amadey | 46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exe
Size

1.7MB
MD5

5f9688cd14e2b49f3bd2de113c271975
SHA1

81bf9a848e0eba741e9b1c7100e338016d817c31
SHA256

46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9
SHA512

88b82e208d56dabda21f4c8b5a95d237c49c0d7edfbc0fae315e42a03c6707cf7bcc31974328181ef036465d4c120b606af0f635bff96cd27579244c4a3a215f
SSDEEP

24576:oy5ntwV7z/6EXwvZ5xCWiw94WtIi5Zqz8yNqY0vLNo+uxft0/UNao2t67PNme0QZ:v5n6/pXET1jt9qeLa+uxftVhfYjQk

Score

10^/10

amadey healer redline 9c0adb most discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

185.161.248.73:4164

Attributes

auth_value
7da4dfa153f2919e617aa016f7c36008

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4792-2166-0x00000000052F0000-0x00000000052FA000-memory.dmp	healer
C:\Windows\Temp\1.exe	healer
behavioral1/memory/4560-2181-0x0000000000070000-0x000000000007A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/6136-6480-0x0000000005770000-0x00000000057A2000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f25378829.exe	family_redline
behavioral1/memory/3888-6486-0x0000000000430000-0x0000000000460000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a87648516.exec99692866.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	a87648516.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	c99692866.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 14 IoCs

Processes:

ev095721.exeQs183801.exeeM990013.exeNf205023.exea87648516.exe1.exeb78125950.exec99692866.exeoneetx.exed34423980.exef25378829.exeoneetx.exeoneetx.exeoneetx.exe

pid	process
3680	ev095721.exe
1120	Qs183801.exe
3304	eM990013.exe
4908	Nf205023.exe
4792	a87648516.exe
4560	1.exe
3820	b78125950.exe
5268	c99692866.exe
4364	oneetx.exe
6136	d34423980.exe
3888	f25378829.exe
6120	oneetx.exe
3876	oneetx.exe
312	oneetx.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

1.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Nf205023.exe46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exeev095721.exeQs183801.exeeM990013.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Nf205023.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ev095721.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Qs183801.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	eM990013.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

6056 3820 WerFault.exe b78125950.exe
4144 6136 WerFault.exe d34423980.exe

pid	pid_target	process	target process
6056	3820	WerFault.exe	b78125950.exe
4144	6136	WerFault.exe	d34423980.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.execacls.exe46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exeb78125950.execmd.execacls.exeNf205023.exeoneetx.exed34423980.exec99692866.exeQs183801.exeeM990013.exea87648516.execmd.execmd.execacls.execacls.exeev095721.exef25378829.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b78125950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nf205023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d34423980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c99692866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qs183801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eM990013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a87648516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev095721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f25378829.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1428 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1.exe

pid process

4560 1.exe
4560 1.exe

pid	process
1428	schtasks.exe

pid	process
4560	1.exe
4560	1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a87648516.exeb78125950.exe1.exed34423980.exe

description	pid	process
Token: SeDebugPrivilege	4792	a87648516.exe
Token: SeDebugPrivilege	3820	b78125950.exe
Token: SeDebugPrivilege	4560	1.exe
Token: SeDebugPrivilege	6136	d34423980.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exeev095721.exeQs183801.exeeM990013.exeNf205023.exea87648516.exec99692866.exeoneetx.execmd.exe

