amadey | fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515

Analysis

max time kernel
144s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe
Size

1010KB
MD5

f75382000254020f2db8cad6873a4639
SHA1

162ba73d9815503411fe4f729fc424b2ea127f2c
SHA256

fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515
SHA512

2d377e866cf1b3012bdec81834ec716e155cfa54446658865e579ce4dfe35bca5e417bd407f3666f94977eb67a446ec09b4ef097897e695e2b3128674fbc2f4a
SSDEEP

24576:Ayxmbb+1Ut751FBuKBPEIbYgbocdcVSzXigAUn8X:Hxmbb+1Ut7yKE41boKcVSTigAUn

Score

10^/10

amadey redline down roxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

roxi

193.233.20.31:4125

Attributes

auth_value
9d8be78c896acc3cf8b8a6637a221376

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

cor4810.exebus8646.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor4810.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bus8646.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bus8646.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bus8646.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor4810.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor4810.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor4810.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bus8646.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bus8646.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bus8646.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor4810.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor4810.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1692-213-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-214-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-216-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-218-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-220-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-222-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-224-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-226-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-228-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-230-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-232-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-234-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-236-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-238-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-240-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-242-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-244-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline
behavioral1/memory/1692-246-0x0000000004C30000-0x0000000004C6E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge031017.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	ge031017.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 11 IoCs

Processes:

kino4365.exekino3553.exekino7959.exebus8646.execor4810.exedcs93s08.exeen100117.exege031017.exemetafor.exemetafor.exemetafor.exe

pid	process
532	kino4365.exe
2112	kino3553.exe
224	kino7959.exe
3952	bus8646.exe
1092	cor4810.exe
1692	dcs93s08.exe
4804	en100117.exe
2984	ge031017.exe
4816	metafor.exe
2776	metafor.exe
1344	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bus8646.execor4810.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bus8646.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor4810.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor4810.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kino3553.exekino7959.exefdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exekino4365.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kino3553.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino7959.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kino7959.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino4365.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kino4365.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino3553.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4540 1092 WerFault.exe cor4810.exe
3428 1692 WerFault.exe dcs93s08.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

5008 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bus8646.execor4810.exedcs93s08.exeen100117.exe

pid process

3952 bus8646.exe
3952 bus8646.exe
1092 cor4810.exe
1092 cor4810.exe
1692 dcs93s08.exe
1692 dcs93s08.exe
4804 en100117.exe
4804 en100117.exe

pid	pid_target	process	target process
4540	1092	WerFault.exe	cor4810.exe
3428	1692	WerFault.exe	dcs93s08.exe

pid	process
5008	schtasks.exe

pid	process
3952	bus8646.exe
3952	bus8646.exe
1092	cor4810.exe
1092	cor4810.exe
1692	dcs93s08.exe
1692	dcs93s08.exe
4804	en100117.exe
4804	en100117.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bus8646.execor4810.exedcs93s08.exeen100117.exe

description	pid	process
Token: SeDebugPrivilege	3952	bus8646.exe
Token: SeDebugPrivilege	1092	cor4810.exe
Token: SeDebugPrivilege	1692	dcs93s08.exe
Token: SeDebugPrivilege	4804	en100117.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exekino4365.exekino3553.exekino7959.exege031017.exemetafor.execmd.exe

