amadey | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250211-en
resource tags

arch:x64arch:x86image:win11-20250211-enlocale:en-usos:windows11-21h2-x64system
submitted
14-02-2025 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

amadey asyncrat stealc stealerium 7c4393 default qqtalk discovery rat stealer trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

14.243.221.170:3322

Mutex

ynBzTukwLg8N

Attributes

delay
3
install
false
install_file
Clean.bat
install_folder
%Temp%

aes.plain

Extracted

Family

stealc

Botnet

QQtalk

http://154.216.17.90

Attributes

url_path
/a48146f6763ef3af.php

Extracted

Family

amadey

Version

5.03

Botnet

7c4393

http://185.215.113.217

Attributes

install_dir
f9c76c1660
install_file
corept.exe
strings_key
9808a67f01d2f0720518035acbde7521
url_paths
/CoreOPT/index.php

rc4.plain

Extracted

Family

stealerium

https://api.telegram.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage?chat_id=-4224073938

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Stealerium family
stealerium

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/files/0x001a00000002af1a-11.dat	family_asyncrat

Downloads MZ/PE file 6 IoCs

flow	pid	Process
10	3288	Process not Found
11	3480	4363463463464363463463463.exe
11	3480	4363463463464363463463463.exe
11	3480	4363463463464363463463463.exe
11	3480	4363463463464363463463463.exe
15	3480	4363463463464363463463463.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LgAmARwZ.url	random.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\lgamarwz.url	taskmgr.exe

Executes dropped EXE 7 IoCs

pid	Process
1516	TCP.exe
3136	plrifjidicfid.exe
3428	Wallet-PrivateKey.Pdf.exe
3272	svchost.exe
4912	random.exe
2464	perviy.exe
800	SecurityHealthHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
26	raw.githubusercontent.com
31	raw.githubusercontent.com
34	raw.githubusercontent.com
35	raw.githubusercontent.com
36	raw.githubusercontent.com
11	raw.githubusercontent.com
18	raw.githubusercontent.com
32	raw.githubusercontent.com
33	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4912 set thread context of 2460	4912	random.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wallet-PrivateKey.Pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perviy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2332	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2772	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
972	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1008898722-3518013580-3694625758-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1008898722-3518013580-3694625758-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4912	random.exe
4912	random.exe
4912	random.exe
4912	random.exe
4912	random.exe
4912	random.exe
2164	powershell.exe
2164	powershell.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	4363463463464363463463463.exe
Token: SeDebugPrivilege	3428	Wallet-PrivateKey.Pdf.exe
Token: SeDebugPrivilege	3272	svchost.exe
Token: SeDebugPrivilege	4912	random.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	800	SecurityHealthHost.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	948	taskmgr.exe
Token: SeSystemProfilePrivilege	948	taskmgr.exe
Token: SeCreateGlobalPrivilege	948	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4704	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 1516	3480	4363463463464363463463463.exe	87
PID 3480 wrote to memory of 1516	3480	4363463463464363463463463.exe	87
PID 3480 wrote to memory of 1516	3480	4363463463464363463463463.exe	87
PID 3480 wrote to memory of 3136	3480	4363463463464363463463463.exe	88
PID 3480 wrote to memory of 3136	3480	4363463463464363463463463.exe	88
PID 3480 wrote to memory of 3428	3480	4363463463464363463463463.exe	89
PID 3480 wrote to memory of 3428	3480	4363463463464363463463463.exe	89
PID 3480 wrote to memory of 3428	3480	4363463463464363463463463.exe	89
PID 3428 wrote to memory of 3272	3428	Wallet-PrivateKey.Pdf.exe	90
PID 3428 wrote to memory of 3272	3428	Wallet-PrivateKey.Pdf.exe	90
PID 3428 wrote to memory of 3272	3428	Wallet-PrivateKey.Pdf.exe	90
PID 3480 wrote to memory of 4912	3480	4363463463464363463463463.exe	92
PID 3480 wrote to memory of 4912	3480	4363463463464363463463463.exe	92
PID 3480 wrote to memory of 2464	3480	4363463463464363463463463.exe	93
PID 3480 wrote to memory of 2464	3480	4363463463464363463463463.exe	93
PID 3480 wrote to memory of 2464	3480	4363463463464363463463463.exe	93
PID 4912 wrote to memory of 2368	4912	random.exe	94
PID 4912 wrote to memory of 2368	4912	random.exe	94
PID 4912 wrote to memory of 2368	4912	random.exe	94
PID 4912 wrote to memory of 920	4912	random.exe	95
PID 4912 wrote to memory of 920	4912	random.exe	95
PID 4912 wrote to memory of 920	4912	random.exe	95
PID 4912 wrote to memory of 2952	4912	random.exe	96
PID 4912 wrote to memory of 2952	4912	random.exe	96
PID 4912 wrote to memory of 2952	4912	random.exe	96
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 4912 wrote to memory of 2460	4912	random.exe	97
PID 3480 wrote to memory of 2164	3480	4363463463464363463463463.exe	99
PID 3480 wrote to memory of 2164	3480	4363463463464363463463463.exe	99
PID 3480 wrote to memory of 2164	3480	4363463463464363463463463.exe	99
PID 3272 wrote to memory of 800	3272	svchost.exe	101
PID 3272 wrote to memory of 800	3272	svchost.exe	101
PID 800 wrote to memory of 4620	800	SecurityHealthHost.exe	103
PID 800 wrote to memory of 4620	800	SecurityHealthHost.exe	103
PID 4620 wrote to memory of 2196	4620	cmd.exe	105
PID 4620 wrote to memory of 2196	4620	cmd.exe	105
PID 4620 wrote to memory of 972	4620	cmd.exe	106
PID 4620 wrote to memory of 972	4620	cmd.exe	106
PID 4620 wrote to memory of 2772	4620	cmd.exe	107
PID 4620 wrote to memory of 2772	4620	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\Files\TCP.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\TCP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\Files\plrifjidicfid.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\plrifjidicfid.exe"
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Users\Admin\AppData\Local\Temp\Files\Wallet-PrivateKey.Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Wallet-PrivateKey.Pdf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\SecurityHealthHost.exe
      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthHost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f54de641-b5f1-487d-994f-cde4236f1e51.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4620
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2196
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 800
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
      - C:\Windows\system32\timeout.exe
        