description	pid	process	target process
PID 1360 wrote to memory of 3680	1360	46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exe	ev095721.exe
PID 1360 wrote to memory of 3680	1360	46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exe	ev095721.exe
PID 1360 wrote to memory of 3680	1360	46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exe	ev095721.exe
PID 3680 wrote to memory of 1120	3680	ev095721.exe	Qs183801.exe
PID 3680 wrote to memory of 1120	3680	ev095721.exe	Qs183801.exe
PID 3680 wrote to memory of 1120	3680	ev095721.exe	Qs183801.exe
PID 1120 wrote to memory of 3304	1120	Qs183801.exe	eM990013.exe
PID 1120 wrote to memory of 3304	1120	Qs183801.exe	eM990013.exe
PID 1120 wrote to memory of 3304	1120	Qs183801.exe	eM990013.exe
PID 3304 wrote to memory of 4908	3304	eM990013.exe	Nf205023.exe
PID 3304 wrote to memory of 4908	3304	eM990013.exe	Nf205023.exe
PID 3304 wrote to memory of 4908	3304	eM990013.exe	Nf205023.exe
PID 4908 wrote to memory of 4792	4908	Nf205023.exe	a87648516.exe
PID 4908 wrote to memory of 4792	4908	Nf205023.exe	a87648516.exe
PID 4908 wrote to memory of 4792	4908	Nf205023.exe	a87648516.exe
PID 4792 wrote to memory of 4560	4792	a87648516.exe	1.exe
PID 4792 wrote to memory of 4560	4792	a87648516.exe	1.exe
PID 4908 wrote to memory of 3820	4908	Nf205023.exe	b78125950.exe
PID 4908 wrote to memory of 3820	4908	Nf205023.exe	b78125950.exe
PID 4908 wrote to memory of 3820	4908	Nf205023.exe	b78125950.exe
PID 3304 wrote to memory of 5268	3304	eM990013.exe	c99692866.exe
PID 3304 wrote to memory of 5268	3304	eM990013.exe	c99692866.exe
PID 3304 wrote to memory of 5268	3304	eM990013.exe	c99692866.exe
PID 5268 wrote to memory of 4364	5268	c99692866.exe	oneetx.exe
PID 5268 wrote to memory of 4364	5268	c99692866.exe	oneetx.exe
PID 5268 wrote to memory of 4364	5268	c99692866.exe	oneetx.exe
PID 1120 wrote to memory of 6136	1120	Qs183801.exe	d34423980.exe
PID 1120 wrote to memory of 6136	1120	Qs183801.exe	d34423980.exe
PID 1120 wrote to memory of 6136	1120	Qs183801.exe	d34423980.exe
PID 4364 wrote to memory of 1428	4364	oneetx.exe	schtasks.exe
PID 4364 wrote to memory of 1428	4364	oneetx.exe	schtasks.exe
PID 4364 wrote to memory of 1428	4364	oneetx.exe	schtasks.exe
PID 4364 wrote to memory of 5468	4364	oneetx.exe	cmd.exe
PID 4364 wrote to memory of 5468	4364	oneetx.exe	cmd.exe
PID 4364 wrote to memory of 5468	4364	oneetx.exe	cmd.exe
PID 5468 wrote to memory of 4208	5468	cmd.exe	cmd.exe
PID 5468 wrote to memory of 4208	5468	cmd.exe	cmd.exe
PID 5468 wrote to memory of 4208	5468	cmd.exe	cmd.exe
PID 5468 wrote to memory of 3744	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 3744	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 3744	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 5592	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 5592	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 5592	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 4320	5468	cmd.exe	cmd.exe
PID 5468 wrote to memory of 4320	5468	cmd.exe	cmd.exe
PID 5468 wrote to memory of 4320	5468	cmd.exe	cmd.exe
PID 5468 wrote to memory of 5668	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 5668	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 5668	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 2892	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 2892	5468	cmd.exe	cacls.exe
PID 5468 wrote to memory of 2892	5468	cmd.exe	cacls.exe
PID 3680 wrote to memory of 3888	3680	ev095721.exe	f25378829.exe
PID 3680 wrote to memory of 3888	3680	ev095721.exe	f25378829.exe
PID 3680 wrote to memory of 3888	3680	ev095721.exe	f25378829.exe

