amadey | c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb

Analysis

max time kernel
113s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe
Size

1008KB
MD5

1d516f0bb3b7e7b7555e391987483029
SHA1

0165b2b4fc76fd5b1a2ebd7eea2fe4259db2eb9b
SHA256

c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb
SHA512

45dbd64e1145e738c1eaa2cfbc5d3f3f4b15143ff2f641e0edc53909ad186396f24857d825fe11e58b197c69b010bfb3f2eaa8225f616dfaea75487834304d71
SSDEEP

24576:Lyk71QXPKhG5awDO+CF7WAtW9bfOsX+4afRNCLtVb1S:+eQyhYDO+E79tmGsX+4CzO

Score

10^/10

amadey redline down roxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

roxi

193.233.20.31:4125

Attributes

auth_value
9d8be78c896acc3cf8b8a6637a221376

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

bus5792.execor1201.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bus5792.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor1201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor1201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor1201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor1201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor1201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor1201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bus5792.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bus5792.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bus5792.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bus5792.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bus5792.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1164-214-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-215-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-217-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-219-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-221-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-223-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-227-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-225-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-229-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-231-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-233-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-235-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-237-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-239-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-241-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-243-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-245-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline
behavioral1/memory/1164-247-0x0000000007740000-0x000000000777E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge627822.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	ge627822.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 11 IoCs

Processes:

kino6252.exekino1675.exekino5156.exebus5792.execor1201.exedVs73s52.exeen977183.exege627822.exemetafor.exemetafor.exemetafor.exe

pid	process
1296	kino6252.exe
1060	kino1675.exe
2880	kino5156.exe
4004	bus5792.exe
4592	cor1201.exe
1164	dVs73s52.exe
4652	en977183.exe
1704	ge627822.exe
5020	metafor.exe
3040	metafor.exe
2652	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

cor1201.exebus5792.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor1201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor1201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bus5792.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kino5156.exec1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exekino6252.exekino1675.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kino5156.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino6252.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kino6252.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino1675.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kino1675.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino5156.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4244 4592 WerFault.exe cor1201.exe
2012 1164 WerFault.exe dVs73s52.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2124 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bus5792.execor1201.exedVs73s52.exeen977183.exe

pid process

4004 bus5792.exe
4004 bus5792.exe
4592 cor1201.exe
4592 cor1201.exe
1164 dVs73s52.exe
1164 dVs73s52.exe
4652 en977183.exe
4652 en977183.exe

pid	pid_target	process	target process
4244	4592	WerFault.exe	cor1201.exe
2012	1164	WerFault.exe	dVs73s52.exe

pid	process
2124	schtasks.exe

pid	process
4004	bus5792.exe
4004	bus5792.exe
4592	cor1201.exe
4592	cor1201.exe
1164	dVs73s52.exe
1164	dVs73s52.exe
4652	en977183.exe
4652	en977183.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bus5792.execor1201.exedVs73s52.exeen977183.exe

description	pid	process
Token: SeDebugPrivilege	4004	bus5792.exe
Token: SeDebugPrivilege	4592	cor1201.exe
Token: SeDebugPrivilege	1164	dVs73s52.exe
Token: SeDebugPrivilege	4652	en977183.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exekino6252.exekino1675.exekino5156.exege627822.exemetafor.execmd.exe

