amadey | 77c71ac94b604db2bc11b822cd3bfc357abe47f4c967dae4be2383b50c837ed1

Sharing

Copy URL Twitter E-mail

General

Target
Malware.2024.11.18.7z
Size 349.7MB
Sample260915-y7ajbazzfs
SHA256 77c71ac94b604db2bc11b822cd3bfc357abe47f4c967dae4be2383b50c837ed1
MD5 01d71ea18393d1d93350c99017e2aeb2
SHA1 9e1d47b65cc351cb2a8b514581ac26f0980f7abb
SHA512 38844e6a335fa2829e9d2a52626631cc71268dfe23ab87251d0f3674a65990544f8f9ae0437b0ac091d7277f6b29d4c81bf0bd3179700e0b1cdd514e91c56c80
SSDEEP 6291456:ojUyiI0I3VIe9LBq6PBWnH15maC6H08PE2f7jJ4b4KsRhDUTux7JnrfAf1:oIyiI0Iv9LBq6PBWm36UwE2fnJRKszFk
TLSH
T1B40933B28E3B5D89C34BDCD9A400B96E647DC705F152CA42CAC1DEE72E5920C7BAB54C
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
http://master-x.com/index.php
http://kaspersky.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://kaspersky.ru/index.htm
http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Extracted

Family

asyncrat

Version

1.0.7

Botnet

WindowsSEC

AnonKrnl-47127.portmap.io:47127

Mutex

asfqwGDsgWEthQWEhdfhGewhSDF

Attributes

delay
3
install
true
install_file
Windows Security Systray.exe
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

Version

192.168.1.133:4444
america-surrey.gl.at.ply.gg:54338

Mutex

Nen131aoFM2x3zyi

Attributes

Install_directory
%AppData%
install_file
OKEAN.exe
pastebin_url
https://pastebin.com/raw/b28eXjCB

aes.plain

Extracted

Family

stealc

Botnet

mainteam

http://31.58.137.238

Attributes

url_path
/3392f30dc348fa7b.php

Extracted

Family

amadey

Version

3.81

Botnet

f9a925

http://77.91.124.20

Attributes

install_dir
c3912af058
install_file
oneetx.exe
strings_key
0504ce46646b0dc397a3c30d6692ec75
url_paths
/store/games/index.php

rc4.plain

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Extracted

Family

redline

Botnet

dozt

77.91.124.145:4125

Attributes

auth_value
857bdfe4fa14711025859d89f18b32cb

Extracted

Family

redline

Botnet

darm

217.196.96.56:4138

Attributes

auth_value
d88ac8ccc04ab9979b04b46313db1648

Extracted

Family

redline

Botnet

zima

176.113.115.145:4125

Attributes

auth_value
2ef701d510c0d27e8a8e3270281678b1

Extracted

Family

redline

Botnet

muse

176.113.115.145:4125

Attributes

auth_value
b91988a63a24940038d9262827a5320c

Extracted

Family

redline

Botnet

dunkan

193.233.20.24:4123

Attributes

auth_value
505c396c57c6287fc3fdc5f3aeab0819

Extracted

Family

redline

Botnet

forma

193.233.20.24:4123

Attributes

auth_value
50b8e065d7cb1e9e30786f7a370368f9

Extracted

Family

redline

Botnet

dogma

193.233.20.32:4125

Attributes

auth_value
1b692976ca991040f2e8890409c35142

Extracted

Family

redline

Botnet

fchan

pepunn.com:4162

Attributes

auth_value
127bd53d55e8c4f0dd2f6e1ea60deef4

Extracted

Family

redline

Botnet

fabio

193.233.20.27:4123

Attributes

auth_value
56b82736c3f56b13be8e64c87d2cf9e5

Extracted

Family

redline

Botnet

from

176.113.115.145:4125

Attributes

auth_value
8633e283485822a4a48f0a41d5397566

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

Baaptyst-25027.portmap.host:25027

Mutex

0ef8ad75-eaeb-42b1-9495-e9a64cdb45c6

Attributes

encryption_key
76C62DF6E7B70F1A27E24720FDF3E4F2ED196228
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

anonam39-41248.portmap.io:41248

Mutex

bcabad1b-b1a9-478b-a187-3607b6476fd1

Attributes

encryption_key
479AF86B7B3A0AC9CE19AAE974A681BB6EE1949C
install_name
RuntimeBroker.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
a7