        timeout /T 2 /NOBREAK
        6⤵
        Delays execution with timeout.exe
        
        PID:2772
- C:\Users\Admin\AppData\Local\Temp\Files\random.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2952
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2460
- C:\Users\Admin\AppData\Local\Temp\Files\perviy.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\perviy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2464
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2164

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUEyRDQ2QTUtQkEwMS00Q0E0LUIzMEMtNzcwMkRENzkxMkExfSIgdXNlcmlkPSJ7Q0QwMkFFMUUtRDUxMS00ODIzLTg0NEEtNTk4RkJFNkREMTVGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjAyMUJCRTQtNzQxOS00MTc5LTlGREYtQjRERkQzNEMxMUJGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIiIGluc3RhbGxkYXRldGltZT0iMTczOTI5NDgzNCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNzY2NTUyNTM3MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ3OTY3Mzg4NzUiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2332

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4704

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
9918786300ad8c717995d228a3239f40

SHA1
d2eaabdad2ae7975eda10ca4b164aa03ff40e90c

SHA256
98ef46a27db3af45c6a72f04826f6eef615a427f48caae9ccce6ed94a788a3e5

SHA512
d4d43b9a896b8c8029b7a159af96135cfcdf2fb9a1eca4e5c657beee3fd1226d355eba78ac883c89bef5efef179b8609ef9ecf173991b724118339d831e9a040

Download Submit
C:\Users\Admin\AppData\Local\Temp\008898722351

Filesize
63KB

MD5
8e195a05808b604246ac1b67766767af

SHA1
8a6ad7a4c6feab1b532a915f75996b96e1ae1893

SHA256
c979cd46da2dc655bd08fc0181ecaa20e2b276f5ca44aa0717bdf4b9cabce388

SHA512
84f3621ae8bb7ddf6ee224361df9819654cff7a691e2069b5ebba3d7d8be44c0ad68913bbf9d076ac85cefaa3fa58cbd8a75990f23d1f2dabe0e43e76da1c1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\TCP.exe

