amadey | a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c

Analysis

max time kernel
135s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe
Size

1011KB
MD5

560e9a6f0e847305865b54f43c367e82
SHA1

aec7a41211f7d42a686949ed2ed3a7e84947dcb3
SHA256

a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c
SHA512

0eca0ffc79b56c704ce0cb445bd454e384f1c3bbc0ac375eb813e40aa280b8fb6f3253e31869f64798f59a1fd65407c177097c0d5c6f7a016359994106673f7b
SSDEEP

24576:dyOhG5f5crFNzYZOmyzMhoHsA8bwLNaEcvyiLcJ:4Ogf5cr8YnMhoMA0+NfWyiI

Score

10^/10

amadey redline down roxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

roxi

193.233.20.31:4125

Attributes

auth_value
9d8be78c896acc3cf8b8a6637a221376

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

bus7347.execor4886.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bus7347.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor4886.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor4886.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor4886.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bus7347.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bus7347.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bus7347.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor4886.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor4886.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bus7347.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bus7347.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor4886.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4388-209-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-210-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-217-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-213-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-220-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-222-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-224-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-226-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-228-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-230-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-232-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-234-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-236-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-238-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-240-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-242-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-244-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-246-0x0000000004C70000-0x0000000004CAE000-memory.dmp	family_redline
behavioral1/memory/4388-1128-0x0000000004B40000-0x0000000004B50000-memory.dmp	family_redline
behavioral1/memory/4388-1129-0x0000000004B40000-0x0000000004B50000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge304682.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	ge304682.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 11 IoCs

Processes:

kino6914.exekino7018.exekino0573.exebus7347.execor4886.exeddN73s20.exeen176679.exege304682.exemetafor.exemetafor.exemetafor.exe

pid	process
1684	kino6914.exe
1176	kino7018.exe
2212	kino0573.exe
372	bus7347.exe
2108	cor4886.exe
4388	ddN73s20.exe
4792	en176679.exe
3876	ge304682.exe
1664	metafor.exe
992	metafor.exe
3148	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

cor4886.exebus7347.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor4886.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bus7347.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor4886.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exekino6914.exekino7018.exekino0573.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino6914.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kino6914.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino7018.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kino7018.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino0573.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kino0573.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

460 2108 WerFault.exe cor4886.exe
1244 4388 WerFault.exe ddN73s20.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3596 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bus7347.execor4886.exeddN73s20.exeen176679.exe

pid process

372 bus7347.exe
372 bus7347.exe
2108 cor4886.exe
2108 cor4886.exe
4388 ddN73s20.exe
4388 ddN73s20.exe
4792 en176679.exe
4792 en176679.exe

pid	pid_target	process	target process
460	2108	WerFault.exe	cor4886.exe
1244	4388	WerFault.exe	ddN73s20.exe

pid	process
3596	schtasks.exe

pid	process
372	bus7347.exe
372	bus7347.exe
2108	cor4886.exe
2108	cor4886.exe
4388	ddN73s20.exe
4388	ddN73s20.exe
4792	en176679.exe
4792	en176679.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bus7347.execor4886.exeddN73s20.exeen176679.exe

description	pid	process
Token: SeDebugPrivilege	372	bus7347.exe
Token: SeDebugPrivilege	2108	cor4886.exe
Token: SeDebugPrivilege	4388	ddN73s20.exe
Token: SeDebugPrivilege	4792	en176679.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exekino6914.exekino7018.exekino0573.exege304682.exemetafor.execmd.exe

