amadey | 64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf

Analysis

max time kernel
119s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe
Size

1010KB
MD5

21af7d4926511fff69e55f4c70bb9bab
SHA1

c22f1470403e0cbaa4edb5c88484b0b8d763fa81
SHA256

64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf
SHA512

6da045ba814cd78bfc234d816c80292eecf8989005afc44391255b6dd90d15b7d8f79b5f4cf7ca705423d324c5e9f2c9affab363d2bb0e6742bf87635a9a4bad
SSDEEP

24576:lyq8j30BW2B/JsVJsNM/GBl0+yf50bQL21tEgMM:AqDW2B/OzsNM/GBlvyf5cu2kr

Score

10^/10

amadey redline down roxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

roxi

193.233.20.31:4125

Attributes

auth_value
9d8be78c896acc3cf8b8a6637a221376

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

bus0765.execor3602.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bus0765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bus0765.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor3602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor3602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor3602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor3602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor3602.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bus0765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bus0765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bus0765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bus0765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor3602.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2812-210-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-211-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-213-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-216-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-223-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-225-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-221-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-227-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-229-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-231-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-233-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-235-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-237-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-239-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-241-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-243-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-245-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-247-0x0000000004E30000-0x0000000004E6E000-memory.dmp	family_redline
behavioral1/memory/2812-1128-0x0000000007440000-0x0000000007450000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge939833.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	ge939833.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 11 IoCs

Processes:

kino8148.exekino6740.exekino1102.exebus0765.execor3602.exedhQ45s25.exeen639582.exege939833.exemetafor.exemetafor.exemetafor.exe

pid	process
4524	kino8148.exe
728	kino6740.exe
1084	kino1102.exe
1196	bus0765.exe
1064	cor3602.exe
2812	dhQ45s25.exe
1592	en639582.exe
3888	ge939833.exe
4956	metafor.exe
1684	metafor.exe
1604	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bus0765.execor3602.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bus0765.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor3602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor3602.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kino8148.exekino6740.exekino1102.exe64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino8148.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kino8148.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino6740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kino6740.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino1102.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kino1102.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3932 1064 WerFault.exe cor3602.exe
1844 2812 WerFault.exe dhQ45s25.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2408 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bus0765.execor3602.exedhQ45s25.exeen639582.exe

pid process

1196 bus0765.exe
1196 bus0765.exe
1064 cor3602.exe
1064 cor3602.exe
2812 dhQ45s25.exe
2812 dhQ45s25.exe
1592 en639582.exe
1592 en639582.exe

pid	pid_target	process	target process
3932	1064	WerFault.exe	cor3602.exe
1844	2812	WerFault.exe	dhQ45s25.exe

pid	process
2408	schtasks.exe

pid	process
1196	bus0765.exe
1196	bus0765.exe
1064	cor3602.exe
1064	cor3602.exe
2812	dhQ45s25.exe
2812	dhQ45s25.exe
1592	en639582.exe
1592	en639582.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bus0765.execor3602.exedhQ45s25.exeen639582.exe

description	pid	process
Token: SeDebugPrivilege	1196	bus0765.exe
Token: SeDebugPrivilege	1064	cor3602.exe
Token: SeDebugPrivilege	2812	dhQ45s25.exe
Token: SeDebugPrivilege	1592	en639582.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exekino8148.exekino6740.exekino1102.exege939833.exemetafor.execmd.exe

