amadey | c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe
Size

1.4MB
MD5

b7b94ad54ce8ca963e9c851492f47739
SHA1

504da849dfaa79e262d56f934b991f492e7bdb3b
SHA256

c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74
SHA512

08698657ba50d390892c515c285fdfd4c6acd7b97ef8d7bcc6619db487493f2d21fd4f75e03659637f751538f305c0334dcf2eaed45ec4de3bbbc73d2e52d692
SSDEEP

24576:2ygqfs+oHOmVXY1ek5mlAuattLK27P1JmOL9TDdCoMwrqpq2HQNG:Fw+ou4XY0amyu8tu273FYoMzqaQY

Score

10^/10

amadey healer redline 9c0adb gena most discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

most

185.161.248.73:4164

Attributes

auth_value
7da4dfa153f2919e617aa016f7c36008

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/4920-2159-0x0000000004C70000-0x0000000004C7A000-memory.dmp	healer
behavioral1/files/0x00050000000230d8-2164.dat	healer
behavioral1/memory/5576-2172-0x0000000000910000-0x000000000091A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/5368-6474-0x0000000005760000-0x0000000005792000-memory.dmp	family_redline
behavioral1/files/0x00050000000230d8-6479.dat	family_redline
behavioral1/memory/2348-6487-0x0000000000E80000-0x0000000000EAE000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c97-6497.dat	family_redline
behavioral1/memory/5716-6498-0x0000000000590000-0x00000000005C0000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	c10323177.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	d72245512.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	a70151891.exe

Executes dropped EXE 13 IoCs

pid	Process
2896	uX545623.exe
3740	jj162478.exe
4700	bo566662.exe
4920	a70151891.exe
5576	1.exe
5628	b14520330.exe
2484	c10323177.exe
4416	oneetx.exe
5368	d72245512.exe
2348	1.exe
5716	f57672417.exe
5000	oneetx.exe
4840	oneetx.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	uX545623.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	jj162478.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	bo566662.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1852	5628	WerFault.exe	93
1712	5368	WerFault.exe	105

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uX545623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d72245512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b14520330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c10323177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jj162478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bo566662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a70151891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f57672417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5576	1.exe
5576	1.exe
5576	1.exe
5576	1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	a70151891.exe
Token: SeDebugPrivilege	5628	b14520330.exe
Token: SeDebugPrivilege	5576	1.exe
Token: SeDebugPrivilege	5368	d72245512.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 2896	3132	c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe	85
PID 3132 wrote to memory of 2896	3132	c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe	85
PID 3132 wrote to memory of 2896	3132	c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe	85
PID 2896 wrote to memory of 3740	2896	uX545623.exe	86
PID 2896 wrote to memory of 3740	2896	uX545623.exe	86
PID 2896 wrote to memory of 3740	2896	uX545623.exe	86
PID 3740 wrote to memory of 4700	3740	jj162478.exe	88
PID 3740 wrote to memory of 4700	3740	jj162478.exe	88
PID 3740 wrote to memory of 4700	3740	jj162478.exe	88
PID 4700 wrote to memory of 4920	4700	bo566662.exe	89
PID 4700 wrote to memory of 4920	4700	bo566662.exe	89
PID 4700 wrote to memory of 4920	4700	bo566662.exe	89
PID 4920 wrote to memory of 5576	4920	a70151891.exe	92
PID 4920 wrote to memory of 5576	4920	a70151891.exe	92
PID 4700 wrote to memory of 5628	4700	bo566662.exe	93
PID 4700 wrote to memory of 5628	4700	bo566662.exe	93
PID 4700 wrote to memory of 5628	4700	bo566662.exe	93
PID 3740 wrote to memory of 2484	3740	jj162478.exe	103
PID 3740 wrote to memory of 2484	3740	jj162478.exe	103
PID 3740 wrote to memory of 2484	3740	jj162478.exe	103
PID 2484 wrote to memory of 4416	2484	c10323177.exe	104
PID 2484 wrote to memory of 4416	2484	c10323177.exe	104
PID 2484 wrote to memory of 4416	2484	c10323177.exe	104
PID 2896 wrote to memory of 5368	2896	uX545623.exe	105
PID 2896 wrote to memory of 5368	2896	uX545623.exe	105
PID 2896 wrote to memory of 5368	2896	uX545623.exe	105
PID 4416 wrote to memory of 2868	4416	oneetx.exe	106
PID 4416 wrote to memory of 2868	4416	oneetx.exe	106
PID 4416 wrote to memory of 2868	4416	oneetx.exe	106
PID 4416 wrote to memory of 5160	4416	oneetx.exe	108
PID 4416 wrote to memory of 5160	4416	oneetx.exe	108
PID 4416 wrote to memory of 5160	4416	oneetx.exe	108
PID 5160 wrote to memory of 5216	5160	cmd.exe	110
PID 5160 wrote to memory of 5216	5160	cmd.exe	110
PID 5160 wrote to memory of 5216	5160	cmd.exe	110
PID 5160 wrote to memory of 4456	5160	cmd.exe	111
PID 5160 wrote to memory of 4456	5160	cmd.exe	111
PID 5160 wrote to memory of 4456	5160	cmd.exe	111
PID 5160 wrote to memory of 5648	5160	cmd.exe	112
PID 5160 wrote to memory of 5648	5160	cmd.exe	112
PID 5160 wrote to memory of 5648	5160	cmd.exe	112
PID 5160 wrote to memory of 6136	5160	cmd.exe	113
PID 5160 wrote to memory of 6136	5160	cmd.exe	113
PID 5160 wrote to memory of 6136	5160	cmd.exe	113
PID 5160 wrote to memory of 6020	5160	cmd.exe	114
PID 5160 wrote to memory of 6020	5160	cmd.exe	114
PID 5160 wrote to memory of 6020	5160	cmd.exe	114
PID 5160 wrote to memory of 560	5160	cmd.exe	115
PID 5160 wrote to memory of 560	5160	cmd.exe	115
PID 5160 wrote to memory of 560	5160	cmd.exe	115
PID 5368 wrote to memory of 2348	5368	d72245512.exe	116
PID 5368 wrote to memory of 2348	5368	d72245512.exe	116
PID 5368 wrote to memory of 2348	5368	d72245512.exe	116
PID 3132 wrote to memory of 5716	3132	c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe	119
PID 3132 wrote to memory of 5716	3132	c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe	119
PID 3132 wrote to memory of 5716	3132	c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe	119