description	pid	process	target process
PID 4316 wrote to memory of 1684	4316	a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe	kino6914.exe
PID 4316 wrote to memory of 1684	4316	a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe	kino6914.exe
PID 4316 wrote to memory of 1684	4316	a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe	kino6914.exe
PID 1684 wrote to memory of 1176	1684	kino6914.exe	kino7018.exe
PID 1684 wrote to memory of 1176	1684	kino6914.exe	kino7018.exe
PID 1684 wrote to memory of 1176	1684	kino6914.exe	kino7018.exe
PID 1176 wrote to memory of 2212	1176	kino7018.exe	kino0573.exe
PID 1176 wrote to memory of 2212	1176	kino7018.exe	kino0573.exe
PID 1176 wrote to memory of 2212	1176	kino7018.exe	kino0573.exe
PID 2212 wrote to memory of 372	2212	kino0573.exe	bus7347.exe
PID 2212 wrote to memory of 372	2212	kino0573.exe	bus7347.exe
PID 2212 wrote to memory of 2108	2212	kino0573.exe	cor4886.exe
PID 2212 wrote to memory of 2108	2212	kino0573.exe	cor4886.exe
PID 2212 wrote to memory of 2108	2212	kino0573.exe	cor4886.exe
PID 1176 wrote to memory of 4388	1176	kino7018.exe	ddN73s20.exe
PID 1176 wrote to memory of 4388	1176	kino7018.exe	ddN73s20.exe
PID 1176 wrote to memory of 4388	1176	kino7018.exe	ddN73s20.exe
PID 1684 wrote to memory of 4792	1684	kino6914.exe	en176679.exe
PID 1684 wrote to memory of 4792	1684	kino6914.exe	en176679.exe
PID 1684 wrote to memory of 4792	1684	kino6914.exe	en176679.exe
PID 4316 wrote to memory of 3876	4316	a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe	ge304682.exe
PID 4316 wrote to memory of 3876	4316	a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe	ge304682.exe
PID 4316 wrote to memory of 3876	4316	a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe	ge304682.exe
PID 3876 wrote to memory of 1664	3876	ge304682.exe	metafor.exe
PID 3876 wrote to memory of 1664	3876	ge304682.exe	metafor.exe
PID 3876 wrote to memory of 1664	3876	ge304682.exe	metafor.exe
PID 1664 wrote to memory of 3596	1664	metafor.exe	schtasks.exe
PID 1664 wrote to memory of 3596	1664	metafor.exe	schtasks.exe
PID 1664 wrote to memory of 3596	1664	metafor.exe	schtasks.exe
PID 1664 wrote to memory of 4844	1664	metafor.exe	cmd.exe
PID 1664 wrote to memory of 4844	1664	metafor.exe	cmd.exe
PID 1664 wrote to memory of 4844	1664	metafor.exe	cmd.exe
PID 4844 wrote to memory of 4872	4844	cmd.exe	cmd.exe
PID 4844 wrote to memory of 4872	4844	cmd.exe	cmd.exe
PID 4844 wrote to memory of 4872	4844	cmd.exe	cmd.exe
PID 4844 wrote to memory of 5028	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 5028	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 5028	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 4936	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 4936	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 4936	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 3260	4844	cmd.exe	cmd.exe
PID 4844 wrote to memory of 3260	4844	cmd.exe	cmd.exe
PID 4844 wrote to memory of 3260	4844	cmd.exe	cmd.exe
PID 4844 wrote to memory of 2204	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 2204	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 2204	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 3344	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 3344	4844	cmd.exe	cacls.exe
PID 4844 wrote to memory of 3344	4844	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe
"C:\Users\Admin\AppData\Local\Temp\a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6914.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6914.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7018.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7018.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0573.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0573.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7347.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7347.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:372
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4886.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 1076
        6⤵
        Program crash
        
        PID:460
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddN73s20.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddN73s20.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1356
        5⤵
        Program crash
        
        PID:1244
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en176679.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en176679.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge304682.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge304682.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
    "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3596
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4872
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:N"
        5⤵
        
        PID:5028
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:R" /E
        5⤵
        
        PID:4936
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3260
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:N"
        5⤵
        
        PID:2204
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:R" /E
        5⤵
        
        PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2108 -ip 2108
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4388 -ip 4388
1⤵
PID:4644

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:992

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:3148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge304682.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge304682.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6914.exe

Filesize
828KB

MD5
41046bd23cc07e4751f2a75caa82a7f3

SHA1
d791f4d22aec2c0ccdc1faa012b314b8a5537a24

SHA256
ec7afc5ec7a6e13a63ed8839ad360420ea9550a75d909cad122c1a41e89f5545

SHA512
7de6330a730adf31aa8c449537d6b8d87f7efa7dd795b49c4b10554724ff9810e7a32d83cebcc9f2ba40ef7aa323c2984d54de159167b453c941a1c882fdf1c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6914.exe

Filesize
828KB

MD5
41046bd23cc07e4751f2a75caa82a7f3

SHA1
d791f4d22aec2c0ccdc1faa012b314b8a5537a24

SHA256
ec7afc5ec7a6e13a63ed8839ad360420ea9550a75d909cad122c1a41e89f5545

SHA512
7de6330a730adf31aa8c449537d6b8d87f7efa7dd795b49c4b10554724ff9810e7a32d83cebcc9f2ba40ef7aa323c2984d54de159167b453c941a1c882fdf1c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en176679.exe

Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en176679.exe

Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7018.exe

Filesize
686KB

MD5
2dd14057aec1eae0e193c6fbf5199b2a

SHA1
82c95d596a6eee5c2c4a9f5a5acf0f807b3cbc4b

SHA256
dbcc8198374d0b076384814cc22b1c5a8d1d823e65c57d994811e32376d91866

SHA512
f560137c6717b77b2e725dcbcb3280078c515cb2d1d24d05959dcc2a0453ecca09a51581807744402327786b2ba1a307f5be59ded0f891be80dd7d4b012f5b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7018.exe

Filesize
686KB

MD5
2dd14057aec1eae0e193c6fbf5199b2a

SHA1
82c95d596a6eee5c2c4a9f5a5acf0f807b3cbc4b

SHA256
dbcc8198374d0b076384814cc22b1c5a8d1d823e65c57d994811e32376d91866

SHA512
f560137c6717b77b2e725dcbcb3280078c515cb2d1d24d05959dcc2a0453ecca09a51581807744402327786b2ba1a307f5be59ded0f891be80dd7d4b012f5b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddN73s20.exe