description	pid	process	target process
PID 4316 wrote to memory of 4524	4316	64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe	kino8148.exe
PID 4316 wrote to memory of 4524	4316	64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe	kino8148.exe
PID 4316 wrote to memory of 4524	4316	64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe	kino8148.exe
PID 4524 wrote to memory of 728	4524	kino8148.exe	kino6740.exe
PID 4524 wrote to memory of 728	4524	kino8148.exe	kino6740.exe
PID 4524 wrote to memory of 728	4524	kino8148.exe	kino6740.exe
PID 728 wrote to memory of 1084	728	kino6740.exe	kino1102.exe
PID 728 wrote to memory of 1084	728	kino6740.exe	kino1102.exe
PID 728 wrote to memory of 1084	728	kino6740.exe	kino1102.exe
PID 1084 wrote to memory of 1196	1084	kino1102.exe	bus0765.exe
PID 1084 wrote to memory of 1196	1084	kino1102.exe	bus0765.exe
PID 1084 wrote to memory of 1064	1084	kino1102.exe	cor3602.exe
PID 1084 wrote to memory of 1064	1084	kino1102.exe	cor3602.exe
PID 1084 wrote to memory of 1064	1084	kino1102.exe	cor3602.exe
PID 728 wrote to memory of 2812	728	kino6740.exe	dhQ45s25.exe
PID 728 wrote to memory of 2812	728	kino6740.exe	dhQ45s25.exe
PID 728 wrote to memory of 2812	728	kino6740.exe	dhQ45s25.exe
PID 4524 wrote to memory of 1592	4524	kino8148.exe	en639582.exe
PID 4524 wrote to memory of 1592	4524	kino8148.exe	en639582.exe
PID 4524 wrote to memory of 1592	4524	kino8148.exe	en639582.exe
PID 4316 wrote to memory of 3888	4316	64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe	ge939833.exe
PID 4316 wrote to memory of 3888	4316	64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe	ge939833.exe
PID 4316 wrote to memory of 3888	4316	64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe	ge939833.exe
PID 3888 wrote to memory of 4956	3888	ge939833.exe	metafor.exe
PID 3888 wrote to memory of 4956	3888	ge939833.exe	metafor.exe
PID 3888 wrote to memory of 4956	3888	ge939833.exe	metafor.exe
PID 4956 wrote to memory of 2408	4956	metafor.exe	schtasks.exe
PID 4956 wrote to memory of 2408	4956	metafor.exe	schtasks.exe
PID 4956 wrote to memory of 2408	4956	metafor.exe	schtasks.exe
PID 4956 wrote to memory of 3340	4956	metafor.exe	cmd.exe
PID 4956 wrote to memory of 3340	4956	metafor.exe	cmd.exe
PID 4956 wrote to memory of 3340	4956	metafor.exe	cmd.exe
PID 3340 wrote to memory of 4372	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 4372	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 4372	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 3260	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 3260	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 3260	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 752	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 752	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 752	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 2116	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 2116	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 2116	3340	cmd.exe	cmd.exe
PID 3340 wrote to memory of 1004	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 1004	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 1004	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 428	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 428	3340	cmd.exe	cacls.exe
PID 3340 wrote to memory of 428	3340	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe
"C:\Users\Admin\AppData\Local\Temp\64d603663e430729b6f2156cce2705aa79ce5d1af71be8c202b63f3d291fd3cf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino8148.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino8148.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6740.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6740.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:728
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1102.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1102.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus0765.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus0765.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor3602.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor3602.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 1044
        6⤵
        Program crash
        
        PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dhQ45s25.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dhQ45s25.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2812
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 1724
        5⤵
        Program crash
        
        PID:1844
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en639582.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en639582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge939833.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge939833.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
    "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2408
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3340
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4372
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:N"
        5⤵
        
        PID:3260
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:R" /E
        5⤵
        
        PID:752
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2116
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:N"
        5⤵
        
        PID:1004
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:R" /E
        5⤵
        
        PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1064 -ip 1064
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2812 -ip 2812
1⤵
PID:2112

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:1684

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge939833.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge939833.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino8148.exe

Filesize
828KB

MD5
cf076d6eddbe3937dfff67fa3311cf16

SHA1
3472a84ac330a3b6466ee5e8beab5112487c49d4

SHA256
44773769cbaf22e63d0dd2d70874b8aa0a4a0e2c9e51d36f9c9e0865e14d8a06

SHA512
d1f6d98576bffd83b4df038c8e4b903b1ada698d136648229c80dabe41f705c023efc6ed5c58d5ed182903611fb7220dafca0dd8994b8d4b7fe750e1f11a90aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino8148.exe