description	pid	process	target process
PID 1048 wrote to memory of 532	1048	fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe	kino4365.exe
PID 1048 wrote to memory of 532	1048	fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe	kino4365.exe
PID 1048 wrote to memory of 532	1048	fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe	kino4365.exe
PID 532 wrote to memory of 2112	532	kino4365.exe	kino3553.exe
PID 532 wrote to memory of 2112	532	kino4365.exe	kino3553.exe
PID 532 wrote to memory of 2112	532	kino4365.exe	kino3553.exe
PID 2112 wrote to memory of 224	2112	kino3553.exe	kino7959.exe
PID 2112 wrote to memory of 224	2112	kino3553.exe	kino7959.exe
PID 2112 wrote to memory of 224	2112	kino3553.exe	kino7959.exe
PID 224 wrote to memory of 3952	224	kino7959.exe	bus8646.exe
PID 224 wrote to memory of 3952	224	kino7959.exe	bus8646.exe
PID 224 wrote to memory of 1092	224	kino7959.exe	cor4810.exe
PID 224 wrote to memory of 1092	224	kino7959.exe	cor4810.exe
PID 224 wrote to memory of 1092	224	kino7959.exe	cor4810.exe
PID 2112 wrote to memory of 1692	2112	kino3553.exe	dcs93s08.exe
PID 2112 wrote to memory of 1692	2112	kino3553.exe	dcs93s08.exe
PID 2112 wrote to memory of 1692	2112	kino3553.exe	dcs93s08.exe
PID 532 wrote to memory of 4804	532	kino4365.exe	en100117.exe
PID 532 wrote to memory of 4804	532	kino4365.exe	en100117.exe
PID 532 wrote to memory of 4804	532	kino4365.exe	en100117.exe
PID 1048 wrote to memory of 2984	1048	fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe	ge031017.exe
PID 1048 wrote to memory of 2984	1048	fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe	ge031017.exe
PID 1048 wrote to memory of 2984	1048	fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe	ge031017.exe
PID 2984 wrote to memory of 4816	2984	ge031017.exe	metafor.exe
PID 2984 wrote to memory of 4816	2984	ge031017.exe	metafor.exe
PID 2984 wrote to memory of 4816	2984	ge031017.exe	metafor.exe
PID 4816 wrote to memory of 5008	4816	metafor.exe	schtasks.exe
PID 4816 wrote to memory of 5008	4816	metafor.exe	schtasks.exe
PID 4816 wrote to memory of 5008	4816	metafor.exe	schtasks.exe
PID 4816 wrote to memory of 548	4816	metafor.exe	cmd.exe
PID 4816 wrote to memory of 548	4816	metafor.exe	cmd.exe
PID 4816 wrote to memory of 548	4816	metafor.exe	cmd.exe
PID 548 wrote to memory of 2100	548	cmd.exe	cmd.exe
PID 548 wrote to memory of 2100	548	cmd.exe	cmd.exe
PID 548 wrote to memory of 2100	548	cmd.exe	cmd.exe
PID 548 wrote to memory of 3580	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 3580	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 3580	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 392	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 392	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 392	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 4140	548	cmd.exe	cmd.exe
PID 548 wrote to memory of 4140	548	cmd.exe	cmd.exe
PID 548 wrote to memory of 4140	548	cmd.exe	cmd.exe
PID 548 wrote to memory of 3824	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 3824	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 3824	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 1688	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 1688	548	cmd.exe	cacls.exe
PID 548 wrote to memory of 1688	548	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe
"C:\Users\Admin\AppData\Local\Temp\fdd6a63e1c2b24ccdf700d184ed3a547c3211ca3ad3f8f252a26f9b3e27e9515.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino4365.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino4365.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3553.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3553.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino7959.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino7959.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8646.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8646.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4810.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4810.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1076
        6⤵
        Program crash
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcs93s08.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcs93s08.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 1484
        5⤵
        Program crash
        
        PID:3428
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en100117.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en100117.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge031017.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge031017.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
    "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:5008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2100
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:N"
        5⤵
        
        PID:3580
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:R" /E
        5⤵
        
        PID:392
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4140
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:N"
        5⤵
        
        PID:3824
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:R" /E
        5⤵
        
        PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1092 -ip 1092
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1692 -ip 1692
1⤵
PID:400

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:2776

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge031017.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge031017.exe

Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino4365.exe

Filesize
827KB

MD5
6709e9e1104333574cdd54af3d01daab

SHA1
9a791dcd96f0fcdecc275d00032e5247e0da9475

SHA256
c50ef4c78f50ecc991e28659ad255fad5e65dbf48fdff402ac8e640b1182f530

SHA512
01b935f23d72701fbef7d64624d8e14216848c90b04f6122b19440999840075eb8860fd22cb2da252a5906bfcd4da5d07602e42efb3ba5869c9aeb1230c98853

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino4365.exe

Filesize
827KB

MD5
6709e9e1104333574cdd54af3d01daab

SHA1
9a791dcd96f0fcdecc275d00032e5247e0da9475

SHA256
c50ef4c78f50ecc991e28659ad255fad5e65dbf48fdff402ac8e640b1182f530

SHA512
01b935f23d72701fbef7d64624d8e14216848c90b04f6122b19440999840075eb8860fd22cb2da252a5906bfcd4da5d07602e42efb3ba5869c9aeb1230c98853

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en100117.exe

Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en100117.exe

Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3553.exe

Filesize
685KB

MD5
f03f555f8aca39d1055296e9c2f98fa5

SHA1
96746f39506975e9975a4117897bb64628e5fad0

SHA256
67d8baba02e04dfa3306f3d295a940f66e67b6d126623456ba447edbcc981e19

SHA512
a0921c3b31a438da2ffb9ef7aaac53144d8456b9e20e24206bde0bf4c5bec66a4efa009f4c53dec75552f761c678a2b7ed3cbe9da1bafa964dc47a4254febb23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3553.exe

Filesize
685KB

MD5
f03f555f8aca39d1055296e9c2f98fa5

SHA1
96746f39506975e9975a4117897bb64628e5fad0

SHA256
67d8baba02e04dfa3306f3d295a940f66e67b6d126623456ba447edbcc981e19

SHA512
a0921c3b31a438da2ffb9ef7aaac53144d8456b9e20e24206bde0bf4c5bec66a4efa009f4c53dec75552f761c678a2b7ed3cbe9da1bafa964dc47a4254febb23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcs93s08.exe