description	pid	process	target process
PID 2092 wrote to memory of 1296	2092	c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe	kino6252.exe
PID 2092 wrote to memory of 1296	2092	c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe	kino6252.exe
PID 2092 wrote to memory of 1296	2092	c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe	kino6252.exe
PID 1296 wrote to memory of 1060	1296	kino6252.exe	kino1675.exe
PID 1296 wrote to memory of 1060	1296	kino6252.exe	kino1675.exe
PID 1296 wrote to memory of 1060	1296	kino6252.exe	kino1675.exe
PID 1060 wrote to memory of 2880	1060	kino1675.exe	kino5156.exe
PID 1060 wrote to memory of 2880	1060	kino1675.exe	kino5156.exe
PID 1060 wrote to memory of 2880	1060	kino1675.exe	kino5156.exe
PID 2880 wrote to memory of 4004	2880	kino5156.exe	bus5792.exe
PID 2880 wrote to memory of 4004	2880	kino5156.exe	bus5792.exe
PID 2880 wrote to memory of 4592	2880	kino5156.exe	cor1201.exe
PID 2880 wrote to memory of 4592	2880	kino5156.exe	cor1201.exe
PID 2880 wrote to memory of 4592	2880	kino5156.exe	cor1201.exe
PID 1060 wrote to memory of 1164	1060	kino1675.exe	dVs73s52.exe
PID 1060 wrote to memory of 1164	1060	kino1675.exe	dVs73s52.exe
PID 1060 wrote to memory of 1164	1060	kino1675.exe	dVs73s52.exe
PID 1296 wrote to memory of 4652	1296	kino6252.exe	en977183.exe
PID 1296 wrote to memory of 4652	1296	kino6252.exe	en977183.exe
PID 1296 wrote to memory of 4652	1296	kino6252.exe	en977183.exe
PID 2092 wrote to memory of 1704	2092	c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe	ge627822.exe
PID 2092 wrote to memory of 1704	2092	c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe	ge627822.exe
PID 2092 wrote to memory of 1704	2092	c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe	ge627822.exe
PID 1704 wrote to memory of 5020	1704	ge627822.exe	metafor.exe
PID 1704 wrote to memory of 5020	1704	ge627822.exe	metafor.exe
PID 1704 wrote to memory of 5020	1704	ge627822.exe	metafor.exe
PID 5020 wrote to memory of 2124	5020	metafor.exe	schtasks.exe
PID 5020 wrote to memory of 2124	5020	metafor.exe	schtasks.exe
PID 5020 wrote to memory of 2124	5020	metafor.exe	schtasks.exe
PID 5020 wrote to memory of 1892	5020	metafor.exe	cmd.exe
PID 5020 wrote to memory of 1892	5020	metafor.exe	cmd.exe
PID 5020 wrote to memory of 1892	5020	metafor.exe	cmd.exe
PID 1892 wrote to memory of 2016	1892	cmd.exe	cmd.exe
PID 1892 wrote to memory of 2016	1892	cmd.exe	cmd.exe
PID 1892 wrote to memory of 2016	1892	cmd.exe	cmd.exe
PID 1892 wrote to memory of 1216	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 1216	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 1216	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 1596	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 1596	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 1596	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 1004	1892	cmd.exe	cmd.exe
PID 1892 wrote to memory of 1004	1892	cmd.exe	cmd.exe
PID 1892 wrote to memory of 1004	1892	cmd.exe	cmd.exe
PID 1892 wrote to memory of 4488	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 4488	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 4488	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 2532	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 2532	1892	cmd.exe	cacls.exe
PID 1892 wrote to memory of 2532	1892	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe
"C:\Users\Admin\AppData\Local\Temp\c1d4606dc14a50873ca8d7b259b2fe30158c3474fb3e1220315f5db4d9c87beb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2092

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6252.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6252.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1296

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino1675.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino1675.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1060

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5156.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5156.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2880

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus5792.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus5792.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1201.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1201.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 1056
6⤵
- Program crash
PID:4244

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dVs73s52.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dVs73s52.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1868
5⤵
- Program crash
PID:2012

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en977183.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en977183.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge627822.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge627822.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
4⤵
- Creates scheduled task(s)
PID:2124

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2016

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:N"
5⤵
PID:1216

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:R" /E
5⤵
PID:1596

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:N"
5⤵
PID:4488

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1004

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:R" /E
5⤵
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4592 -ip 4592
1⤵
PID:328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1164 -ip 1164
1⤵
PID:2168

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:3040

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:2652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge627822.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge627822.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6252.exe
Filesize
827KB