Filesize
828KB

MD5
cf076d6eddbe3937dfff67fa3311cf16

SHA1
3472a84ac330a3b6466ee5e8beab5112487c49d4

SHA256
44773769cbaf22e63d0dd2d70874b8aa0a4a0e2c9e51d36f9c9e0865e14d8a06

SHA512
d1f6d98576bffd83b4df038c8e4b903b1ada698d136648229c80dabe41f705c023efc6ed5c58d5ed182903611fb7220dafca0dd8994b8d4b7fe750e1f11a90aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en639582.exe

Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en639582.exe

Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6740.exe

Filesize
686KB

MD5
d7cc6b10b5236f081b7c20722ab58486

SHA1
1664622c6878556da3cfd7ac5fa530544ae0fc77

SHA256
c94ebed324691bdee223143133893797ce0f9b3484144cce3fa18b46d936c9ad

SHA512
71aa07f66a11d7856ac3e4d95c4018a5f3663465e090bcbc7afcdea417d40f2a7ce9636e5550f3bf87fea9ad39610be5ea95ba9ee798d810dbaba68a5dbb1309

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6740.exe

Filesize
686KB

MD5
d7cc6b10b5236f081b7c20722ab58486

SHA1
1664622c6878556da3cfd7ac5fa530544ae0fc77

SHA256
c94ebed324691bdee223143133893797ce0f9b3484144cce3fa18b46d936c9ad

SHA512
71aa07f66a11d7856ac3e4d95c4018a5f3663465e090bcbc7afcdea417d40f2a7ce9636e5550f3bf87fea9ad39610be5ea95ba9ee798d810dbaba68a5dbb1309

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dhQ45s25.exe

Filesize
355KB

MD5
0fc0a1bae4be1a74ace3a75d7380ecab

SHA1
d80191041b72016fe24ace0e672a588e592997c9

SHA256
ea388f76fb820258d8a08038f876c3a239ac0f4d1f5386cab8017a21ff66b60d

SHA512
01909beab8e8ae7ad72bcc0bf9e8e4acc1b4906a494f85bcb94a7c255d36b10b93af8eb19c6cde01a778c4ee2cda940eae5297ab2603d26fadfa64f03ed7a88e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dhQ45s25.exe

Filesize
355KB

MD5
0fc0a1bae4be1a74ace3a75d7380ecab

SHA1
d80191041b72016fe24ace0e672a588e592997c9

SHA256
ea388f76fb820258d8a08038f876c3a239ac0f4d1f5386cab8017a21ff66b60d

SHA512
01909beab8e8ae7ad72bcc0bf9e8e4acc1b4906a494f85bcb94a7c255d36b10b93af8eb19c6cde01a778c4ee2cda940eae5297ab2603d26fadfa64f03ed7a88e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1102.exe

Filesize
340KB

MD5
8d5d093613ad893d7987750ff1f3afd9

SHA1
24aeec6afce620864e81bbf22d9d36f9cc7ddc3f

SHA256
3cc118aca210eb37d9dc693b11991935f5c72dcc6784731178206def75db9de0

SHA512
d4475953e46c6f9c660a0be4221aee86df21d807d8d7c7670c373cd36c89fe89b29c85a547e328595cd20f6610b1ee10a247d42e5ca0504d50f1cce29516808d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1102.exe

Filesize
340KB

MD5
8d5d093613ad893d7987750ff1f3afd9

SHA1
24aeec6afce620864e81bbf22d9d36f9cc7ddc3f

SHA256
3cc118aca210eb37d9dc693b11991935f5c72dcc6784731178206def75db9de0

SHA512
d4475953e46c6f9c660a0be4221aee86df21d807d8d7c7670c373cd36c89fe89b29c85a547e328595cd20f6610b1ee10a247d42e5ca0504d50f1cce29516808d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus0765.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus0765.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor3602.exe

Filesize
298KB

MD5
61d1f0073eda7ce3d4c2418bd303f935

SHA1
53a2e65b8ce162c1eafc9fdcfb573141c8462c0d

SHA256
6bd2a128eecdae307c5186127212778a9f6a06c12f4a6921d630cce2e983bc6f

SHA512
6ab9c4c9feac2142de0aa5813a5c35f31e94925cfb69dfddbcfb7c02527c152482c96902b64d35a83858876dc83c1fe5c594c9efba4f6fd2d0cc53829f325a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor3602.exe