Filesize
45KB

MD5
f127aef5829703426ff8399a76c1852c

SHA1
17e72d081ceb20119abe7bef8c640d5db48276f6

SHA256
6907ab3a0f4e69bf6dcb8c03a18bd8402afa701ade8863a0e15808614ffb1b17

SHA512
c3125920567b59119b86e284ed96c3860b1998f9d6b6078b5c2a18aa6b4c56274124fd2f77710bbbf972a6387ef20cb4a5d19c96be2131fb02f6d5692c2384c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Wallet-PrivateKey.Pdf.exe

Filesize
107KB

MD5
036ba72c9c4cf36bda1dc440d537af3c

SHA1
3c10ef9932ffc206a586fe5768879bf078e9ebeb

SHA256
bb41ae95f911a55ab1101ca7854918ec0f23548376d4846a2176b9c289102114

SHA512
c7e8c37787b759bca7fb6d02692c0263d6c60f606ee52e890f3c177dabd00ac6305cd43056164f6e16fbc18046a8c4226172f295ebc85e310ea7e52878d5137d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\perviy.exe

Filesize
239KB

MD5
23ad8a022dd0138e14615a93b01d87da

SHA1
8c8d2b1d1c8006410fab2111b56ab55e0d55eb8b

SHA256
fbb5cee6f3ee4ca8643b64da8d85e2aee256199f009d195d8b776cf0445e4b91

SHA512
c1889f29d8813b4853a688900c461a6f45950038387069176fc8950ba44f6c53705a39fdc09dfdd32979cd3f12790898fe505ea3c725f55413b4b3234e545c86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\plrifjidicfid.exe

Filesize
105KB

MD5
b56db4ebf7110c1083550ed83a03df17

SHA1
258b171956d961a628efa6433f8cb3f629a346fc

SHA256
2d6863a49648f59642f53236790f35a63df119facda1d98549025b3a8ddac2fb

SHA512
f94d231f631a55a14130b7c8d9f5c1fd314b0b07029dc28146677f65aac99055e860b5744231b119fb06d0d582db59d4d73716c79f087d4fa455955a77ba4580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\random.exe

Filesize
514KB

MD5
26d8d52bac8f4615861f39e118efa28d

SHA1
efd5a7ccd128ffe280af75ec8b3e465c989d9e35

SHA256
8521a1f4d523a2a9e7f8ddf01147e65e7f3ff54b268e9b40f91e07dc01fa148f

SHA512
1911a21d654e317fba50308007bb9d56fba2c19a545ef6dfaade17821b0f8fc48aa041c8a4a0339bee61cbd429852d561985e27c574eced716b2e937afa18733

Download Submit
C:\Users\Admin\AppData\Local\Temp\SecurityHealthHost.exe

Filesize
3.7MB

MD5
6967a105bf22f11871cf14fb2fda7bf1

SHA1
9be5af0232c8219b9ba0df4cb2b924b07e467ac2

SHA256
d06a144d1382d9fb1596b5a7a94d43377249bc95faee1d7b23dce3d6ac98dd3d

SHA512
df232d8915746eac5383a179fbcf322d697eacca9104da95962826a85416555c708575ffb84a769d8699c03597309a84269f310f3d555525a39f86967f85dcc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4lvarr23.4pf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\f54de641-b5f1-487d-994f-cde4236f1e51.bat

Filesize
151B

MD5
5ea688e3c877101837eaa05b3b6b531b

SHA1
252a60373659fe784464323587b7e278b29a0b6d

SHA256
d8c1feb552976a859ae3890da831cc4f3944e7a95c5390cfe024b0c4c1f95227

SHA512
e573dc6dee8db7e0bed30885fd41c19a992c9dec956e62e1f94ccb82e62b3adf282586ac8ca76712f5ca3f149d671616591ea6ba3122134bec1f449db5759942

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
73KB

MD5
9d347d5ac998a89f78ba00e74b951f55

SHA1
73df3d5c8388a4d6693cbb24f719dba8833c9157

SHA256
2ea5686422bd8fb6eda542e9a96588f9deb1c97c45f3cb7d3b21ac4da540b57c

SHA512
3db7421aa98e8e108bf982048dda7e0f09428c6498cf5f9f56ef499fb2fafc5deabde8ecb99e1fdd570d54ae9c0533b7502de5848c9e772708cf75509d0c9d9e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LgAmARwZ.url

