amadey | 3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408.exe
Size

1.2MB
MD5

fd3ee3e48dd9eb3c5ce1311876e68615
SHA1

44b6d3a55f2279e4a716f2074f609e57241bb9c9
SHA256

3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408
SHA512

951113f5292df5557dd372d6e979741be2c81222644bb84e052335fea8a24468f4c19fdb0605fcb7f516decba0f954bbd926f13a0d478b9a1c119ceabcdaa4be
SSDEEP

24576:cyNN2N9BDTDwgp85Wbcv600vXhewmplEL5O5XIqDo7sl:LNN2jJDw2yWbcvn6X3uEL4dIq

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 34 IoCs

resource	yara_rule
behavioral1/memory/1000-28-0x00000000021A0000-0x00000000021BA000-memory.dmp	healer
behavioral1/memory/1000-30-0x00000000024A0000-0x00000000024B8000-memory.dmp	healer
behavioral1/memory/1000-38-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-36-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-58-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-56-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-54-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-52-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-50-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-48-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-46-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-44-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-42-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-40-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-34-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-32-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/1000-31-0x00000000024A0000-0x00000000024B3000-memory.dmp	healer
behavioral1/memory/624-64-0x00000000023C0000-0x00000000023DA000-memory.dmp	healer
behavioral1/memory/624-65-0x00000000028D0000-0x00000000028E8000-memory.dmp	healer
behavioral1/memory/624-66-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-73-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-93-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-92-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-89-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-88-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-85-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-84-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-81-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-79-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-77-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-75-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-72-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-69-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer
behavioral1/memory/624-67-0x00000000028D0000-0x00000000028E2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	152975410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	152975410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	269148369.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	152975410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	152975410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	152975410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	269148369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	269148369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	269148369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	269148369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	152975410.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/868-114-0x00000000028D0000-0x000000000290C000-memory.dmp	family_redline
behavioral1/memory/868-115-0x0000000004E10000-0x0000000004E4A000-memory.dmp	family_redline
behavioral1/memory/868-121-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/868-119-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/868-116-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/868-117-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	317007509.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
1440	yA133929.exe
4616	Ty610437.exe
5036	Al695610.exe
1000	152975410.exe
624	269148369.exe
428	317007509.exe
1640	oneetx.exe
868	429520107.exe
3788	oneetx.exe
2848	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	152975410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	152975410.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	269148369.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	yA133929.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Ty610437.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Al695610.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4108	624	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ty610437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Al695610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	152975410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	269148369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	317007509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	429520107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yA133929.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1000	152975410.exe
1000	152975410.exe
624	269148369.exe
624	269148369.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	152975410.exe
Token: SeDebugPrivilege	624	269148369.exe
Token: SeDebugPrivilege	868	429520107.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
428	317007509.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1440	3736	3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408.exe	83
PID 3736 wrote to memory of 1440	3736	3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408.exe	83
PID 3736 wrote to memory of 1440	3736	3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408.exe	83
PID 1440 wrote to memory of 4616	1440	yA133929.exe	84
PID 1440 wrote to memory of 4616	1440	yA133929.exe	84
PID 1440 wrote to memory of 4616	1440	yA133929.exe	84
PID 4616 wrote to memory of 5036	4616	Ty610437.exe	86
PID 4616 wrote to memory of 5036	4616	Ty610437.exe	86
PID 4616 wrote to memory of 5036	4616	Ty610437.exe	86
PID 5036 wrote to memory of 1000	5036	Al695610.exe	88
PID 5036 wrote to memory of 1000	5036	Al695610.exe	88
PID 5036 wrote to memory of 1000	5036	Al695610.exe	88
PID 5036 wrote to memory of 624	5036	Al695610.exe	94
PID 5036 wrote to memory of 624	5036	Al695610.exe	94
PID 5036 wrote to memory of 624	5036	Al695610.exe	94
PID 4616 wrote to memory of 428	4616	Ty610437.exe	98
PID 4616 wrote to memory of 428	4616	Ty610437.exe	98
PID 4616 wrote to memory of 428	4616	Ty610437.exe	98
PID 428 wrote to memory of 1640	428	317007509.exe	99
PID 428 wrote to memory of 1640	428	317007509.exe	99
PID 428 wrote to memory of 1640	428	317007509.exe	99
PID 1440 wrote to memory of 868	1440	yA133929.exe	100
PID 1440 wrote to memory of 868	1440	yA133929.exe	100
PID 1440 wrote to memory of 868	1440	yA133929.exe	100
PID 1640 wrote to memory of 4876	1640	oneetx.exe	101
PID 1640 wrote to memory of 4876	1640	oneetx.exe	101
PID 1640 wrote to memory of 4876	1640	oneetx.exe	101
PID 1640 wrote to memory of 3768	1640	oneetx.exe	103
PID 1640 wrote to memory of 3768	1640	oneetx.exe	103
PID 1640 wrote to memory of 3768	1640	oneetx.exe	103
PID 3768 wrote to memory of 1672	3768	cmd.exe	105
PID 3768 wrote to memory of 1672	3768	cmd.exe	105
PID 3768 wrote to memory of 1672	3768	cmd.exe	105
PID 3768 wrote to memory of 4444	3768	cmd.exe	106
PID 3768 wrote to memory of 4444	3768	cmd.exe	106
PID 3768 wrote to memory of 4444	3768	cmd.exe	106
PID 3768 wrote to memory of 2624	3768	cmd.exe	107
PID 3768 wrote to memory of 2624	3768	cmd.exe	107
PID 3768 wrote to memory of 2624	3768	cmd.exe	107
PID 3768 wrote to memory of 1632	3768	cmd.exe	108
PID 3768 wrote to memory of 1632	3768	cmd.exe	108
PID 3768 wrote to memory of 1632	3768	cmd.exe	108
PID 3768 wrote to memory of 3904	3768	cmd.exe	109
PID 3768 wrote to memory of 3904	3768	cmd.exe	109
PID 3768 wrote to memory of 3904	3768	cmd.exe	109
PID 3768 wrote to memory of 112	3768	cmd.exe	110
PID 3768 wrote to memory of 112	3768	cmd.exe	110
PID 3768 wrote to memory of 112	3768	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408.exe
"C:\Users\Admin\AppData\Local\Temp\3b5bd420b211b26dac93b287ada20ad42ee48583561c6e7c0eebdfc665e1c408.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yA133929.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yA133929.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ty610437.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ty610437.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Al695610.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Al695610.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\152975410.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\152975410.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\269148369.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\269148369.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 1140
        6⤵
        Program crash
        
        PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\317007509.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\317007509.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:428
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1640
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4876
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:112
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\429520107.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\429520107.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 624 -ip 624
1⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:3788

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yA133929.exe

Filesize
1.0MB

MD5
2725ba0cae9d50d104754a10bafb3665

SHA1
0ff586ffc8e588d5a969ba1e3ff8b3ef32a48e40

SHA256
e52084cc780038bb53e7e1105a46aa702578a25b3f1fdd96f4b800133a467b38

SHA512
d30248fae890e08e3ce6c5fd4b433cc45bef9ab722b07329c28412d973b6268769f5ef25ebb809ec475c4796102b66acf867c6f0c2d5c94d9d87553a6b2e8a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\429520107.exe

Filesize
461KB

MD5
f937c27acbbb851d1360d779346c5a8d

SHA1
5b164dc4062608e98139f3a3912354dd90f9323b

SHA256
8926fddee482b272de564c8c36c7de5b3589d96a2527f3c558425490edeb02aa

SHA512
0839f950b158ab9740fcf06f6c6c8ce6411fb693116c0e6c1a206c46ddf5f659aa6fe7a2859c7e2c852bdd2ef98943db46197128bb25f0e717bb3c6cb113a5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ty610437.exe

Filesize
639KB

MD5
19ab1089ddd3640d36b4f4ab65f9ca92

SHA1
06707389d9b5ec0bbdf285279792497b1a5556f6

SHA256
a5aac751f348ae4d95d9197d0d60af72d050b7fdeabbe556684bfbadf79e3705

SHA512
35876524c18a51fc443d7bee7be5301721d37bf5473fe5cb175c3ec5339f2456a07017eb6b5cd3df56311b5553d9720ddf03016c5c4a79ab97a71f9a4d749c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\317007509.exe

