amadey | 0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a.exe
Size

1.1MB
MD5

f2f47bac007be43f238281af8a07ef81
SHA1

f1a565c5a9fae8bd5a9eabb67fac258384091019
SHA256

0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a
SHA512

7a95af84971b643328c0237ccd9618295f9ace5fdbddc9afa8cd4e9d6c2e78654382af4ba56ea953febd067385008027555cf0a23bcffc8a0180f2a893f12a28
SSDEEP

24576:iy1mEFMKwcFXvSht5bKoRb1VUYnv0TXe9NUGy2T6:J1tN7Nahtc0GYv0TXYUL

Score

10^/10

amadey healer redline 9c0adb discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3040-28-0x0000000002340000-0x000000000235A000-memory.dmp	healer
behavioral1/memory/3040-30-0x0000000004980000-0x0000000004998000-memory.dmp	healer
behavioral1/memory/3040-58-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-56-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-55-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-53-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-50-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-48-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-46-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-45-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-42-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-40-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-38-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-36-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-34-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-31-0x0000000004980000-0x0000000004993000-memory.dmp	healer
behavioral1/memory/3040-32-0x0000000004980000-0x0000000004993000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	284897979.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	187893560.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	187893560.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	187893560.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	187893560.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	187893560.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	284897979.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	284897979.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	284897979.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	187893560.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	284897979.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/2040-112-0x0000000002510000-0x000000000254C000-memory.dmp	family_redline
behavioral1/memory/2040-113-0x0000000004A80000-0x0000000004ABA000-memory.dmp	family_redline
behavioral1/memory/2040-119-0x0000000004A80000-0x0000000004AB5000-memory.dmp	family_redline
behavioral1/memory/2040-117-0x0000000004A80000-0x0000000004AB5000-memory.dmp	family_redline
behavioral1/memory/2040-115-0x0000000004A80000-0x0000000004AB5000-memory.dmp	family_redline
behavioral1/memory/2040-114-0x0000000004A80000-0x0000000004AB5000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	397770948.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 10 IoCs