C:\Users\Admin\AppData\Local\Temp\c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe
"C:\Users\Admin\AppData\Local\Temp\c2f9824198bb4818a8971d9122b6fecb2457b15ec3e0f0d07eb93cbd289e4e74.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uX545623.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uX545623.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jj162478.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jj162478.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bo566662.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bo566662.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a70151891.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a70151891.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4920
      - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b14520330.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b14520330.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 1268
        6⤵
        Program crash
        
        PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c10323177.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c10323177.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4416
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2868
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:560
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d72245512.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d72245512.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 1336
      4⤵
      Program crash
      PID:1712
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f57672417.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f57672417.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5628 -ip 5628
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5368 -ip 5368
1⤵
PID:1956

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f57672417.exe

Filesize
168KB

MD5
b9ec6bbc29caf260c9a2b592b31a6d2d

SHA1
c19d1bc122b41012e5c1860d982acee4e7ec141e

SHA256
a172d2f280ec378ba8d5e5904b54752ae264b1c5fa6597eb47fcbd5395827d3a

SHA512
a01b2d1d252c9e763fa8a62b5822ae88dec46f78886b8b93b73c3695614e522814f2aeac011ed5033740bb1659c8ec3f9353d12f8bfae5bbd09ce0f7f50efee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uX545623.exe

Filesize
1.3MB

MD5
810fe8d997193d7ee0f26c6bec8a84c4

SHA1
dd25a0292e7b6fe207d2a8527da44057bec10976

SHA256
5c96d0e5cca202e9a2af79e1e7c913af17949361a695202d00c3ebfa2c99f536

SHA512
56edf0141d0276e8efa35579756b7030cf927cdfbb97a232e230a38fb5436b67783596b3e48fdb0275e36b7c3edbb585a5a1030aa68179238247c38a88414e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d72245512.exe

Filesize
581KB

MD5
557d8676a834bb3e9d34245e097f49bd

SHA1
c5ef483575b75f9c408a5591a0ad2b14efb6c373

SHA256
a1d0a57515f46ec5f2916d1ac0707b0cb525700dedeba3645cc4dc35044d226f

SHA512
f9b10125f37eaaae4c0acbeefffa01362e4c7e4691d44c9f54de28e53bd4bc9357e811c257d265607e34d690b342595e2954876f9ea31fe5ab361e360f5db21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jj162478.exe

Filesize
851KB

MD5
4ef32c8d2d98a31d12d903076557259a

SHA1
362521a694de81803c4bcb44f5ed3897b6dae6b9

SHA256
2a0dcf0555e091bb9a4be9ab73467978ed52ec346e80928573480a9b7caef81d

SHA512
cee4e10c4819c71785a7767234784146cb54734da2e9bb26ae9995bf380fbe6b3fb8114c5812af308320a4e7df9fbc4aef9bf7652a59d0d8f36249b060ad464b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bo566662.exe