MD5
6c5e25ce7f58fa93b7e8ea38eff6c9eb

SHA1
f449e1ca95a6f951acf457b950370ab89e2f2db6

SHA256
ceb3d912b948209b3b39e2e7aec1c8133a46744dc5997034b829abc68fc4dcc0

SHA512
5dc3f98f74b0040958255f11a5917934dbea3d252f05fb4c71f7ac4b163d02440a5bad5e7d85336c597e0c0b8f421a68b3c7c1be3b364426f5d9289b72ce0cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6252.exe
Filesize
827KB

MD5
6c5e25ce7f58fa93b7e8ea38eff6c9eb

SHA1
f449e1ca95a6f951acf457b950370ab89e2f2db6

SHA256
ceb3d912b948209b3b39e2e7aec1c8133a46744dc5997034b829abc68fc4dcc0

SHA512
5dc3f98f74b0040958255f11a5917934dbea3d252f05fb4c71f7ac4b163d02440a5bad5e7d85336c597e0c0b8f421a68b3c7c1be3b364426f5d9289b72ce0cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en977183.exe
Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en977183.exe
Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino1675.exe
Filesize
685KB

MD5
f1328de40e7b712b5df2c3e64497d32a

SHA1
6723492f8eed45f6ae8adf14180193fa31d8a096

SHA256
4732fd1e660ae936cf305bd5756be469f987a7cf28653de4d7bd08646f4e7918

SHA512
1e0c49ba0c1c8bf8d5fcb40929694548fb21d97f5688b215d7e29a96d2a5cf3eea7af5ae4904ea110a9bcb62723aabac3a2335a91d107356f4d2fdd070c0cfe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino1675.exe
Filesize
685KB

MD5
f1328de40e7b712b5df2c3e64497d32a

SHA1
6723492f8eed45f6ae8adf14180193fa31d8a096

SHA256
4732fd1e660ae936cf305bd5756be469f987a7cf28653de4d7bd08646f4e7918

SHA512
1e0c49ba0c1c8bf8d5fcb40929694548fb21d97f5688b215d7e29a96d2a5cf3eea7af5ae4904ea110a9bcb62723aabac3a2335a91d107356f4d2fdd070c0cfe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dVs73s52.exe
Filesize
355KB

MD5
7ca2ae62078d35ffdfe1842acfc9bad6

SHA1
5e5e88d329d6531e74e298c3763885385a65b651

SHA256
9d2bf628b24ed57cbd926d2385e81537b0e3d7cc1cb21b6016e1213e57899374

SHA512
7c0c001e31d7d2c23854168f0c0253d1518d6b9c6fa46adaddf710cc01f4139c604f37aaa8efd717e04ff80574ff8dd011daa14a2711cab27c73657e6e9f355e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dVs73s52.exe
Filesize
355KB

MD5
7ca2ae62078d35ffdfe1842acfc9bad6

SHA1
5e5e88d329d6531e74e298c3763885385a65b651

SHA256
9d2bf628b24ed57cbd926d2385e81537b0e3d7cc1cb21b6016e1213e57899374

SHA512
7c0c001e31d7d2c23854168f0c0253d1518d6b9c6fa46adaddf710cc01f4139c604f37aaa8efd717e04ff80574ff8dd011daa14a2711cab27c73657e6e9f355e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5156.exe
Filesize
340KB

MD5
3fd10cda6f5ee5fe2b5bf048bfda5061

SHA1
ba72076788b414f7e0f88bfac387af37ac218173

SHA256
be175722476d4e6c7fb22830dd3cc3f2d0bfd155627a148725d79fbd4d0b168a

SHA512
085b67a9c8882af25e65c5d6c5d3570a6d1af34129cf1cc424c6c507394b36eed220b6569e889f688e6204e8f7759dc798677986d934d42b58c9df7913f15243

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5156.exe
Filesize
340KB

MD5
3fd10cda6f5ee5fe2b5bf048bfda5061

SHA1
ba72076788b414f7e0f88bfac387af37ac218173

SHA256
be175722476d4e6c7fb22830dd3cc3f2d0bfd155627a148725d79fbd4d0b168a

SHA512
085b67a9c8882af25e65c5d6c5d3570a6d1af34129cf1cc424c6c507394b36eed220b6569e889f688e6204e8f7759dc798677986d934d42b58c9df7913f15243

