amadey | 8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba.exe
Size

1.1MB
MD5

7bba61e57e0af5e72705db1f913396b5
SHA1

9490d37ccf7ba8c7bc93867dc58e7b28c17cff99
SHA256

8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba
SHA512

d7ef8a55d494140a514f079c87c888b363089e849f2c8eba0fd72667d4f98bef1ddb0226e03fa2984d9f3c9a97a1264b0bba5092b5a31569f2b471fae17f5ac3
SSDEEP

24576:4yJ8CZHYrAT+ftEUl3yk9M9bO+PJ+npQiYd6ufBMNL7TECk5:/G2HDHUlBMk0J+n6J5UFk

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/836-28-0x00000000048D0000-0x00000000048EA000-memory.dmp	healer
behavioral1/memory/836-30-0x0000000004F40000-0x0000000004F58000-memory.dmp	healer
behavioral1/memory/836-34-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-58-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-56-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-54-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-52-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-50-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-46-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-45-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-42-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-40-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-38-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-36-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-32-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-31-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer
behavioral1/memory/836-48-0x0000000004F40000-0x0000000004F53000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	216113896.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	107978475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	107978475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	107978475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	216113896.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	216113896.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	216113896.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	107978475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	107978475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	107978475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	216113896.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/3656-112-0x0000000004DC0000-0x0000000004DFC000-memory.dmp	family_redline
behavioral1/memory/3656-113-0x00000000072C0000-0x00000000072FA000-memory.dmp	family_redline
behavioral1/memory/3656-117-0x00000000072C0000-0x00000000072F5000-memory.dmp	family_redline
behavioral1/memory/3656-115-0x00000000072C0000-0x00000000072F5000-memory.dmp	family_redline
behavioral1/memory/3656-114-0x00000000072C0000-0x00000000072F5000-memory.dmp	family_redline
behavioral1/memory/3656-119-0x00000000072C0000-0x00000000072F5000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	320274073.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
2800	lE263095.exe
3752	Ed018579.exe
5056	xn451183.exe
836	107978475.exe
2616	216113896.exe
3948	320274073.exe
4308	oneetx.exe
3656	422461510.exe
3488	oneetx.exe
5932	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	216113896.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	107978475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	107978475.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Ed018579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	xn451183.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	lE263095.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1588	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2616	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	107978475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lE263095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xn451183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	320274073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ed018579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	216113896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	422461510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
836	107978475.exe
836	107978475.exe
2616	216113896.exe
2616	216113896.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	107978475.exe
Token: SeDebugPrivilege	2616	216113896.exe