Filesize
355KB

MD5
68810a912a947f1e81f6dd753a8e735a

SHA1
33114fe1ded2120993df0ed74d93605ec449c772

SHA256
b0bfe519bd9d7456867665462e8ebfa9ff93da0bfc2651804a84d6f19f99b37e

SHA512
0f6027f0d210a807de2222295c78a4a3b92386904e8b1c167ccd450a02c74eff163684a156666e91be4e9384cfe64d3749b9018f289aa9049412b9083b5fcff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddN73s20.exe

Filesize
355KB

MD5
68810a912a947f1e81f6dd753a8e735a

SHA1
33114fe1ded2120993df0ed74d93605ec449c772

SHA256
b0bfe519bd9d7456867665462e8ebfa9ff93da0bfc2651804a84d6f19f99b37e

SHA512
0f6027f0d210a807de2222295c78a4a3b92386904e8b1c167ccd450a02c74eff163684a156666e91be4e9384cfe64d3749b9018f289aa9049412b9083b5fcff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0573.exe

Filesize
340KB

MD5
1eecfe60fe6687954a7b81d72a1b2cff

SHA1
5c47ed2f67a141bfd89c4061dfa690ebd53f0da9

SHA256
db8dd9b7398a889bdfc2312830958ce2ddef346175da6c7f0bde3e301a6a739e

SHA512
2141557254663430561929efa53511de839bed01e595ddc02b30fd0cad190e6d02985d8fa78313966e5cba985b365999e6b2e18eea06db5448ce12c0d4065dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0573.exe

Filesize
340KB

MD5
1eecfe60fe6687954a7b81d72a1b2cff

SHA1
5c47ed2f67a141bfd89c4061dfa690ebd53f0da9

SHA256
db8dd9b7398a889bdfc2312830958ce2ddef346175da6c7f0bde3e301a6a739e

SHA512
2141557254663430561929efa53511de839bed01e595ddc02b30fd0cad190e6d02985d8fa78313966e5cba985b365999e6b2e18eea06db5448ce12c0d4065dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7347.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7347.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4886.exe

Filesize
298KB

MD5
09dafa76e70e412e88c563c06fe7e601

SHA1
c324c9dd8042fd64b3d97514727cf0fb3a938901

SHA256
bf1be2437ac9e95f41383aedb7858f8484e709116192fae7ac259a28feb2e96d

SHA512
ac566b737a7afb772b9af586a317221e242157b14e462e342578c1afca36f7219fb035cd809f70d050164902951924af9146547714ede5cbdcdec255d4809da2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4886.exe

Filesize
298KB

MD5
09dafa76e70e412e88c563c06fe7e601

SHA1
c324c9dd8042fd64b3d97514727cf0fb3a938901

SHA256
bf1be2437ac9e95f41383aedb7858f8484e709116192fae7ac259a28feb2e96d

SHA512
ac566b737a7afb772b9af586a317221e242157b14e462e342578c1afca36f7219fb035cd809f70d050164902951924af9146547714ede5cbdcdec255d4809da2

Download Submit
memory/372-161-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2108-176-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-198-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-180-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-182-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-184-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-186-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-188-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-190-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-192-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-194-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-196-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-178-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-199-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/2108-200-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2108-201-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2108-203-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2108-204-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/2108-174-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-172-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-171-0x0000000007110000-0x0000000007122000-memory.dmp

Filesize
72KB

Download
memory/2108-170-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2108-169-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/2108-168-0x0000000002C80000-0x0000000002CAD000-memory.dmp

Filesize
180KB

Download
memory/2108-167-0x0000000007260000-0x0000000007804000-memory.dmp

Filesize
5.6MB

Download
memory/4388-217-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-1123-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/4388-222-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-224-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-226-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-228-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-230-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-232-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-234-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-236-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-238-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-240-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-242-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-244-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-246-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-1119-0x0000000007920000-0x0000000007F38000-memory.dmp

Filesize
6.1MB

Download
memory/4388-1120-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/4388-1121-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/4388-1122-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/4388-220-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-1125-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/4388-1126-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/4388-1127-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/4388-1128-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/4388-1129-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/4388-1130-0x0000000008DC0000-0x0000000008F82000-memory.dmp

Filesize
1.8MB

Download
memory/4388-1131-0x0000000008F90000-0x00000000094BC000-memory.dmp

Filesize
5.2MB

Download
memory/4388-1132-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/4388-1133-0x000000000A8F0000-0x000000000A966000-memory.dmp

Filesize
472KB

Download
memory/4388-1134-0x000000000A970000-0x000000000A9C0000-memory.dmp

Filesize
320KB

Download
memory/4388-209-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-210-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-219-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/4388-216-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/4388-213-0x0000000004C70000-0x0000000004CAE000-memory.dmp

Filesize
248KB

Download
memory/4388-214-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/4388-212-0x0000000002CB0000-0x0000000002CFB000-memory.dmp

Filesize
300KB

Download
memory/4792-1141-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/4792-1140-0x0000000000A20000-0x0000000000A52000-memory.dmp

Filesize
200KB

Download