amadey | 28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840

Analysis

max time kernel
142s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe
Size

1012KB
MD5

93a717f99e5d1677dc552c9f185b4e74
SHA1

13f7311092f7507cde4d9b1c5c5d92b425930e09
SHA256

28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840
SHA512

39f19b1c1e3d501bb3b3f42201fb74de6243284826fa8b17144e65e6416756f539d673498a8931f3b5208678c852b2870b8856240de1f6e6be180a63dc8b7555
SSDEEP

24576:fyInehrFt+GHMRMNSMc7+ybe+1AM1T0cLbZv:qIehrFt+GHMRMNSMcaGp1AM1T0cJ

Score

10^/10

amadey redline down roxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

roxi

193.233.20.31:4125

Attributes

auth_value
9d8be78c896acc3cf8b8a6637a221376

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

cor0741.exebus7298.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor0741.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor0741.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor0741.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bus7298.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bus7298.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bus7298.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bus7298.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor0741.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor0741.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor0741.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bus7298.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bus7298.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4900-207-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-208-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-210-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-212-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-214-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-219-0x0000000007210000-0x0000000007220000-memory.dmp	family_redline
behavioral1/memory/4900-222-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-218-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-224-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-226-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-228-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-230-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-232-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-234-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-236-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-238-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-240-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-242-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral1/memory/4900-244-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge398085.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	ge398085.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 11 IoCs

Processes:

kino5988.exekino0130.exekino4943.exebus7298.execor0741.exedgJ80s56.exeen712774.exege398085.exemetafor.exemetafor.exemetafor.exe

pid	process
2168	kino5988.exe
4592	kino0130.exe
1696	kino4943.exe
1784	bus7298.exe
1672	cor0741.exe
4900	dgJ80s56.exe
3656	en712774.exe
3848	ge398085.exe
3776	metafor.exe
4720	metafor.exe
228	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bus7298.execor0741.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bus7298.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor0741.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor0741.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exekino5988.exekino0130.exekino4943.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino5988.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kino5988.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino0130.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kino0130.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino4943.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kino4943.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4760 1672 WerFault.exe cor0741.exe
3356 4900 WerFault.exe dgJ80s56.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1016 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bus7298.execor0741.exedgJ80s56.exeen712774.exe

pid process

1784 bus7298.exe
1784 bus7298.exe
1672 cor0741.exe
1672 cor0741.exe
4900 dgJ80s56.exe
4900 dgJ80s56.exe
3656 en712774.exe
3656 en712774.exe

pid	pid_target	process	target process
4760	1672	WerFault.exe	cor0741.exe
3356	4900	WerFault.exe	dgJ80s56.exe

pid	process
1016	schtasks.exe

pid	process
1784	bus7298.exe
1784	bus7298.exe
1672	cor0741.exe
1672	cor0741.exe
4900	dgJ80s56.exe
4900	dgJ80s56.exe
3656	en712774.exe
3656	en712774.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bus7298.execor0741.exedgJ80s56.exeen712774.exe

description	pid	process
Token: SeDebugPrivilege	1784	bus7298.exe
Token: SeDebugPrivilege	1672	cor0741.exe
Token: SeDebugPrivilege	4900	dgJ80s56.exe
Token: SeDebugPrivilege	3656	en712774.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exekino5988.exekino0130.exekino4943.exege398085.exemetafor.execmd.exe

