amadey | eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395b

Analysis

max time kernel
118s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe
Size

1.4MB
MD5

b0c7884342c924f90d7112993f0298d0
SHA1

81c18b8988d7afd18b01775d425b653cede4e90a
SHA256

eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395b
SHA512

6079a3cfaf4ec3d617a89eb09fbf89bd19151c05508b8995fa472f8b3e09a1722c5fbeb356fb548798b9a0b808f788acc70a9d21868a0bcf5256a46af2bd8027
SSDEEP

24576:2ygqfs+oHOmVXY1ek5mlAuattLK27P1JmOL9TDdCoMwrqpq2HQN:Fw+ou4XY0amyu8tu273FYoMzqaQ

Score

10^/10

amadey healer redline 9c0adb gena most discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.80

Botnet

9c0adb

http://193.3.19.154

Attributes

install_dir
cb7ae701b3
install_file
oneetx.exe
strings_key
23b27c80db2465a8e1dc15491b69b82f
url_paths
/store/games/index.php

rc4.plain

Extracted

Family

redline

Botnet

gena

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

most

185.161.248.73:4164

Attributes

auth_value
7da4dfa153f2919e617aa016f7c36008

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/4072-2159-0x00000000052F0000-0x00000000052FA000-memory.dmp	healer
behavioral1/files/0x0002000000022b11-2164.dat	healer
behavioral1/memory/1452-2175-0x0000000000E20000-0x0000000000E2A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2272-6474-0x0000000004F30000-0x0000000004F62000-memory.dmp	family_redline
behavioral1/files/0x0002000000022b11-6479.dat	family_redline
behavioral1/memory/636-6487-0x0000000000270000-0x000000000029E000-memory.dmp	family_redline
behavioral1/files/0x0007000000023ca2-6495.dat	family_redline
behavioral1/memory/5368-6498-0x0000000000E90000-0x0000000000EC0000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	a70151891.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	c10323177.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	d72245512.exe

Executes dropped EXE 13 IoCs

pid	Process
1824	uX545623.exe
4744	jj162478.exe
1840	bo566662.exe
4072	a70151891.exe
1452	1.exe
1468	b14520330.exe
4976	c10323177.exe
1980	oneetx.exe
2272	d72245512.exe
636	1.exe
5368	f57672417.exe
1676	oneetx.exe
5744	oneetx.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	jj162478.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	bo566662.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	uX545623.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5020	1468	WerFault.exe	91
2248	2272	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bo566662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b14520330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c10323177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oneetx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d72245512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uX545623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f57672417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jj162478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a70151891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1452	1.exe
1452	1.exe
1452	1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	a70151891.exe
Token: SeDebugPrivilege	1468	b14520330.exe
Token: SeDebugPrivilege	1452	1.exe
Token: SeDebugPrivilege	2272	d72245512.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4976	c10323177.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 1824	3360	eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe	83
PID 3360 wrote to memory of 1824	3360	eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe	83
PID 3360 wrote to memory of 1824	3360	eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe	83
PID 1824 wrote to memory of 4744	1824	uX545623.exe	84
PID 1824 wrote to memory of 4744	1824	uX545623.exe	84
PID 1824 wrote to memory of 4744	1824	uX545623.exe	84
PID 4744 wrote to memory of 1840	4744	jj162478.exe	85
PID 4744 wrote to memory of 1840	4744	jj162478.exe	85
PID 4744 wrote to memory of 1840	4744	jj162478.exe	85
PID 1840 wrote to memory of 4072	1840	bo566662.exe	87
PID 1840 wrote to memory of 4072	1840	bo566662.exe	87
PID 1840 wrote to memory of 4072	1840	bo566662.exe	87
PID 4072 wrote to memory of 1452	4072	a70151891.exe	90
PID 4072 wrote to memory of 1452	4072	a70151891.exe	90
PID 1840 wrote to memory of 1468	1840	bo566662.exe	91
PID 1840 wrote to memory of 1468	1840	bo566662.exe	91
PID 1840 wrote to memory of 1468	1840	bo566662.exe	91
PID 4744 wrote to memory of 4976	4744	jj162478.exe	105
PID 4744 wrote to memory of 4976	4744	jj162478.exe	105
PID 4744 wrote to memory of 4976	4744	jj162478.exe	105
PID 4976 wrote to memory of 1980	4976	c10323177.exe	106
PID 4976 wrote to memory of 1980	4976	c10323177.exe	106
PID 4976 wrote to memory of 1980	4976	c10323177.exe	106
PID 1824 wrote to memory of 2272	1824	uX545623.exe	107
PID 1824 wrote to memory of 2272	1824	uX545623.exe	107
PID 1824 wrote to memory of 2272	1824	uX545623.exe	107
PID 1980 wrote to memory of 3972	1980	oneetx.exe	108
PID 1980 wrote to memory of 3972	1980	oneetx.exe	108
PID 1980 wrote to memory of 3972	1980	oneetx.exe	108
PID 1980 wrote to memory of 1192	1980	oneetx.exe	110
PID 1980 wrote to memory of 1192	1980	oneetx.exe	110
PID 1980 wrote to memory of 1192	1980	oneetx.exe	110
PID 1192 wrote to memory of 1908	1192	cmd.exe	112
PID 1192 wrote to memory of 1908	1192	cmd.exe	112
PID 1192 wrote to memory of 1908	1192	cmd.exe	112
PID 1192 wrote to memory of 5080	1192	cmd.exe	113
PID 1192 wrote to memory of 5080	1192	cmd.exe	113
PID 1192 wrote to memory of 5080	1192	cmd.exe	113
PID 1192 wrote to memory of 1012	1192	cmd.exe	114
PID 1192 wrote to memory of 1012	1192	cmd.exe	114
PID 1192 wrote to memory of 1012	1192	cmd.exe	114
PID 1192 wrote to memory of 4316	1192	cmd.exe	115
PID 1192 wrote to memory of 4316	1192	cmd.exe	115
PID 1192 wrote to memory of 4316	1192	cmd.exe	115
PID 1192 wrote to memory of 2128	1192	cmd.exe	120
PID 1192 wrote to memory of 2128	1192	cmd.exe	120
PID 1192 wrote to memory of 2128	1192	cmd.exe	120
PID 1192 wrote to memory of 5612	1192	cmd.exe	117
PID 1192 wrote to memory of 5612	1192	cmd.exe	117
PID 1192 wrote to memory of 5612	1192	cmd.exe	117
PID 2272 wrote to memory of 636	2272	d72245512.exe	121
PID 2272 wrote to memory of 636	2272	d72245512.exe	121
PID 2272 wrote to memory of 636	2272	d72245512.exe	121
PID 3360 wrote to memory of 5368	3360	eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe	124
PID 3360 wrote to memory of 5368	3360	eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe	124
PID 3360 wrote to memory of 5368	3360	eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe	124

