amadey | a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe
Size

1.5MB
MD5

9136e94d39f0c9e5396d06173e2415e3
SHA1

340b05a86434c40b7197fde4444107e03038cb9f
SHA256

a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a
SHA512

b52d6af183dbfa044c35e8b4fa6080ce051481b3836bbe3f48610bc54197486c30d9b0c241ca8c22820ac0de6632ff034baff4c8337b317318bb1cd5248f7a97
SSDEEP

24576:SyxN8Qd91qeBKkMtMJg5ZbkxXrloZ87hs2kBqxQ+jTI9M17jlQ31cCHFTp:5vZd91LKxtygXkxJm87vCqi+wM1tO3Hl

Score

10^/10

amadey healer redline 9c0adb most discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

most

185.161.248.73:4164

Attributes

auth_value
7da4dfa153f2919e617aa016f7c36008

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1916-2159-0x0000000005430000-0x000000000543A000-memory.dmp	healer
C:\Windows\Temp\1.exe	healer
behavioral1/memory/6508-2175-0x0000000000240000-0x000000000024A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1972-6473-0x0000000005020000-0x0000000005052000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\534089251.exe	family_redline
behavioral1/memory/7164-6479-0x0000000000EB0000-0x0000000000EE0000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

155067669.exe378783061.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	155067669.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	378783061.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 12 IoCs

Processes:

ra188498.exeQT933828.exexo703569.exe155067669.exe1.exe264293402.exe378783061.exeoneetx.exe430628952.exe534089251.exeoneetx.exeoneetx.exe

pid	process
2448	ra188498.exe
3976	QT933828.exe
1444	xo703569.exe
1916	155067669.exe
6508	1.exe
6536	264293402.exe
3964	378783061.exe
3756	oneetx.exe
1972	430628952.exe
7164	534089251.exe
6820	oneetx.exe
6400	oneetx.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

1.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

QT933828.exexo703569.exea5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exera188498.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	QT933828.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	xo703569.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ra188498.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2556 6536 WerFault.exe 264293402.exe
4820 1972 WerFault.exe 430628952.exe

pid	pid_target	process	target process
2556	6536	WerFault.exe	264293402.exe
4820	1972	WerFault.exe	430628952.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

QT933828.execacls.execmd.exe534089251.exea5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe155067669.exe264293402.execacls.exera188498.exexo703569.exeoneetx.exe430628952.exeschtasks.execmd.exe378783061.execmd.execacls.execacls.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QT933828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	534089251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	155067669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	264293402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ra188498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xo703569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	430628952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	378783061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

5424 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1.exe

pid process

6508 1.exe
6508 1.exe

pid	process
5424	schtasks.exe

pid	process
6508	1.exe
6508	1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

155067669.exe264293402.exe1.exe430628952.exe

description	pid	process
Token: SeDebugPrivilege	1916	155067669.exe
Token: SeDebugPrivilege	6536	264293402.exe
Token: SeDebugPrivilege	6508	1.exe
Token: SeDebugPrivilege	1972	430628952.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

378783061.exe

pid process

3964 378783061.exe

pid	process
3964	378783061.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exera188498.exeQT933828.exexo703569.exe155067669.exe378783061.exeoneetx.execmd.exe