Filesize
64B

MD5
76f433b3fbd6c3d0ca94f50293292ecc

SHA1
55cecbed8cb353b05ce046ad185488fbcb91bed8

SHA256
b04b8ad6f41d55d715fee227f2c1e4d333627ff2a1b89c0f55e35384028f1b32

SHA512
829f24bd3474abb436d4f685fc6ec8172b1d3ad548cfa71b3cd263b0a3fc353ae4cdd0ab925397fdb07bfa859e79711a6c0b7dbdd95b94b419fedce60090bdb6

Download Submit
memory/800-124-0x0000022727620000-0x00000227279D6000-memory.dmp

Filesize
3.7MB

Download
memory/948-139-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/948-146-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/948-138-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/948-144-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/948-145-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/948-149-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/948-140-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/948-148-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/948-150-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/948-147-0x0000021B65730000-0x0000021B65731000-memory.dmp

Filesize
4KB

Download
memory/1516-18-0x0000000000AF0000-0x0000000000B02000-memory.dmp

Filesize
72KB

Download
memory/1516-19-0x0000000074290000-0x0000000074A41000-memory.dmp

Filesize
7.7MB

Download
memory/1516-56-0x0000000074290000-0x0000000074A41000-memory.dmp

Filesize
7.7MB

Download
memory/2164-119-0x0000000007500000-0x0000000007546000-memory.dmp

Filesize
280KB

Download
memory/2164-117-0x0000000006420000-0x000000000646C000-memory.dmp

Filesize
304KB

Download
memory/2164-116-0x00000000063D0000-0x00000000063EE000-memory.dmp

Filesize
120KB

Download
memory/2164-102-0x0000000005070000-0x00000000050A6000-memory.dmp

Filesize
216KB

Download
memory/2164-103-0x0000000005790000-0x0000000005DBA000-memory.dmp

Filesize
6.2MB

Download
memory/2164-106-0x0000000005750000-0x0000000005772000-memory.dmp

Filesize
136KB

Download
memory/2164-115-0x0000000005F10000-0x0000000006267000-memory.dmp

Filesize
3.3MB

Download
memory/2164-111-0x0000000005EA0000-0x0000000005F06000-memory.dmp

Filesize
408KB

Download
memory/2164-110-0x0000000005E30000-0x0000000005E96000-memory.dmp

Filesize
408KB

Download
memory/2460-84-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2460-85-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2460-82-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2460-81-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2464-77-0x0000000000BB0000-0x0000000000E00000-memory.dmp

Filesize
2.3MB

Download
memory/2464-79-0x0000000000BB0000-0x0000000000E00000-memory.dmp

Filesize
2.3MB

Download
memory/3272-55-0x0000000000B60000-0x0000000000B78000-memory.dmp

Filesize
96KB

Download
memory/3428-54-0x0000000006900000-0x000000000690A000-memory.dmp

Filesize
40KB

Download
memory/3428-41-0x0000000004CF0000-0x0000000004D82000-memory.dmp

Filesize
584KB

Download
memory/3428-40-0x00000000051B0000-0x0000000005756000-memory.dmp

Filesize
5.6MB

Download
memory/3428-39-0x0000000000380000-0x00000000003A0000-memory.dmp

Filesize
128KB

Download
memory/3480-0-0x000000007429E000-0x000000007429F000-memory.dmp

Filesize
4KB

Download
memory/3480-6-0x0000000074290000-0x0000000074A41000-memory.dmp

Filesize
7.7MB

Download
memory/3480-4-0x000000007429E000-0x000000007429F000-memory.dmp

Filesize
4KB

Download
memory/3480-3-0x0000000074290000-0x0000000074A41000-memory.dmp

Filesize
7.7MB

Download
memory/3480-2-0x0000000004DD0000-0x0000000004E6C000-memory.dmp

Filesize
624KB

Download
memory/3480-1-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download
memory/4912-69-0x000000001C7C0000-0x000000001C842000-memory.dmp

Filesize
520KB

Download
memory/4912-68-0x00000000008F0000-0x0000000000976000-memory.dmp

Filesize
536KB

Download