Token: SeDebugPrivilege	3656	422461510.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3948	320274073.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2800	412	8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba.exe	83
PID 412 wrote to memory of 2800	412	8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba.exe	83
PID 412 wrote to memory of 2800	412	8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba.exe	83
PID 2800 wrote to memory of 3752	2800	lE263095.exe	84
PID 2800 wrote to memory of 3752	2800	lE263095.exe	84
PID 2800 wrote to memory of 3752	2800	lE263095.exe	84
PID 3752 wrote to memory of 5056	3752	Ed018579.exe	86
PID 3752 wrote to memory of 5056	3752	Ed018579.exe	86
PID 3752 wrote to memory of 5056	3752	Ed018579.exe	86
PID 5056 wrote to memory of 836	5056	xn451183.exe	87
PID 5056 wrote to memory of 836	5056	xn451183.exe	87
PID 5056 wrote to memory of 836	5056	xn451183.exe	87
PID 5056 wrote to memory of 2616	5056	xn451183.exe	97
PID 5056 wrote to memory of 2616	5056	xn451183.exe	97
PID 5056 wrote to memory of 2616	5056	xn451183.exe	97
PID 3752 wrote to memory of 3948	3752	Ed018579.exe	102
PID 3752 wrote to memory of 3948	3752	Ed018579.exe	102
PID 3752 wrote to memory of 3948	3752	Ed018579.exe	102
PID 3948 wrote to memory of 4308	3948	320274073.exe	103
PID 3948 wrote to memory of 4308	3948	320274073.exe	103
PID 3948 wrote to memory of 4308	3948	320274073.exe	103
PID 2800 wrote to memory of 3656	2800	lE263095.exe	104
PID 2800 wrote to memory of 3656	2800	lE263095.exe	104
PID 2800 wrote to memory of 3656	2800	lE263095.exe	104
PID 4308 wrote to memory of 1992	4308	oneetx.exe	105
PID 4308 wrote to memory of 1992	4308	oneetx.exe	105
PID 4308 wrote to memory of 1992	4308	oneetx.exe	105
PID 4308 wrote to memory of 1388	4308	oneetx.exe	107
PID 4308 wrote to memory of 1388	4308	oneetx.exe	107
PID 4308 wrote to memory of 1388	4308	oneetx.exe	107
PID 1388 wrote to memory of 4120	1388	cmd.exe	109
PID 1388 wrote to memory of 4120	1388	cmd.exe	109
PID 1388 wrote to memory of 4120	1388	cmd.exe	109
PID 1388 wrote to memory of 3724	1388	cmd.exe	110
PID 1388 wrote to memory of 3724	1388	cmd.exe	110
PID 1388 wrote to memory of 3724	1388	cmd.exe	110
PID 1388 wrote to memory of 3896	1388	cmd.exe	111
PID 1388 wrote to memory of 3896	1388	cmd.exe	111
PID 1388 wrote to memory of 3896	1388	cmd.exe	111
PID 1388 wrote to memory of 2472	1388	cmd.exe	112
PID 1388 wrote to memory of 2472	1388	cmd.exe	112
PID 1388 wrote to memory of 2472	1388	cmd.exe	112
PID 1388 wrote to memory of 2220	1388	cmd.exe	113
PID 1388 wrote to memory of 2220	1388	cmd.exe	113
PID 1388 wrote to memory of 2220	1388	cmd.exe	113
PID 1388 wrote to memory of 5040	1388	cmd.exe	114
PID 1388 wrote to memory of 5040	1388	cmd.exe	114
PID 1388 wrote to memory of 5040	1388	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba.exe
"C:\Users\Admin\AppData\Local\Temp\8e02fc29e9dd9999bec7b79b74c7524dd981fce8b5d3a0601c6f1567d05fddba.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:412
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lE263095.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lE263095.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ed018579.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ed018579.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xn451183.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xn451183.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\107978475.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\107978475.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216113896.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216113896.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1064
        6⤵
        Program crash
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\320274073.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\320274073.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4308
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1992
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\422461510.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\422461510.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2616 -ip 2616
1⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lE263095.exe