C:\Users\Admin\AppData\Local\Temp\46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\46653e4e1d19971ffa722d0f1b18844ef6883a6ef21fc81ea9b458fe19f3a1f9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ev095721.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ev095721.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qs183801.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qs183801.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\eM990013.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\eM990013.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Nf205023.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Nf205023.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a87648516.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a87648516.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b78125950.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b78125950.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 1256
        7⤵
        Program crash
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c99692866.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c99692866.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1428
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4208
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d34423980.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d34423980.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 1232
        5⤵
        Program crash
        
        PID:4144
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f25378829.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f25378829.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3820 -ip 3820
1⤵
PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6136 -ip 6136
1⤵
PID:5240

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:6120

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:3876

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ev095721.exe

Filesize
1.4MB

MD5
f9a4c00d54aade6ffc55ed961ade207b

SHA1
a2cc9bdc296fecfecdaffe420bcc1e5d218d9646

SHA256
17e1cfe9a9231e74eb803c9c19db48e7dade4d453eb0d08ed21ec39044b2a7e8

SHA512
7909601796c1c4fb7d468514c583b45fb146a38b9a2273911d18f5bc62c6e0358af45956cced7608d9d7a4a0ce604046693d4da21d9db6e52348bd2db01282ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qs183801.exe

Filesize
1.3MB

MD5
24b9b8407fc8ceed8a50babe23015c06

SHA1
9f8eda8d65382496eaeedc2ae51b5eaaf5339378

SHA256
a578ec8a4a9022e7369e23547aff527b6b7aa586fc14fb6f9dedf2c0069a4de5

SHA512
a3d5346215ca5b9d93b4fb3ce29992843c33995a143dc0abe0746a46111a3957744de86f8d6c176d3c1879cb52263bb324fb40c5babb32635bb4b439f704d146

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f25378829.exe

Filesize
169KB

MD5
e320d206908ffcf2369f0f188f44b9d6

SHA1
026a2624623d55f6de608dd6348c4cb505258512

SHA256
2ce5103f50bd1a2497dca2e9452669633a9da24531ced9ae423161511eb9f31e

SHA512
a33b60e07106b997f806fa0d78cbc00ef0266791f84d746f0ae6830ad0f6a0bb1cf17c5f5ddf999bdbcc0cbae2affa983ce1a47002441c76cab9a3f43ef6b7e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d34423980.exe

Filesize
582KB

MD5
a218152b0c6ed89fc1fc997ab6527148

SHA1
e9dd9f21edd0a3ce9594d1e79874f71f1fe7b7f0

SHA256
be8afa497e00190a4d7a8345e8f2d2821bc5cdc0fb7ed7e44f269bf71c560624

SHA512
b501ca67d2a359f78d4aea2e83e604363a1069e79808608572d38cf616b92542938a87e1c74a8e95948b9fe9995f8a0bed18e1b8b5ad2f71d23e721f7c1f4522

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\eM990013.exe

Filesize
852KB

MD5
5a228df7a14b7dde402b054e2dd68168

SHA1
0645475b8ecfba7d34757a2e091a29c7ee585ef0

SHA256
af36484a4001c272a0b9d1990fb54d2a4f566acf6a90b5383b702bc5d9b086dc

SHA512
aff18f3593b7e7c7e9a22967c056f853a44ec7fa9e98110f890da101bef63fe9ebaea896125148351ca9cf6bb0c654fade4bc986550345f555677ecc6bb16637

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Nf205023.exe

Filesize
680KB

MD5
3121eefdbffb5d6eb9413a4f3fed2b58

SHA1
f8a8067d40c97d8ac6b2ba56b7cec5acaf294f6c

SHA256
4190bcc2cbc45041548f99f5f0d51a9973d37ecc1ae66761d210453e1bafe754

SHA512
2b349a6ddee6c15691ba304644cb6815ec26fa26b0915ff26516d4916b3cc87898b7196454d6d43665bb9f50679fca0ba3711ccf00b06d23ce1f3e7805c8c2b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c99692866.exe