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Extracted

Family

metasploit

Version

windows/exec

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.13.147:4444
192.168.100.19:4444

Extracted

Family

metasploit

Version

metasploit_stager

192.168.91.129:1512

Extracted

Family

nanocore

Version

1.2.2.0

[email protected]:46218
178.32.224.116:46218

Mutex

4af74541-e3f1-469c-8af7-efe4071b81cf

Attributes

activate_away_mode
false
backup_connection_host
178.32.224.116
backup_dns_server
buffer_size
65535
build_time
2018-07-28T12:59:38.488799236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
46218
default_group
tourex
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
4af74541-e3f1-469c-8af7-efe4071b81cf
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
[email protected]
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

qqpass

http://zc.qq.com/chs/index.html

Attributes

url
http://i2.tietuku.com/8975c2a506763d03.jpg
user_agent
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Extracted

Family

emotet

Botnet

Epoch3

112.78.142.170:80
178.128.14.92:8080
178.238.232.46:443
185.142.236.163:443
192.210.217.94:8080
192.241.220.183:8080
105.209.235.113:8080
182.187.139.200:8080
188.0.135.237:80
201.213.177.139:80
31.146.61.34:80
202.5.47.71:80
81.17.93.134:80
192.163.221.191:8080
97.104.107.190:80
201.235.10.215:80
181.114.114.203:80
51.38.201.19:7080
46.32.229.152:8080
177.144.130.105:443
188.251.213.180:443
91.83.93.103:443
118.70.15.19:8080
197.83.232.19:80
195.201.56.70:8080
172.105.78.244:8080
177.37.81.212:443
172.96.190.154:8080
177.32.8.85:80
107.161.30.122:8080
175.29.183.2:80
86.57.216.23:80
185.86.148.68:443
198.57.203.63:8080
115.79.195.246:80
177.94.227.143:80
50.116.78.109:8080
181.134.9.162:80
92.24.51.238:80
197.249.6.179:443
87.106.231.60:8080
41.185.29.128:8080
78.189.60.109:443
81.214.253.80:443
77.74.78.80:443
105.213.67.88:80
143.95.101.72:8080
60.125.114.64:443
115.78.11.155:80
71.57.180.213:80
139.59.12.63:8080
203.153.216.178:7080
190.190.15.20:80
37.46.129.215:8080
190.53.144.120:80
203.153.216.182:7080
139.99.157.213:8080
86.98.143.163:80
178.33.167.120:8080
113.161.148.81:80
66.61.94.36:80
74.208.173.91:8080
157.7.164.178:8081
190.212.140.6:80
217.199.160.224:8080
46.105.131.68:8080
185.208.226.142:8080
179.62.238.49:80
179.5.118.12:80
216.75.37.196:8080
181.113.229.139:443
190.164.75.175:80
212.112.113.235:80
5.79.70.250:8080
75.127.14.170:8080