Filesize
930KB

MD5
1eddd385723a4091deb5df6b009debac

SHA1
4a55fd02275ffd87a9c37355671c2aa98b7b1d2a

SHA256
8331f9f7f50162111fa0c2e4d1e729b624b698e2895889dc688c168d912d036f

SHA512
ce45f5f0915d39f5c2b32b13bed69b8a2ad400cb11dcab09bf66b288a445580d5fe690667a2e2ee1f9833428b7634f205c7843c76167f032fdc3c8bf99650be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\422461510.exe

Filesize
341KB

MD5
4209683a32951cc146b50f3860a5e2f8

SHA1
dca329790ff2c43cc226d368a9ed1ab1c7c416b9

SHA256
0f1735df2eae40ba1c864792d91f496ac8bb94509917983eaa28d825cb8deb8a

SHA512
167bc9e105228277b09f6cbfbb63836f529abf528c8dd6be2fe892d2af7af120929c8c0eddbbf4be13215274313cd9bc29150a2f10f5743800b31f62c5b88c60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ed018579.exe

Filesize
577KB

MD5
234b286940c6fe4c3da1519f2982e428

SHA1
7526851faf4b19997fd5655f0d27690e5e274fd3

SHA256
3133d81661cb41dd12f2c7ae68ded8491edbc55837234f9c0284449b71db80ce

SHA512
5994dcc48968ebe1ae8ba42675d94d6cf2885ca9fea38caea747edc161819b9e208e40a3dd494590ad3a0078fc7590f828f1e481ad896ba23e250d4d85c6ecd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\320274073.exe

Filesize
204KB

MD5
1304f384653e08ae497008ff13498608

SHA1
d9a76ed63d74d4217c5027757cb9a7a0d0093080

SHA256
2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

SHA512
4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xn451183.exe

Filesize
405KB

MD5
cb39defe93cb4e64829f988a2f3a71bb

SHA1
d2d82e1cb21bba2a42ab997a0ffe5ddce3835f57

SHA256
a87d7a1d85acff160953c42013b24a1d3a844654ab2a41f7c4dc6569fc0bde4d

SHA512
800edbd4dc4d37786134511f9ddef112ad949813ca20f4da6fbfebf66d8995c4856ac7d0138058acac15ac2e7f294c1e81731135f741594ed90a53564dcb28a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\107978475.exe

Filesize
176KB

MD5
2b71f4b18ac8214a2bff547b6ce2f64f

SHA1
b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

SHA256
f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

SHA512
33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216113896.exe

Filesize
258KB

MD5
ea4c778e2b9d7538977460496198026b

SHA1
84c24d6befad965ab2859794aa7347780fff4de3

SHA256
bed2340a6db094882237b4bff72baf8936aa7a1c9e0b7392afe68e3407fc6c65

SHA512
2a239f75997640a708b857ec8ca362050c91638f21b856eb635b0fdfc74caf261336930a23adadd1e5085f2c53b291e9616026ccd3f8e370cd3c70ac01957688

Download Submit
memory/836-36-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-30-0x0000000004F40000-0x0000000004F58000-memory.dmp

Filesize
96KB

Download
memory/836-56-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-54-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-52-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-50-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-46-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-45-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-42-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-40-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-38-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-34-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-32-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-31-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-48-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-58-0x0000000004F40000-0x0000000004F53000-memory.dmp

Filesize
76KB

Download
memory/836-28-0x00000000048D0000-0x00000000048EA000-memory.dmp

Filesize
104KB

Download
memory/836-29-0x0000000004930000-0x0000000004ED4000-memory.dmp

Filesize
5.6MB

Download
memory/2616-94-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download
memory/2616-92-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download
memory/3656-114-0x00000000072C0000-0x00000000072F5000-memory.dmp

Filesize
212KB

Download
memory/3656-113-0x00000000072C0000-0x00000000072FA000-memory.dmp

Filesize
232KB

Download
memory/3656-117-0x00000000072C0000-0x00000000072F5000-memory.dmp

Filesize
212KB

Download
memory/3656-115-0x00000000072C0000-0x00000000072F5000-memory.dmp

Filesize
212KB

Download
memory/3656-112-0x0000000004DC0000-0x0000000004DFC000-memory.dmp

Filesize
240KB

Download
memory/3656-119-0x00000000072C0000-0x00000000072F5000-memory.dmp

Filesize
212KB

Download
memory/3656-906-0x0000000009DD0000-0x000000000A3E8000-memory.dmp

Filesize
6.1MB

Download
memory/3656-907-0x000000000A470000-0x000000000A482000-memory.dmp

Filesize
72KB

Download
memory/3656-908-0x000000000A490000-0x000000000A59A000-memory.dmp

Filesize
1.0MB

Download
memory/3656-909-0x000000000A5B0000-0x000000000A5EC000-memory.dmp

Filesize
240KB

Download
memory/3656-910-0x0000000004BE0000-0x0000000004C2C000-memory.dmp

Filesize
304KB

Download