description	pid	process	target process
PID 1028 wrote to memory of 2448	1028	a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe	ra188498.exe
PID 1028 wrote to memory of 2448	1028	a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe	ra188498.exe
PID 1028 wrote to memory of 2448	1028	a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe	ra188498.exe
PID 2448 wrote to memory of 3976	2448	ra188498.exe	QT933828.exe
PID 2448 wrote to memory of 3976	2448	ra188498.exe	QT933828.exe
PID 2448 wrote to memory of 3976	2448	ra188498.exe	QT933828.exe
PID 3976 wrote to memory of 1444	3976	QT933828.exe	xo703569.exe
PID 3976 wrote to memory of 1444	3976	QT933828.exe	xo703569.exe
PID 3976 wrote to memory of 1444	3976	QT933828.exe	xo703569.exe
PID 1444 wrote to memory of 1916	1444	xo703569.exe	155067669.exe
PID 1444 wrote to memory of 1916	1444	xo703569.exe	155067669.exe
PID 1444 wrote to memory of 1916	1444	xo703569.exe	155067669.exe
PID 1916 wrote to memory of 6508	1916	155067669.exe	1.exe
PID 1916 wrote to memory of 6508	1916	155067669.exe	1.exe
PID 1444 wrote to memory of 6536	1444	xo703569.exe	264293402.exe
PID 1444 wrote to memory of 6536	1444	xo703569.exe	264293402.exe
PID 1444 wrote to memory of 6536	1444	xo703569.exe	264293402.exe
PID 3976 wrote to memory of 3964	3976	QT933828.exe	378783061.exe
PID 3976 wrote to memory of 3964	3976	QT933828.exe	378783061.exe
PID 3976 wrote to memory of 3964	3976	QT933828.exe	378783061.exe
PID 3964 wrote to memory of 3756	3964	378783061.exe	oneetx.exe
PID 3964 wrote to memory of 3756	3964	378783061.exe	oneetx.exe
PID 3964 wrote to memory of 3756	3964	378783061.exe	oneetx.exe
PID 2448 wrote to memory of 1972	2448	ra188498.exe	430628952.exe
PID 2448 wrote to memory of 1972	2448	ra188498.exe	430628952.exe
PID 2448 wrote to memory of 1972	2448	ra188498.exe	430628952.exe
PID 3756 wrote to memory of 5424	3756	oneetx.exe	schtasks.exe
PID 3756 wrote to memory of 5424	3756	oneetx.exe	schtasks.exe
PID 3756 wrote to memory of 5424	3756	oneetx.exe	schtasks.exe
PID 3756 wrote to memory of 5220	3756	oneetx.exe	cmd.exe
PID 3756 wrote to memory of 5220	3756	oneetx.exe	cmd.exe
PID 3756 wrote to memory of 5220	3756	oneetx.exe	cmd.exe
PID 5220 wrote to memory of 5652	5220	cmd.exe	cmd.exe
PID 5220 wrote to memory of 5652	5220	cmd.exe	cmd.exe
PID 5220 wrote to memory of 5652	5220	cmd.exe	cmd.exe
PID 5220 wrote to memory of 5740	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 5740	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 5740	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 5580	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 5580	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 5580	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 3024	5220	cmd.exe	cmd.exe
PID 5220 wrote to memory of 3024	5220	cmd.exe	cmd.exe
PID 5220 wrote to memory of 3024	5220	cmd.exe	cmd.exe
PID 5220 wrote to memory of 5808	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 5808	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 5808	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 4472	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 4472	5220	cmd.exe	cacls.exe
PID 5220 wrote to memory of 4472	5220	cmd.exe	cacls.exe
PID 1028 wrote to memory of 7164	1028	a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe	534089251.exe
PID 1028 wrote to memory of 7164	1028	a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe	534089251.exe
PID 1028 wrote to memory of 7164	1028	a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe	534089251.exe

C:\Users\Admin\AppData\Local\Temp\a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe
"C:\Users\Admin\AppData\Local\Temp\a5f39c51d708dcff21c899016bfb207e2c2e57aeb28baa0adef95d2cf265844a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra188498.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra188498.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QT933828.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QT933828.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xo703569.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xo703569.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\155067669.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\155067669.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1916
      - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\264293402.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\264293402.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:6536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 1256
        6⤵
        Program crash
        
        PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378783061.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378783061.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3756
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5424
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\430628952.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\430628952.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1252
      4⤵
      Program crash
      PID:4820
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\534089251.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\534089251.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6536 -ip 6536
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1972 -ip 1972
1⤵
PID:6776

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:6820

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:6400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\534089251.exe

Filesize
168KB

MD5
23bf8277fe81d432902a96d16906735b

SHA1
998bd641c8084bf425b2185419f3d91f4cf0dec4

SHA256
743b918aa649e9dfb54739b2ac00523fa048d1495dcf1ed3baf6afe5b10b106b

SHA512
cd0db15dd275d05d7156842ee3033fdd834c623a321ee476e53dfc400f6bf9f1a3df06e4e815071da554ba2e2b075bfc16ba2087ff92e84a29b55f501e3aadf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra188498.exe

Filesize
1.3MB

MD5
4a6d1e84a3605e34cab90d9aea98ea6a

SHA1
db11c004108dcb620cc6221d214d823c8926a215

SHA256
4dd7d2358cc1b0fff31164dc6d0e1b6d60e9264c1d6d127f79d9e883e9047745

SHA512
40215ff2a41bea1367a4bfef854d550ce8358dc6a68ed8bb351bcaa2618b15f01ce679218c27e9a1f8a2c0bdaae26a0541be6a18b9d193fee53e2291ee6fc714

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\430628952.exe

Filesize
538KB

MD5
80f029b03f6e10b3b80c46d3a8c4850a

SHA1
eaacd14447bfc70db928143393cfebb7230c8d37

SHA256
87cec760f5d325a188499bc56c4cec389d0886e77772edaceefd8b205f15ccf3

SHA512
c416c110df3ee807ec44005747c81b567101b80b727f4c555df5ca7e50206d3f7b7b564cc44f2f7b586ec5ace114e5e9b02406f72f38b727f8415ed01ee3a4f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QT933828.exe

