
PID 3284 wrote to memory of 1952	3284	oneetx.exe	101
PID 3284 wrote to memory of 1952	3284	oneetx.exe	101
PID 3284 wrote to memory of 1952	3284	oneetx.exe	101
PID 3284 wrote to memory of 4580	3284	oneetx.exe	103
PID 3284 wrote to memory of 4580	3284	oneetx.exe	103
PID 3284 wrote to memory of 4580	3284	oneetx.exe	103
PID 4580 wrote to memory of 1996	4580	cmd.exe	105
PID 4580 wrote to memory of 1996	4580	cmd.exe	105
PID 4580 wrote to memory of 1996	4580	cmd.exe	105
PID 4580 wrote to memory of 1504	4580	cmd.exe	106
PID 4580 wrote to memory of 1504	4580	cmd.exe	106
PID 4580 wrote to memory of 1504	4580	cmd.exe	106
PID 4580 wrote to memory of 2136	4580	cmd.exe	107
PID 4580 wrote to memory of 2136	4580	cmd.exe	107
PID 4580 wrote to memory of 2136	4580	cmd.exe	107
PID 4580 wrote to memory of 3696	4580	cmd.exe	108
PID 4580 wrote to memory of 3696	4580	cmd.exe	108
PID 4580 wrote to memory of 3696	4580	cmd.exe	108
PID 4580 wrote to memory of 2212	4580	cmd.exe	109
PID 4580 wrote to memory of 2212	4580	cmd.exe	109
PID 4580 wrote to memory of 2212	4580	cmd.exe	109
PID 4580 wrote to memory of 1760	4580	cmd.exe	110
PID 4580 wrote to memory of 1760	4580	cmd.exe	110
PID 4580 wrote to memory of 1760	4580	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7.exe
"C:\Users\Admin\AppData\Local\Temp\05c52ac6729e93cc5b5b0e7873b8af89a9760a57f5b302de2c4ccd6e63c7e2e7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Cp321818.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Cp321818.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wZ928567.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wZ928567.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dp810068.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dp810068.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\176181181.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\176181181.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\288150743.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\288150743.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\351327853.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\351327853.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3284
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1952
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1504
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\412835973.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\412835973.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3044

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:5268

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:2724

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:5396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Cp321818.exe

Filesize
1.0MB

MD5
a25a4ab1760a44dd6288a8781af05c49

SHA1
bedf89b49fa30b0b2210f26306e5257450d3bfaf

SHA256
d77261d334dd6be55033508c75ed49a4e82cba0b8b611637faf762d3176ed95c

SHA512
88592509a6296448e6ce353fa6a1913e1d66134be7a9adba2c5e412052613ba872b29c63edd4392202b4c622133f923b68e0c29ba37f4697d8784011d42be5a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\412835973.exe

Filesize
461KB

MD5
48cfa40cab86b339793f3b9b596ce3a9

SHA1
85b0714b5549cff7985e266f97a7a0e1494fe194

SHA256
e5d1036bdb7d71ce8db767050330967f064db58243eb33e211ab7f38ff145590

SHA512
0e688a018da6374c209dc4b8020c123b258d57314f3ea29a7e7f9c81871e0c5ccfabb00f04cc8686608e0629458f461a3af789522a33628c4ed23275f83a5dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wZ928567.exe

Filesize
637KB

MD5
37ee11071a124a75e2a3424d98302532

SHA1
8dccbcdc7f6a6d781f63395417c58128c4e9529e

SHA256
b221dbb20e56bd8e2c07a62cd5a270cfc06e97844bb553cb4a6d1be416ce8fc4

SHA512
ccf9d1f0cbde753f9369c851988e47d6045e3aadc2590d7f429367118e6e734d4f5ced1de5b0f295aa982b68edf28902fe7963643a197d7cdc6c4151eec04d83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\351327853.exe

Filesize
204KB

MD5
a772dc432e23d391872284a9d97fec86

SHA1
1cf3dd4242087e29bdbc33d07d2cb5f2dd1a91e2

SHA256
dec8acaf980b9b353d708fc4e2aa747a291d4831019b223befb35ac761aaab51

SHA512
e926beea3aa3c64aa4258ebebde9afd164a05753b1ae10a97adca880e9eee415ac2814a81ef47b7235b44ba94e9376e680dbf85e61b25960f4c54ff5823174dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dp810068.exe

Filesize
466KB

MD5
afaf56350d251217c19a61d4e55783d8

SHA1
3b8a578e9fa8c941ef087cfc1c57acbfb8197e0b

SHA256
4085e8c100f94813e62c4c9d1469f37108fa242e0bc7c0c1094df5f9e524d43b

SHA512
a579bc1da0703036d93f344febd63446d8a4ad954d9c1d7eaa3c079704ecc286a9208f8f9c290468aea7c1c015db5e4c6b196b3ad82f5a4f1096352a39fda42f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\176181181.exe

Filesize
176KB

MD5
75a0da5c200866ea282ea75575359afb

SHA1
9e6c3c9e637e00ceae546e91d4539c838828a9f5

SHA256
10cf797b949f785ad135b388e499152939c00a093027b1ccdd57a0b969c9196d

SHA512
e4015ae7f447e9da1e5e9e21a9491eb83fd4ec2d33bb51707db446008c5466cc993d0c8922fb8b0b8f3221e52194c4c283f6b15469a3775da7e5e9522831d4e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\288150743.exe

Filesize
377KB

MD5
2cde7b19d2e53a4c7651980d02aee178

SHA1
323b12341731e871e8be1275816fd57d5f582a5d

SHA256
d18403320828f92db1b5a77ba3d68d11dd524359f8c96079d935032a4faa10cb

SHA512
6e7d6ef5aba36fa71103daf388599f63fb8fe2c148a95f429de63bc38fb720a948017937762843733d59c80426c1be05f7fb5f29b19e7de4fc5f65320df1269d

Download Submit
memory/2276-28-0x00000000026A0000-0x00000000026BA000-memory.dmp

Filesize
104KB

Download
memory/2276-29-0x0000000004C50000-0x00000000051F4000-memory.dmp

Filesize
5.6MB

Download
memory/2276-30-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

Filesize
96KB

Download
memory/2276-58-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-56-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-54-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-52-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-50-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-48-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-46-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-44-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-42-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-40-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-36-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-34-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-32-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/2276-31-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/3044-115-0x0000000004E40000-0x0000000004E7A000-memory.dmp

Filesize
232KB

Download
memory/3044-116-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/3044-912-0x00000000028F0000-0x000000000293C000-memory.dmp

Filesize
304KB

Download
memory/3044-911-0x00000000080E0000-0x000000000811C000-memory.dmp

Filesize
240KB

Download
memory/3044-910-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/3044-909-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/3044-908-0x0000000007950000-0x0000000007F68000-memory.dmp

Filesize
6.1MB

Download
memory/3044-117-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/3044-114-0x0000000000D40000-0x0000000000D7C000-memory.dmp

Filesize
240KB

Download
memory/3044-119-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/3044-121-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/4740-85-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-91-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-75-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-73-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-89-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-69-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-79-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-81-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-83-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-77-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-93-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-87-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-71-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-65-0x0000000002570000-0x0000000002588000-memory.dmp

Filesize
96KB

Download
memory/4740-64-0x0000000000B00000-0x0000000000B1A000-memory.dmp

Filesize
104KB

Download
memory/4740-67-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-66-0x0000000002570000-0x0000000002582000-memory.dmp

Filesize
72KB

Download
memory/4740-94-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/4740-96-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download