Filesize
205KB

MD5
84a438743d1148f269c68406edfc89ad

SHA1
884c4e582bab2e7d1102c6965dc6ccd1c588eb1d

SHA256
43a59ede1669e8cd3df64c7b6b5c117424327f6bcd60d9fa8bfe69996794bb9b

SHA512
d9ebf6a554eacaf243c62e6c304cfe99a62d900c44112e58798debf649a04805747f462cfd2a3c2a6fada4c159f8005588025631448e630cd69897094107f2f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a87648516.exe

Filesize
302KB

MD5
88692d7c64258ee85a55b049fe8d4845

SHA1
1f3400b5a4406fc0df75747e9e57e78d1a360252

SHA256
7c691c6622375da19424f265cee60c6d5ee1e9db56e95fbcb70e52229b17e013

SHA512
75bdf2b1ac2a7492855052d6f4f4b9483412c7d03fa939bf4b2626ef3f875b11c32645c38c87c9a5de6cae7b36125de4e5ad3a1b5fd47f33df8abdc3faf29eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b78125950.exe

Filesize
522KB

MD5
5e270c373c75f5ba45f5c1cc74294cc3

SHA1
09e015f8ef12fc798ca96985887c940759d3a45c

SHA256
4475626e8f0e9f222baf4f2ea6ff1bbcbdcd6a869c7072b369f87fe6e30e0656

SHA512
3bbf74ee09ea9af1cc1b628fc2b6be17935cfd5f9657cbd47a27c619290a053df5f59e314809417883e32daf782f7d73925525c078828405eed79aff8ca984de

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/3820-4312-0x0000000005750000-0x00000000057E2000-memory.dmp

Filesize
584KB

Download
memory/3888-6489-0x000000000A3E0000-0x000000000A4EA000-memory.dmp

Filesize
1.0MB

Download
memory/3888-6488-0x000000000A870000-0x000000000AE88000-memory.dmp

Filesize
6.1MB

Download
memory/3888-6487-0x0000000004C10000-0x0000000004C16000-memory.dmp

Filesize
24KB

Download
memory/3888-6486-0x0000000000430000-0x0000000000460000-memory.dmp

Filesize
192KB

Download
memory/3888-6490-0x000000000A310000-0x000000000A322000-memory.dmp

Filesize
72KB

Download
memory/3888-6491-0x000000000A370000-0x000000000A3AC000-memory.dmp

Filesize
240KB

Download
memory/3888-6492-0x00000000025F0000-0x000000000263C000-memory.dmp

Filesize
304KB

Download
memory/4560-2181-0x0000000000070000-0x000000000007A000-memory.dmp

Filesize
40KB

Download
memory/4792-93-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-42-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-77-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-75-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-73-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-71-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-69-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-65-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-63-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-61-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-59-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-57-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-55-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-53-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-51-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-49-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-47-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-46-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-43-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-79-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-39-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-38-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-2166-0x00000000052F0000-0x00000000052FA000-memory.dmp

Filesize
40KB

Download
memory/4792-81-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-84-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-85-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-87-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-89-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-95-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-35-0x00000000048F0000-0x0000000004948000-memory.dmp

Filesize
352KB

Download
memory/4792-36-0x0000000004AB0000-0x0000000005054000-memory.dmp

Filesize
5.6MB

Download
memory/4792-37-0x00000000049E0000-0x0000000004A36000-memory.dmp

Filesize
344KB

Download
memory/4792-97-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-99-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-101-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-67-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/4792-91-0x00000000049E0000-0x0000000004A31000-memory.dmp

Filesize
324KB

Download
memory/6136-6480-0x0000000005770000-0x00000000057A2000-memory.dmp

Filesize
200KB

Download
memory/6136-4333-0x0000000002B00000-0x0000000002B66000-memory.dmp

Filesize
408KB

Download
memory/6136-4332-0x0000000002860000-0x00000000028C8000-memory.dmp

Filesize
416KB

Download