rsa_pubkey.plain

Targets

- Target
  Malware.2024.11.18.7z
- Size 349.7MB
- SHA256 77c71ac94b604db2bc11b822cd3bfc357abe47f4c967dae4be2383b50c837ed1
- MD5 01d71ea18393d1d93350c99017e2aeb2
- SHA1 9e1d47b65cc351cb2a8b514581ac26f0980f7abb
- SHA512 38844e6a335fa2829e9d2a52626631cc71268dfe23ab87251d0f3674a65990544f8f9ae0437b0ac091d7277f6b29d4c81bf0bd3179700e0b1cdd514e91c56c80
- SSDEEP 6291456:ojUyiI0I3VIe9LBq6PBWnH15maC6H08PE2f7jJ4b4KsRhDUTux7JnrfAf1:oIyiI0Iv9LBq6PBWm36UwE2fnJRKszFk
- TLSH
  T1B40933B28E3B5D89C34BDCD9A400B96E647DC705F152CA42CAC1DEE72E5920C7BAB54C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  2024-11-18/Backdoor.Win32.DarkKomet.hqxy-527b317e120f7962291d30cf4e3ea9f8915556b6d4a36ca6b17aa286cf6f8e79
- Size 975KB
- SHA256 527b317e120f7962291d30cf4e3ea9f8915556b6d4a36ca6b17aa286cf6f8e79
- MD5 74bf62d0872f462469647645e9c5e4e0
- SHA1 cfd42b9afc04580ba4773d2988ab6b98094a3d5a
- SHA512 3bbfa4bb8f5ddb0e319a2800ef878c79b2911986321888db2073cccb6c7b906076ff419933c893a68acb949be1bf49f51a5ba975ba584cf3190a973a7000f922
- SSDEEP 12288:3MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9utQRmA59j:3nsJ39LyjbJkQFMhmC+6GD9oQRJl
- TLSH
  T1DA25AE32B2A08A37C0B64B784C1692744A3A7F592D34F90E7FE42DDD8E397422E552D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence macro
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  2024-11-18/Backdoor.Win32.DarkKomet.hqxy-710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91
- Size 2.4MB
- SHA256 710b936106397a34d7f1000e74f032687067b21893d76ccfd3ea4bf5d9111d91
- MD5 bfe942ca711739d291ad987cc724a3a0
- SHA1 317df04b21c29b20c45c4a007ca33cf3d6357392
- SHA512 836bd519511e760a8496787f02dfe26aeb3b45c1603cbbaa2c7adcb5dccb7fc794a87033634f8870fe686e864b6fca42bc920ebc934e78f0f4c7b7d4c10d84e8
- SSDEEP 49152:snsHyjtk2MYC5GDvxdth7VaHBIW2Y4XxChF6Hq2BIetbWx:snsmtk2a8F6fT4XAhIH+eVWx
- TLSH
  T1DCB5F1E2B2D1803FC13107347C5AE2A55496BF421F25A9AFBBE92D4C5B3E6D118DC293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence ransomware
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  2024-11-18/Backdoor.Win32.DarkKomet.hqxy-79bedf578b8e61feabedcd9e9e467c5d325bcca87d453b48796ae33d8cb55feb
- Size 1.8MB
- SHA256 79bedf578b8e61feabedcd9e9e467c5d325bcca87d453b48796ae33d8cb55feb
- MD5 0ff280de0233ba547b6e5e689f83ac90
- SHA1 4342b2f852e52892c8d8a00d6b902d2bd10e15ee
- SHA512 744c18f79e8efba34aca360d3a3931cfd9014db2bd9c5093659c564f5ca50aab0b6f259c168a0ea90faf905c7a7ef9cdfdf7ce924e7e448ba92d96655d1e501f
- SSDEEP 49152:ansHyjtk2MYC5GD5KyUqTEBBKjVFVcSLTx:ansmtk2avyyw6Sh
- TLSH
  T1CE859E22B2D18032E17206355DB9A76A543EFE600F3476CB73E85E4D6E38AC12D357A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery execution xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  2024-11-18/Backdoor.Win32.DarkKomet.hqxy-b828dc24877aa7129ea58fb4bdf7373ec5a8ac06d02907cfe663a4599eae2aa2
- Size 2.4MB
- SHA256 b828dc24877aa7129ea58fb4bdf7373ec5a8ac06d02907cfe663a4599eae2aa2
- MD5 4a3d911453118d58a4bc16043c726142
- SHA1 30755f517d05c784ef5857b3d5fa665cea91b438
- SHA512 ad39db2d93687bec5761514440ef1566049a1c567fcd1ef852c52c312a24f3c2497e9c8ce9fc9564537b5607748daf87bc6f71f4cdd7e1f486833c58708f41f3