Filesize
204KB

MD5
14b2ed5ced0c7d26f4f20ef6a16ce1b4

SHA1
c1316d319ed5004540626252079bcbdc946199e4

SHA256
d8ae84771fac8370d8126ee2eae3e7fd9cb363beaae36f403af54cfab8428f96

SHA512
7f202f9c2faf237bc35d6f14c6bd1b5e2a7d90e87874484746698a064573d21c9324968b0a8e756d74d83a22a0598ac7e843b844b51bfba8609e6cc835f6e7e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Al695610.exe

Filesize
467KB

MD5
1bb4d3baf75c10c0f9ad8d770f2b48ab

SHA1
32f3022433da8fef73f9ae4ba5089c443ad51fba

SHA256
56850addecde396ced9715c644f5d35a11ab10525844d7788d7bce4bf189f8ed

SHA512
daee57c9b176fefda66b0063fbd808b51df727dd98324026560a7161f6f27fb3f484acff04f49087cdd7d0a4f4b876f2cea681d427cf33174746901de088d802

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\152975410.exe

Filesize
176KB

MD5
4fb09bc0c3880be466781988bfe98dd7

SHA1
25230ecefc2da502fb97baae88e8a61baabac836

SHA256
75b7c26a47b08532385889d6250587a000fbd1421fbb3458077654069d5b783d

SHA512
5366f477e10a3ffd55a52534e3682e61612d24bb97781c2d7a0d53e772d90fbc4377b83ff5f19f4f7162e9e45ebf563941dcf2a36117076ac8feb1812cbd5c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\269148369.exe

Filesize
378KB

MD5
a8e1c0bab205eab336d93105e3f3afd7

SHA1
c22aa3d2f4002f4476492c3f599c3fcd395a9cb0

SHA256
a7c4cf0a974cffe900b6f6f86af8c9a3115699e1c5ca70f1a0de8e8ac5d2b5e2

SHA512
8dab4106a44da152ab483d2eddcff097f6cfc4d002637c6d61b4fb86544220a9b323dde13356d257fd740d2f829f448d90999e228f6b2ddac540d2c2e60c244a

Download Submit
memory/624-67-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-89-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-77-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-79-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-81-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-84-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-85-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-88-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-75-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-92-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-93-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-73-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-66-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-95-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/624-69-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-72-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/624-64-0x00000000023C0000-0x00000000023DA000-memory.dmp

Filesize
104KB

Download
memory/624-65-0x00000000028D0000-0x00000000028E8000-memory.dmp

Filesize
96KB

Download
memory/868-114-0x00000000028D0000-0x000000000290C000-memory.dmp

Filesize
240KB

Download
memory/868-115-0x0000000004E10000-0x0000000004E4A000-memory.dmp

Filesize
232KB

Download
memory/868-121-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/868-119-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/868-116-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/868-117-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/868-908-0x0000000007F60000-0x0000000008578000-memory.dmp

Filesize
6.1MB

Download
memory/868-909-0x0000000007980000-0x0000000007992000-memory.dmp

Filesize
72KB

Download
memory/868-910-0x00000000079A0000-0x0000000007AAA000-memory.dmp

Filesize
1.0MB

Download
memory/868-911-0x0000000007AC0000-0x0000000007AFC000-memory.dmp

Filesize
240KB

Download
memory/868-912-0x0000000002720000-0x000000000276C000-memory.dmp

Filesize
304KB

Download
memory/1000-34-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-38-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-31-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-30-0x00000000024A0000-0x00000000024B8000-memory.dmp

Filesize
96KB

Download
memory/1000-32-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-29-0x0000000004B60000-0x0000000005104000-memory.dmp

Filesize
5.6MB

Download
memory/1000-28-0x00000000021A0000-0x00000000021BA000-memory.dmp

Filesize
104KB

Download
memory/1000-36-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-40-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-42-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-44-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-46-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-48-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-50-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-52-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-54-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-56-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download
memory/1000-58-0x00000000024A0000-0x00000000024B3000-memory.dmp

Filesize
76KB

Download