Filesize
871KB

MD5
38758e8aa2264ff6d31c5068b15ac90b

SHA1
033b43932ad173ed5d35bd59197a09603cf5688a

SHA256
9e6f7e9a1794494e049c3e325e0c23cd44b8fd6aa8147ed316959a2380c87631

SHA512
2362d7784a78fb50e0aeea708ac32a2fcce659f93cf0ed0623b2678d86b60467136fc570bf6cf4132f938157f5154ec9c649bae5a0d15f1e9c8f3dfdbb207a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\378783061.exe

Filesize
204KB

MD5
e7f86ef357eb4588fd180a4b694f5399

SHA1
6a4b96f9a6c13aef7762b0f580694d337e332325

SHA256
803a2da57b412ca5d72b77c2ca3e602eee4321d8eef9b82ca1c882b59f5f4ced

SHA512
045a1bce9cbbeff632047aea409df95a1223059a808b36f0d4881b9af119a6aac1ef6d12e681630ad19e1489bc9eb8e7bc9fe6a68eb8f51bebb5c2c9c658dc64

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xo703569.exe

Filesize
699KB

MD5
4ddfbf59964e4ac8ffbae1572649dbc2

SHA1
0dfe4ec5bf75ae19393e0707cecfa29b1a09160e

SHA256
db32414e1a9d3330b6639d39194cb2dc26288dbf9414a9aa714e43a1bfcf7ba2

SHA512
13467a1b89dfde3cd3811dd4a9eeb1e14422fd2d53c33c26819a13bbef4bfe40de1f5a0e78276fab266a86c525979459a2ae1b8323d62c56bf9260bbe2fa3252

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\155067669.exe

Filesize
299KB

MD5
2e7cb43efe80c63041485f311070ed9d

SHA1
ae6f5c30a5b0882f59a366cb8bf8581ff9e65098

SHA256
7695794bc934df7401f1ab1384ea5ab78d0a1904d0c9026ec39c1097ff5a0974

SHA512
1009ad1de17cc9943b4c31c8ef9270f03b0c1a70b4a835d8133bfe3431784368e113557a9ddcf0e8012f7d4f0eca1bbf8677c8d7fef45104c39a6d618fbb4e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\264293402.exe

Filesize
478KB

MD5
1d2d60644ddee94b810810a9b04a9bde

SHA1
81d4f5b8fe4525feed34d2bb986977c375975d65

SHA256
7202d6d9981eeeeb2a3358138aaac16980b45ba55f789510144bbe18d2ee68f7

SHA512
4062fed545ddd6c85d528a53a02b014b9d44d1da735f7b4846bc7e2295a17979d1e98a35ded8bf26f4419dab61e6c2a5a99dc7a6cf64e4e30f2901ec5a4100d2

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1916-80-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-34-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-86-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-84-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-82-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-92-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-78-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-74-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-72-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-71-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-68-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-66-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-64-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-62-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-60-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-56-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-54-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-52-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-50-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-46-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-44-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-42-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-40-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-38-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-36-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-90-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-32-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-76-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-58-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-48-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-31-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-2159-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/1916-94-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-88-0x0000000004B50000-0x0000000004BA1000-memory.dmp

Filesize
324KB

Download
memory/1916-28-0x00000000024B0000-0x0000000002508000-memory.dmp

Filesize
352KB

Download
memory/1916-29-0x0000000004C10000-0x00000000051B4000-memory.dmp

Filesize
5.6MB

Download
memory/1916-30-0x0000000004B50000-0x0000000004BA6000-memory.dmp

Filesize
344KB

Download
memory/1972-4325-0x0000000002AB0000-0x0000000002B18000-memory.dmp

Filesize
416KB

Download
memory/1972-4326-0x0000000002B20000-0x0000000002B86000-memory.dmp

Filesize
408KB

Download
memory/1972-6473-0x0000000005020000-0x0000000005052000-memory.dmp

Filesize
200KB

Download
memory/6508-2175-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/6536-4305-0x0000000005740000-0x00000000057D2000-memory.dmp

Filesize
584KB

Download
memory/7164-6479-0x0000000000EB0000-0x0000000000EE0000-memory.dmp

Filesize
192KB

Download
memory/7164-6480-0x0000000003090000-0x0000000003096000-memory.dmp

Filesize
24KB

Download
memory/7164-6481-0x0000000006040000-0x0000000006658000-memory.dmp

Filesize
6.1MB

Download
memory/7164-6482-0x0000000005B30000-0x0000000005C3A000-memory.dmp

Filesize
1.0MB

Download
memory/7164-6483-0x0000000005870000-0x0000000005882000-memory.dmp

Filesize
72KB

Download
memory/7164-6484-0x0000000005890000-0x00000000058CC000-memory.dmp

Filesize
240KB

Download
memory/7164-6486-0x0000000005A20000-0x0000000005A6C000-memory.dmp

Filesize
304KB

Download