Filesize
679KB

MD5
98d71186b1805a7578f9f9a655400082

SHA1
791341dda1846d3ccd0b08da02fd58cda4f8e5a0

SHA256
1219dcbbbf3b48ebbb6cf6e227afe8e2c37f212af16c1d255837c68a962a0b77

SHA512
335bf5c369ee85ab1e19905315956141617d8f44a195000afd5d901cc81ea7f01568063b5f5079a31ae8525e635a2cd451d6d7edfdfa69449321df21aa8595a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c10323177.exe

Filesize
205KB

MD5
93f7f2666f3473a1cc04dd6ad136afe7

SHA1
7999a6b6f1bcf8fcc7374419271224a111db900b

SHA256
53631638b31e0b2759372b2edac7381278980cfcb6d834bdfaf1684ab98c6727

SHA512
b16e2771991b3e11ef57683d264cd5f30ef16bebbe92023f5e93c15d8f0d33d285a7c12b367dd9a633dc8767a17ec3dc93a23fd9210a84b012ff5b9de644bd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a70151891.exe

Filesize
301KB

MD5
9ee97e6757ca75f6a7874e42a9943dfa

SHA1
e51183d6c090177f7bed3ea2d74817afeadb714f

SHA256
25ad4f0320eef883c1c5f9db31538a2b0e3e74066b7508301d35a3a3cb16f260

SHA512
99e6a6c3be6646fec3adb58c123b1b3a3f6f972a9ca2876ec9aa86ff941ca6195ff5e9254d70b82b1cb4d2ff2ce26aa00ea88cfa6279044c0bc8103a853f5b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b14520330.exe

Filesize
521KB

MD5
6a34d8f36d5685feb25b3c6113785e08

SHA1
b3f475f42252939cae7cf669afab61151eaa302d

SHA256
b02ec6e105b5815ab2388cfe8616b8a0183adb6aba46723d037f7c0a42fa7921

SHA512
56c88a42112da0b70b879d4e284f7005138923b06158b9bbadc48ce7b69df005fe7a49872a1c8ffbb901cf848f33c462751e7b5d7055e3a7866c57518d6d153f

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/2348-6488-0x0000000007B30000-0x0000000007B36000-memory.dmp

Filesize
24KB

Download
memory/2348-6487-0x0000000000E80000-0x0000000000EAE000-memory.dmp

Filesize
184KB

Download
memory/2348-6489-0x0000000005DD0000-0x00000000063E8000-memory.dmp

Filesize
6.1MB

Download
memory/2348-6490-0x00000000058C0000-0x00000000059CA000-memory.dmp

Filesize
1.0MB

Download
memory/2348-6491-0x00000000057F0000-0x0000000005802000-memory.dmp

Filesize
72KB

Download
memory/2348-6492-0x0000000005850000-0x000000000588C000-memory.dmp

Filesize
240KB

Download
memory/2348-6493-0x00000000059D0000-0x0000000005A1C000-memory.dmp

Filesize
304KB

Download
memory/4920-78-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-32-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-68-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-66-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-64-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-62-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-60-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-58-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-56-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-54-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-50-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-48-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-46-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-44-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-42-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-40-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-38-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-36-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-34-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-70-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-52-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-72-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-31-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-2159-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Filesize
40KB

Download
memory/4920-74-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-28-0x00000000024F0000-0x0000000002548000-memory.dmp

Filesize
352KB

Download
memory/4920-76-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-29-0x0000000004CA0000-0x0000000005244000-memory.dmp

Filesize
5.6MB

Download
memory/4920-80-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-82-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-30-0x0000000004B70000-0x0000000004BC6000-memory.dmp

Filesize
344KB

Download
memory/4920-84-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-90-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-86-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-88-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-92-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/4920-94-0x0000000004B70000-0x0000000004BC1000-memory.dmp

Filesize
324KB

Download
memory/5368-6474-0x0000000005760000-0x0000000005792000-memory.dmp

Filesize
200KB

Download
memory/5368-4326-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/5368-4325-0x0000000004EC0000-0x0000000004F28000-memory.dmp

Filesize
416KB

Download
memory/5576-2172-0x0000000000910000-0x000000000091A000-memory.dmp

Filesize
40KB

Download
memory/5628-4305-0x0000000005750000-0x00000000057E2000-memory.dmp

Filesize
584KB

Download
memory/5716-6498-0x0000000000590000-0x00000000005C0000-memory.dmp

Filesize
192KB

Download
memory/5716-6499-0x00000000027C0000-0x00000000027C6000-memory.dmp

Filesize
24KB

Download