Filesize
355KB

MD5
eb4b468e4ffa2a548d63f8d99488785a

SHA1
0cb90fa03d84055f2e7775af3ecf891a830d44ae

SHA256
349108a8623e59e3baee540b25a123a20c338b70a2a910da5900bb77e4619d21

SHA512
743208165cca8a5b90fe3da4c1a749e784ec0e5c29f0b33bbcf6825ce3f67c68f6f14cef3d19426a096082a3c9a3aef4072b350ae77ed207f5c417b776b1edfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcs93s08.exe

Filesize
355KB

MD5
eb4b468e4ffa2a548d63f8d99488785a

SHA1
0cb90fa03d84055f2e7775af3ecf891a830d44ae

SHA256
349108a8623e59e3baee540b25a123a20c338b70a2a910da5900bb77e4619d21

SHA512
743208165cca8a5b90fe3da4c1a749e784ec0e5c29f0b33bbcf6825ce3f67c68f6f14cef3d19426a096082a3c9a3aef4072b350ae77ed207f5c417b776b1edfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino7959.exe

Filesize
340KB

MD5
54bd1b1ffe7015d869cc1a75f5f359f2

SHA1
073503d3b92d2aaed092027dda194d1d25c025f2

SHA256
0fdf9974e442d17dd95f2130e9672cad5079724aad3771c7eefbeac63809d78c

SHA512
e3bd6a24a95d717fde2ffae0adfca90c75086d286e623a12f740650604455394d82b435a4988cf2569112fc844729cb1024bd20201a4d7e205551b08c5d6c1d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino7959.exe

Filesize
340KB

MD5
54bd1b1ffe7015d869cc1a75f5f359f2

SHA1
073503d3b92d2aaed092027dda194d1d25c025f2

SHA256
0fdf9974e442d17dd95f2130e9672cad5079724aad3771c7eefbeac63809d78c

SHA512
e3bd6a24a95d717fde2ffae0adfca90c75086d286e623a12f740650604455394d82b435a4988cf2569112fc844729cb1024bd20201a4d7e205551b08c5d6c1d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8646.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8646.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4810.exe

Filesize
298KB

MD5
159af976685f3df91fae1aafe92bf9d7

SHA1
04067083cb75995f59d0c576db7325c5a0025183

SHA256
14edc58f7f64eb3478cb0fb47c597fe1d4a314c23266d6af5843b9e7f7653705

SHA512
f446eba6adabeba1402f36e14010aa557faefa6f59486a2d3057ac3709828848be4bf13ff3c8fafcaf8f028ceabd616c80d32043eeb265d556952958e437b645

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4810.exe

Filesize
298KB

MD5
159af976685f3df91fae1aafe92bf9d7

SHA1
04067083cb75995f59d0c576db7325c5a0025183

SHA256
14edc58f7f64eb3478cb0fb47c597fe1d4a314c23266d6af5843b9e7f7653705

SHA512
f446eba6adabeba1402f36e14010aa557faefa6f59486a2d3057ac3709828848be4bf13ff3c8fafcaf8f028ceabd616c80d32043eeb265d556952958e437b645

Download Submit
memory/1092-177-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-197-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-179-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-181-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-183-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-185-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-187-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-189-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-191-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-193-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-195-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-175-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-199-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-200-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/1092-201-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1092-202-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1092-204-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/1092-173-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-172-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/1092-171-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1092-170-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1092-169-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1092-168-0x0000000002C50000-0x0000000002C7D000-memory.dmp

Filesize
180KB

Download
memory/1092-167-0x0000000007270000-0x0000000007814000-memory.dmp

Filesize
5.6MB

Download
memory/1692-213-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-1123-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/1692-222-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-224-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-226-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-228-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-230-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-232-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-234-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-236-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-238-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-240-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-242-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-244-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-246-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-1119-0x0000000007950000-0x0000000007F68000-memory.dmp

Filesize
6.1MB

Download
memory/1692-1120-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/1692-1121-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/1692-1122-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1692-220-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-1125-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/1692-1126-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/1692-1127-0x0000000008B80000-0x0000000008D42000-memory.dmp

Filesize
1.8MB

Download
memory/1692-1128-0x0000000008D50000-0x000000000927C000-memory.dmp

Filesize
5.2MB

Download
memory/1692-1129-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1692-1130-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1692-1131-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1692-1132-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1692-1133-0x000000000A7A0000-0x000000000A816000-memory.dmp

Filesize
472KB

Download
memory/1692-1134-0x000000000A820000-0x000000000A870000-memory.dmp

Filesize
320KB

Download
memory/1692-209-0x0000000002D80000-0x0000000002DCB000-memory.dmp

Filesize
300KB

Download
memory/1692-211-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1692-218-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-216-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-214-0x0000000004C30000-0x0000000004C6E000-memory.dmp

Filesize
248KB

Download
memory/1692-212-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1692-210-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/3952-161-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/4804-1140-0x00000000009C0000-0x00000000009F2000-memory.dmp

Filesize
200KB

Download