Filesize
298KB

MD5
61d1f0073eda7ce3d4c2418bd303f935

SHA1
53a2e65b8ce162c1eafc9fdcfb573141c8462c0d

SHA256
6bd2a128eecdae307c5186127212778a9f6a06c12f4a6921d630cce2e983bc6f

SHA512
6ab9c4c9feac2142de0aa5813a5c35f31e94925cfb69dfddbcfb7c02527c152482c96902b64d35a83858876dc83c1fe5c594c9efba4f6fd2d0cc53829f325a65

Download Submit
memory/1064-183-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-202-0x00000000071D0000-0x00000000071E0000-memory.dmp

Filesize
64KB

Download
memory/1064-181-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-177-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-185-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-187-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-189-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-191-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-193-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-195-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-197-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-199-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-200-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/1064-179-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-203-0x00000000071D0000-0x00000000071E0000-memory.dmp

Filesize
64KB

Download
memory/1064-204-0x00000000071D0000-0x00000000071E0000-memory.dmp

Filesize
64KB

Download
memory/1064-205-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/1064-167-0x00000000071E0000-0x0000000007784000-memory.dmp

Filesize
5.6MB

Download
memory/1064-175-0x00000000071D0000-0x00000000071E0000-memory.dmp

Filesize
64KB

Download
memory/1064-174-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-173-0x00000000071D0000-0x00000000071E0000-memory.dmp

Filesize
64KB

Download
memory/1064-171-0x00000000071D0000-0x00000000071E0000-memory.dmp

Filesize
64KB

Download
memory/1064-170-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1064-169-0x0000000002B80000-0x0000000002BAD000-memory.dmp

Filesize
180KB

Download
memory/1064-168-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/1196-161-0x0000000000690000-0x000000000069A000-memory.dmp

Filesize
40KB

Download
memory/1592-1142-0x00000000052B0000-0x00000000052C0000-memory.dmp

Filesize
64KB

Download
memory/1592-1141-0x0000000000720000-0x0000000000752000-memory.dmp

Filesize
200KB

Download
memory/2812-215-0x0000000002C60000-0x0000000002CAB000-memory.dmp

Filesize
300KB

Download
memory/2812-227-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-229-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-231-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-233-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-235-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-237-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-239-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-241-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-243-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-245-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-247-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-1120-0x0000000007A00000-0x0000000008018000-memory.dmp

Filesize
6.1MB

Download
memory/2812-1121-0x00000000072C0000-0x00000000073CA000-memory.dmp

Filesize
1.0MB

Download
memory/2812-1122-0x0000000004F30000-0x0000000004F42000-memory.dmp

Filesize
72KB

Download
memory/2812-1123-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/2812-1124-0x00000000073D0000-0x000000000740C000-memory.dmp

Filesize
240KB

Download
memory/2812-1126-0x0000000008280000-0x00000000082E6000-memory.dmp

Filesize
408KB

Download
memory/2812-1127-0x0000000008A90000-0x0000000008B22000-memory.dmp

Filesize
584KB

Download
memory/2812-1128-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/2812-1130-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/2812-1129-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/2812-1131-0x0000000008B60000-0x0000000008BD6000-memory.dmp

Filesize
472KB

Download
memory/2812-1132-0x0000000008BF0000-0x0000000008C40000-memory.dmp

Filesize
320KB

Download
memory/2812-1133-0x0000000008D60000-0x0000000008F22000-memory.dmp

Filesize
1.8MB

Download
memory/2812-1134-0x0000000008F40000-0x000000000946C000-memory.dmp

Filesize
5.2MB

Download
memory/2812-221-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-225-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-223-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-219-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/2812-216-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-220-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/2812-217-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download
memory/2812-213-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-211-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-210-0x0000000004E30000-0x0000000004E6E000-memory.dmp

Filesize
248KB

Download
memory/2812-1135-0x0000000007440000-0x0000000007450000-memory.dmp

Filesize
64KB

Download