C:\Users\Admin\AppData\Local\Temp\eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe
"C:\Users\Admin\AppData\Local\Temp\eae92755d17df620dfab4917b5bdca0db104e2edf9c4e707d3faa5d50375395bN.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uX545623.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uX545623.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jj162478.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jj162478.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bo566662.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bo566662.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a70151891.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a70151891.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4072
      - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b14520330.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b14520330.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1204
        6⤵
        Program crash
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c10323177.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c10323177.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1980
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3972
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d72245512.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d72245512.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1380
      4⤵
      Program crash
      PID:2248
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f57672417.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f57672417.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1468 -ip 1468
1⤵
PID:6000

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2272 -ip 2272
1⤵
PID:1712

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:1676

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:5744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f57672417.exe

Filesize
168KB

MD5
b9ec6bbc29caf260c9a2b592b31a6d2d

SHA1
c19d1bc122b41012e5c1860d982acee4e7ec141e

SHA256
a172d2f280ec378ba8d5e5904b54752ae264b1c5fa6597eb47fcbd5395827d3a

SHA512
a01b2d1d252c9e763fa8a62b5822ae88dec46f78886b8b93b73c3695614e522814f2aeac011ed5033740bb1659c8ec3f9353d12f8bfae5bbd09ce0f7f50efee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uX545623.exe

Filesize
1.3MB

MD5
810fe8d997193d7ee0f26c6bec8a84c4

SHA1
dd25a0292e7b6fe207d2a8527da44057bec10976

SHA256
5c96d0e5cca202e9a2af79e1e7c913af17949361a695202d00c3ebfa2c99f536

SHA512
56edf0141d0276e8efa35579756b7030cf927cdfbb97a232e230a38fb5436b67783596b3e48fdb0275e36b7c3edbb585a5a1030aa68179238247c38a88414e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d72245512.exe

Filesize
581KB

MD5
557d8676a834bb3e9d34245e097f49bd

SHA1
c5ef483575b75f9c408a5591a0ad2b14efb6c373

SHA256
a1d0a57515f46ec5f2916d1ac0707b0cb525700dedeba3645cc4dc35044d226f

SHA512
f9b10125f37eaaae4c0acbeefffa01362e4c7e4691d44c9f54de28e53bd4bc9357e811c257d265607e34d690b342595e2954876f9ea31fe5ab361e360f5db21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jj162478.exe

Filesize
851KB

MD5
4ef32c8d2d98a31d12d903076557259a

SHA1
362521a694de81803c4bcb44f5ed3897b6dae6b9

SHA256
2a0dcf0555e091bb9a4be9ab73467978ed52ec346e80928573480a9b7caef81d

SHA512
cee4e10c4819c71785a7767234784146cb54734da2e9bb26ae9995bf380fbe6b3fb8114c5812af308320a4e7df9fbc4aef9bf7652a59d0d8f36249b060ad464b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bo566662.exe