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus5792.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus5792.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1201.exe
Filesize
298KB

MD5
d5aecc86e3e1e5a24701231a899749bf

SHA1
58bef2bb5b1b9eb4d05c1df9f669d9322332bb45

SHA256
74e64a679ec1c38a4ad722b6b0fb8f3d1db97446e1f4b8f49188f50fc9a46f28

SHA512
e8e5d16860be33fbe5fd59521876abb54a85b46d8d91c6ba66016ed88fbb2fb5adc32794717761efd0c4e29313a20a5096050ab2c569586f4e36a9bc3cdcceb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1201.exe
Filesize
298KB

MD5
d5aecc86e3e1e5a24701231a899749bf

SHA1
58bef2bb5b1b9eb4d05c1df9f669d9322332bb45

SHA256
74e64a679ec1c38a4ad722b6b0fb8f3d1db97446e1f4b8f49188f50fc9a46f28

SHA512
e8e5d16860be33fbe5fd59521876abb54a85b46d8d91c6ba66016ed88fbb2fb5adc32794717761efd0c4e29313a20a5096050ab2c569586f4e36a9bc3cdcceb4

Download Submit
memory/1164-1123-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/1164-1128-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/1164-1134-0x0000000009690000-0x00000000096E0000-memory.dmp

Filesize
320KB

Download
memory/1164-1133-0x0000000009600000-0x0000000009676000-memory.dmp

Filesize
472KB

Download
memory/1164-1132-0x0000000008EA0000-0x00000000093CC000-memory.dmp

Filesize
5.2MB

Download
memory/1164-1131-0x0000000008CC0000-0x0000000008E82000-memory.dmp

Filesize
1.8MB

Download
memory/1164-1130-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/1164-1129-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/1164-1127-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/1164-1126-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/1164-1124-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/1164-1122-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/1164-1121-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/1164-1120-0x00000000078D0000-0x0000000007EE8000-memory.dmp

Filesize
6.1MB

Download
memory/1164-247-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-245-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-243-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-210-0x0000000002C60000-0x0000000002CAB000-memory.dmp

Filesize
300KB

Download
memory/1164-212-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/1164-213-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/1164-211-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/1164-214-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-215-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-217-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-219-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-221-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-223-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-227-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-225-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-229-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-231-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-233-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-235-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-237-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-239-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/1164-241-0x0000000007740000-0x000000000777E000-memory.dmp

Filesize
248KB

Download
memory/4004-161-0x00000000000D0000-0x00000000000DA000-memory.dmp

Filesize
40KB

Download
memory/4592-192-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-184-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-194-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-203-0x0000000004650000-0x0000000004660000-memory.dmp

Filesize
64KB

Download
memory/4592-202-0x0000000004650000-0x0000000004660000-memory.dmp

Filesize
64KB

Download
memory/4592-180-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-200-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/4592-199-0x0000000004650000-0x0000000004660000-memory.dmp

Filesize
64KB

Download
memory/4592-198-0x0000000004650000-0x0000000004660000-memory.dmp

Filesize
64KB

Download
memory/4592-186-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-197-0x0000000004650000-0x0000000004660000-memory.dmp

Filesize
64KB

Download
memory/4592-196-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-204-0x0000000004650000-0x0000000004660000-memory.dmp

Filesize
64KB

Download
memory/4592-205-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/4592-172-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-188-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-178-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-176-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-182-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-167-0x0000000002C50000-0x0000000002C7D000-memory.dmp

Filesize
180KB

Download
memory/4592-174-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-190-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-170-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-169-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/4592-168-0x0000000007240000-0x00000000077E4000-memory.dmp

Filesize
5.6MB

Download
memory/4652-1141-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/4652-1140-0x0000000000620000-0x0000000000652000-memory.dmp

Filesize
200KB

Download