pid	Process
2460	nR392930.exe
1524	fe900061.exe
1896	nX386701.exe
3040	187893560.exe
4604	284897979.exe
2044	397770948.exe
1224	oneetx.exe
2040	482141081.exe
2496	oneetx.exe
4684	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	284897979.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	187893560.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	187893560.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nR392930.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	fe900061.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	nX386701.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	4604	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	482141081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nR392930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nX386701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	187893560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe900061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	284897979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	397770948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3040	187893560.exe
3040	187893560.exe
4604	284897979.exe
4604	284897979.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	187893560.exe
Token: SeDebugPrivilege	4604	284897979.exe
Token: SeDebugPrivilege	2040	482141081.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	397770948.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 2460	3360	0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a.exe	83
PID 3360 wrote to memory of 2460	3360	0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a.exe	83
PID 3360 wrote to memory of 2460	3360	0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a.exe	83
PID 2460 wrote to memory of 1524	2460	nR392930.exe	84
PID 2460 wrote to memory of 1524	2460	nR392930.exe	84
PID 2460 wrote to memory of 1524	2460	nR392930.exe	84
PID 1524 wrote to memory of 1896	1524	fe900061.exe	86
PID 1524 wrote to memory of 1896	1524	fe900061.exe	86
PID 1524 wrote to memory of 1896	1524	fe900061.exe	86
PID 1896 wrote to memory of 3040	1896	nX386701.exe	87
PID 1896 wrote to memory of 3040	1896	nX386701.exe	87
PID 1896 wrote to memory of 3040	1896	nX386701.exe	87
PID 1896 wrote to memory of 4604	1896	nX386701.exe	97
PID 1896 wrote to memory of 4604	1896	nX386701.exe	97
PID 1896 wrote to memory of 4604	1896	nX386701.exe	97
PID 1524 wrote to memory of 2044	1524	fe900061.exe	102
PID 1524 wrote to memory of 2044	1524	fe900061.exe	102
PID 1524 wrote to memory of 2044	1524	fe900061.exe	102
PID 2044 wrote to memory of 1224	2044	397770948.exe	103
PID 2044 wrote to memory of 1224	2044	397770948.exe	103
PID 2044 wrote to memory of 1224	2044	397770948.exe	103
PID 2460 wrote to memory of 2040	2460	nR392930.exe	104
PID 2460 wrote to memory of 2040	2460	nR392930.exe	104
PID 2460 wrote to memory of 2040	2460	nR392930.exe	104
PID 1224 wrote to memory of 2720	1224	oneetx.exe	105
PID 1224 wrote to memory of 2720	1224	oneetx.exe	105
PID 1224 wrote to memory of 2720	1224	oneetx.exe	105
PID 1224 wrote to memory of 1360	1224	oneetx.exe	107
PID 1224 wrote to memory of 1360	1224	oneetx.exe	107
PID 1224 wrote to memory of 1360	1224	oneetx.exe	107
PID 1360 wrote to memory of 5040	1360	cmd.exe	109
PID 1360 wrote to memory of 5040	1360	cmd.exe	109
PID 1360 wrote to memory of 5040	1360	cmd.exe	109
PID 1360 wrote to memory of 4672	1360	cmd.exe	110
PID 1360 wrote to memory of 4672	1360	cmd.exe	110
PID 1360 wrote to memory of 4672	1360	cmd.exe	110
PID 1360 wrote to memory of 8	1360	cmd.exe	111
PID 1360 wrote to memory of 8	1360	cmd.exe	111
PID 1360 wrote to memory of 8	1360	cmd.exe	111
PID 1360 wrote to memory of 5004	1360	cmd.exe	112
PID 1360 wrote to memory of 5004	1360	cmd.exe	112
PID 1360 wrote to memory of 5004	1360	cmd.exe	112
PID 1360 wrote to memory of 2300	1360	cmd.exe	113
PID 1360 wrote to memory of 2300	1360	cmd.exe	113
PID 1360 wrote to memory of 2300	1360	cmd.exe	113
PID 1360 wrote to memory of 3056	1360	cmd.exe	114
PID 1360 wrote to memory of 3056	1360	cmd.exe	114
PID 1360 wrote to memory of 3056	1360	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a.exe
"C:\Users\Admin\AppData\Local\Temp\0b7f069b0e865a2389cd6f76569acead8e637f433d9a6e6e6b3d4cce9c9b366a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nR392930.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nR392930.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fe900061.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fe900061.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nX386701.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nX386701.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\187893560.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\187893560.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\284897979.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\284897979.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4604
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1080
        6⤵
        Program crash
        
        PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\397770948.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\397770948.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1224
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2720
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\482141081.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\482141081.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4604 -ip 4604
1⤵
PID:1848

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nR392930.exe

Filesize
939KB

MD5
107cecf89f3121c9a554fa2980f114eb

SHA1
1b86b48ea238c9258ed0c44e6180dc349d5401b5

SHA256
73fb496a5dfdae0d79b17351d238eb20555c8a67f658bc45c58e2c1b361ea676

SHA512
6a90a2b660c7abfd3766b318d255f361f77d0ddfe3cc1bf0bd7346bbe3f1326ab1d75ec251fd67eec639f1a5166ed38fe4d7da9a4dccb36d0fa9ae8f494bcdcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\482141081.exe

Filesize
341KB

MD5
526d7e49199b8a9f41aa6b7a2a78da70

SHA1
139ac7b0aa52746745a12bf8f9cfbbd232012928

SHA256
ecec4b87ea3f80fb88e105e070e149cd1d505844b45719a8ef02b409ce3c22c4

SHA512
82fe9fe03f0b42de2d070ee731a5c15d116cdfbe15d9e8876959c047d938f12516440af5cbae98612edd9b106454cf430f3db18d387f775d6e3ebd5e9e816ae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fe900061.exe