Filesize
679KB

MD5
98d71186b1805a7578f9f9a655400082

SHA1
791341dda1846d3ccd0b08da02fd58cda4f8e5a0

SHA256
1219dcbbbf3b48ebbb6cf6e227afe8e2c37f212af16c1d255837c68a962a0b77

SHA512
335bf5c369ee85ab1e19905315956141617d8f44a195000afd5d901cc81ea7f01568063b5f5079a31ae8525e635a2cd451d6d7edfdfa69449321df21aa8595a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c10323177.exe

Filesize
205KB

MD5
93f7f2666f3473a1cc04dd6ad136afe7

SHA1
7999a6b6f1bcf8fcc7374419271224a111db900b

SHA256
53631638b31e0b2759372b2edac7381278980cfcb6d834bdfaf1684ab98c6727

SHA512
b16e2771991b3e11ef57683d264cd5f30ef16bebbe92023f5e93c15d8f0d33d285a7c12b367dd9a633dc8767a17ec3dc93a23fd9210a84b012ff5b9de644bd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a70151891.exe

Filesize
301KB

MD5
9ee97e6757ca75f6a7874e42a9943dfa

SHA1
e51183d6c090177f7bed3ea2d74817afeadb714f

SHA256
25ad4f0320eef883c1c5f9db31538a2b0e3e74066b7508301d35a3a3cb16f260

SHA512
99e6a6c3be6646fec3adb58c123b1b3a3f6f972a9ca2876ec9aa86ff941ca6195ff5e9254d70b82b1cb4d2ff2ce26aa00ea88cfa6279044c0bc8103a853f5b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b14520330.exe

Filesize
521KB

MD5
6a34d8f36d5685feb25b3c6113785e08

SHA1
b3f475f42252939cae7cf669afab61151eaa302d

SHA256
b02ec6e105b5815ab2388cfe8616b8a0183adb6aba46723d037f7c0a42fa7921

SHA512
56c88a42112da0b70b879d4e284f7005138923b06158b9bbadc48ce7b69df005fe7a49872a1c8ffbb901cf848f33c462751e7b5d7055e3a7866c57518d6d153f

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
f16fb63d4e551d3808e8f01f2671b57e

SHA1
781153ad6235a1152da112de1fb39a6f2d063575

SHA256
8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

SHA512
fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

Download Submit
memory/636-6490-0x0000000004CC0000-0x0000000004DCA000-memory.dmp

Filesize
1.0MB

Download
memory/636-6488-0x0000000000CC0000-0x0000000000CC6000-memory.dmp

Filesize
24KB

Download
memory/636-6489-0x00000000051B0000-0x00000000057C8000-memory.dmp

Filesize
6.1MB

Download
memory/636-6491-0x0000000004BF0000-0x0000000004C02000-memory.dmp

Filesize
72KB

Download
memory/636-6497-0x0000000004DD0000-0x0000000004E1C000-memory.dmp

Filesize
304KB

Download
memory/636-6487-0x0000000000270000-0x000000000029E000-memory.dmp

Filesize
184KB

Download
memory/636-6492-0x0000000004C50000-0x0000000004C8C000-memory.dmp

Filesize
240KB

Download
memory/1452-2175-0x0000000000E20000-0x0000000000E2A000-memory.dmp

Filesize
40KB

Download
memory/1468-4305-0x0000000005750000-0x00000000057E2000-memory.dmp

Filesize
584KB

Download
memory/2272-4325-0x00000000026D0000-0x0000000002738000-memory.dmp

Filesize
416KB

Download
memory/2272-4326-0x0000000004E90000-0x0000000004EF6000-memory.dmp

Filesize
408KB

Download
memory/2272-6474-0x0000000004F30000-0x0000000004F62000-memory.dmp

Filesize
200KB

Download
memory/4072-80-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-62-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-58-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-56-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-54-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-52-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-50-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-48-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-44-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-42-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-40-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-88-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-38-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-36-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-34-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-32-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-31-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-46-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-2159-0x00000000052F0000-0x00000000052FA000-memory.dmp

Filesize
40KB

Download
memory/4072-60-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-64-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-70-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-72-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-74-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-76-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-78-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-82-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-84-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-86-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-90-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-92-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-94-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-66-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-68-0x0000000004A20000-0x0000000004A71000-memory.dmp

Filesize
324KB

Download
memory/4072-30-0x0000000004A20000-0x0000000004A76000-memory.dmp

Filesize
344KB

Download
memory/4072-29-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/4072-28-0x0000000004940000-0x0000000004998000-memory.dmp

Filesize
352KB

Download
memory/5368-6498-0x0000000000E90000-0x0000000000EC0000-memory.dmp

Filesize
192KB

Download
memory/5368-6499-0x0000000001640000-0x0000000001646000-memory.dmp

Filesize
24KB

Download