- SSDEEP 49152:snsHyjtk2MYC5GDvxdth7VaHBIW2Y4XxChF6Hq2BIetbWr:snsmtk2a8F6fT4XAhIH+eVWr
- TLSH
  T14CB5F1E2B2D1803FC13107347C5AE2A55496BF421F25A9AFBBE92D4C5B3E6D118DC293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence ransomware
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  2024-11-18/Backdoor.Win32.DarkKomet.hqxy-f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca
- Size 3.0MB
- SHA256 f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca
- MD5 66d21c7e8b619bd90c281df45cf2ed86
- SHA1 295631560c1ac8104fe8427de898d043921c42af
- SHA512 5823942b7c784f35a5defb565a69ad7a58545a102b9d68ed72c710846308ef30297976902eb9d9bf271152d81bd364aba7d6ef0408ccdd8a39c2262343ee245e
- SSDEEP 49152:KnsHyjtk2MYC5GDRARtcS4sGmG/E8gglu9mPKG34dOTTtDYd8xX56W2ohUZi5mqr:Knsmtk2aZRtQsGmdXkSG3tYO/NUZZqwS
- TLSH
  T1B9E50222F2D24436D1321A3C9C6B92A45C2ABE512DF8754A3FF9DE4C5E797822C352D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred installer persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  2024-11-18/Backdoor.Win32.Emotet.cjpy-59f30fdd15ba8562e1e882ace16c1a6a7845bf467aa0e53ce6f63b7f62390fa2
- Size 72KB
- SHA256 59f30fdd15ba8562e1e882ace16c1a6a7845bf467aa0e53ce6f63b7f62390fa2
- MD5 2ffe22eb2829a05e50fc513a49791920
- SHA1 e7b4c28e73f79bd12bc25fe85cae7983650c57c8
- SHA512 aef09444859e52f2fb14c1718b36435e03dcc511c214f9895833fa7a27b11e4e6bfd560bb6c4a1edc4daefe65bd759ddcbc689c097f912f2a084b2c779bdbbdf
- SSDEEP 768:C0Zzo2xDoZm3DAZvExxyl5FgupK5YVNfDi9nk0mrxae9R5UT6Arws+Od2iN:1Z0iAZUx8JUY3Di91md79R5m6Aw2d2i
- TLSH
  T17373BF07FBAE84F2E562593118BA7B762A37B8262F50479F5388EC1D42315C1AD2334F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker epoch3 discovery emotet trojan
- Family: Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  2024-11-18/Backdoor.Win32.Emotet.cjpy-8457c544eee3ff43c0a4209a79d39223b529882ccfb113f3d9b1917ab9df9ccf
- Size 72KB
- SHA256 8457c544eee3ff43c0a4209a79d39223b529882ccfb113f3d9b1917ab9df9ccf
- MD5 bc36a9f7d28754a28a9fda8af5142740
- SHA1 e2c3280ea3bbee95b72e42d03a68f098a37f8954
- SHA512 408a62c852d9b74f301bb22c62e158841fd3a3f5fdc3dbf8b6b54dcc7bb0585501df135258076933defa41f32ffaedd61b1c999d1f805f823d12ad3caa8afb57
- SSDEEP 768:C0Zzo2xDoZm3DAZvExxyl5FAupK5YVNfDi9nk0mrxae9R5UT6Arws+Od2iN:1Z0iAZUx8RUY3Di91md79R5m6Aw2d2i
- TLSH
  T17C73BF07FBAE84F2E562593118BA7B762A37B8662F50479F5388EC1D42315C1AD2334F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker epoch3 discovery emotet trojan
- Family: Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Family: Xred

Suspicious Office macro

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Family: Xred

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Family: Xred

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Family: Xred

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Family: Xred

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Family: Emotet

Emotet payload

Executes dropped EXE

Drops file in System32 directory

Family: Emotet

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8