Filesize
585KB

MD5
17262f4ebdab22b162cb2a6eb1b8a3e5

SHA1
2fb16f5579ee4b5136096518b62c18423955c51b

SHA256
9c8054d5c765aec3bd1f5eb8d02bec7c92d51f1b74b1ecc6b2c0d3f66951a08d

SHA512
7079bd5c414efbc91eeeb70ae746db818af12f00f118b62c4c0361521db0b14ce8178ce0133c98cfe34b4c7c14f624d78fa916a47869b80494f401d3fd932a59

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\397770948.exe

Filesize
204KB

MD5
1304f384653e08ae497008ff13498608

SHA1
d9a76ed63d74d4217c5027757cb9a7a0d0093080

SHA256
2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

SHA512
4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nX386701.exe

Filesize
414KB

MD5
9b0d0611373000055efc2f646ab37a7c

SHA1
854b6bcf22625b46ca2c7253f327bec355493390

SHA256
1bbbb6e22215388cabcb69991610c64b1bb2dd97bb18249545c306315a43e2a6

SHA512
ca85cf78997500f05bbcdec8edc436713da8e8ae836747bf5fd8d6642c524c50b4af26c951a83ffd2471d263748229d6dc1b09934ef0806eebbf103213ec1e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\187893560.exe

Filesize
175KB

MD5
a165b5f6b0a4bdf808b71de57bf9347d

SHA1
39a7b301e819e386c162a47e046fa384bb5ab437

SHA256
68349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a

SHA512
3dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\284897979.exe

Filesize
258KB

MD5
895633311f2b11b2285dc80e15beb615

SHA1
1f954281a683581a106abd3ed1a069e5d78063fb

SHA256
6ab0e14e8dbaa7bfbb4488f7631ec3cf9c02a43f55950c2dbcd9420cc505dadf

SHA512
e550060da7361c6e2181bd129b9cb1797a48cbf1bef25135d60266a6b924971208466825d2c1baf79eaebf2a93571a88f04893a0dfa65079e77e7764122a4147

Download Submit
memory/2040-906-0x00000000075B0000-0x0000000007BC8000-memory.dmp

Filesize
6.1MB

Download
memory/2040-907-0x0000000007BF0000-0x0000000007C02000-memory.dmp

Filesize
72KB

Download
memory/2040-908-0x0000000007C10000-0x0000000007D1A000-memory.dmp

Filesize
1.0MB

Download
memory/2040-114-0x0000000004A80000-0x0000000004AB5000-memory.dmp

Filesize
212KB

Download
memory/2040-115-0x0000000004A80000-0x0000000004AB5000-memory.dmp

Filesize
212KB

Download
memory/2040-117-0x0000000004A80000-0x0000000004AB5000-memory.dmp

Filesize
212KB

Download
memory/2040-119-0x0000000004A80000-0x0000000004AB5000-memory.dmp

Filesize
212KB

Download
memory/2040-113-0x0000000004A80000-0x0000000004ABA000-memory.dmp

Filesize
232KB

Download
memory/2040-112-0x0000000002510000-0x000000000254C000-memory.dmp

Filesize
240KB

Download
memory/2040-909-0x0000000007D30000-0x0000000007D6C000-memory.dmp

Filesize
240KB

Download
memory/2040-910-0x00000000045B0000-0x00000000045FC000-memory.dmp

Filesize
304KB

Download
memory/3040-55-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-50-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-31-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-32-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-36-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-28-0x0000000002340000-0x000000000235A000-memory.dmp

Filesize
104KB

Download
memory/3040-29-0x0000000004A40000-0x0000000004FE4000-memory.dmp

Filesize
5.6MB

Download
memory/3040-38-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-40-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-42-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-45-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-46-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-48-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-34-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-53-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-56-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-58-0x0000000004980000-0x0000000004993000-memory.dmp

Filesize
76KB

Download
memory/3040-30-0x0000000004980000-0x0000000004998000-memory.dmp

Filesize
96KB

Download
memory/4604-94-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4604-92-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download