description	pid	process	target process
PID 2136 wrote to memory of 2168	2136	28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe	kino5988.exe
PID 2136 wrote to memory of 2168	2136	28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe	kino5988.exe
PID 2136 wrote to memory of 2168	2136	28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe	kino5988.exe
PID 2168 wrote to memory of 4592	2168	kino5988.exe	kino0130.exe
PID 2168 wrote to memory of 4592	2168	kino5988.exe	kino0130.exe
PID 2168 wrote to memory of 4592	2168	kino5988.exe	kino0130.exe
PID 4592 wrote to memory of 1696	4592	kino0130.exe	kino4943.exe
PID 4592 wrote to memory of 1696	4592	kino0130.exe	kino4943.exe
PID 4592 wrote to memory of 1696	4592	kino0130.exe	kino4943.exe
PID 1696 wrote to memory of 1784	1696	kino4943.exe	bus7298.exe
PID 1696 wrote to memory of 1784	1696	kino4943.exe	bus7298.exe
PID 1696 wrote to memory of 1672	1696	kino4943.exe	cor0741.exe
PID 1696 wrote to memory of 1672	1696	kino4943.exe	cor0741.exe
PID 1696 wrote to memory of 1672	1696	kino4943.exe	cor0741.exe
PID 4592 wrote to memory of 4900	4592	kino0130.exe	dgJ80s56.exe
PID 4592 wrote to memory of 4900	4592	kino0130.exe	dgJ80s56.exe
PID 4592 wrote to memory of 4900	4592	kino0130.exe	dgJ80s56.exe
PID 2168 wrote to memory of 3656	2168	kino5988.exe	en712774.exe
PID 2168 wrote to memory of 3656	2168	kino5988.exe	en712774.exe
PID 2168 wrote to memory of 3656	2168	kino5988.exe	en712774.exe
PID 2136 wrote to memory of 3848	2136	28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe	ge398085.exe
PID 2136 wrote to memory of 3848	2136	28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe	ge398085.exe
PID 2136 wrote to memory of 3848	2136	28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe	ge398085.exe
PID 3848 wrote to memory of 3776	3848	ge398085.exe	metafor.exe
PID 3848 wrote to memory of 3776	3848	ge398085.exe	metafor.exe
PID 3848 wrote to memory of 3776	3848	ge398085.exe	metafor.exe
PID 3776 wrote to memory of 1016	3776	metafor.exe	schtasks.exe
PID 3776 wrote to memory of 1016	3776	metafor.exe	schtasks.exe
PID 3776 wrote to memory of 1016	3776	metafor.exe	schtasks.exe
PID 3776 wrote to memory of 5060	3776	metafor.exe	cmd.exe
PID 3776 wrote to memory of 5060	3776	metafor.exe	cmd.exe
PID 3776 wrote to memory of 5060	3776	metafor.exe	cmd.exe
PID 5060 wrote to memory of 1132	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 1132	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 1132	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 3788	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 3788	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 3788	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 448	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 448	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 448	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 1280	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 1280	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 1280	5060	cmd.exe	cmd.exe
PID 5060 wrote to memory of 1604	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 1604	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 1604	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 1152	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 1152	5060	cmd.exe	cacls.exe
PID 5060 wrote to memory of 1152	5060	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe
"C:\Users\Admin\AppData\Local\Temp\28af7f6222238f49b11df38b3c77780bed3dc0b07f8b0b91adb7b41f230df840.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2136

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino5988.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino5988.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2168

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino0130.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino0130.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4592

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4943.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4943.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7298.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7298.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor0741.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor0741.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 1052
6⤵
- Program crash
PID:4760

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dgJ80s56.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dgJ80s56.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1924
5⤵
- Program crash
PID:3356

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en712774.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en712774.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge398085.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge398085.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
4⤵
- Creates scheduled task(s)
PID:1016

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1132

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:N"
5⤵
PID:3788

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:R" /E
5⤵
PID:448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1280

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:N"
5⤵
PID:1604

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:R" /E
5⤵
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1672 -ip 1672
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4900 -ip 4900
1⤵
PID:4600

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge398085.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge398085.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino5988.exe
Filesize
829KB

MD5
7813370edfc75c3be0b8e28fb286bff4

SHA1
ab2d1396e8ae8655895ab0941b7dc60eb2cfe09f

SHA256
5273b20dbea50ea34a02eb9ca1a594f178d164074aa46ea80055bea2bbe89714

SHA512
fbfdc6e68d9d07ff20abc998b619cbe7a88550483f2a413fd42dbfd4767ed3aebcb7cf7bed43be30df1e036d9e8f859e74442f011543a92c27a36112696187a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino5988.exe
Filesize
829KB

MD5
7813370edfc75c3be0b8e28fb286bff4

SHA1
ab2d1396e8ae8655895ab0941b7dc60eb2cfe09f

SHA256
5273b20dbea50ea34a02eb9ca1a594f178d164074aa46ea80055bea2bbe89714

SHA512
fbfdc6e68d9d07ff20abc998b619cbe7a88550483f2a413fd42dbfd4767ed3aebcb7cf7bed43be30df1e036d9e8f859e74442f011543a92c27a36112696187a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en712774.exe
Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en712774.exe
Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino0130.exe
Filesize
686KB

MD5
b1b569022e0eccae9e2701a7bc691b74

SHA1
2712e2752b31fb4707e76bfd5a54716e4cfc038c

SHA256
70a97d5eb0daab20beda8d802b697d8cdbb961916240bc1bc563061fd4fbcf80

SHA512
f194f01facd2a7e3c16172d43cee7f7a952a64763923e5dfaffed03ef3124500a44ec0d44c9fd35495d2a2eb7279f838a100d87f637e692329f4b5c30673ab27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino0130.exe
Filesize
686KB

MD5
b1b569022e0eccae9e2701a7bc691b74

SHA1
2712e2752b31fb4707e76bfd5a54716e4cfc038c

SHA256
70a97d5eb0daab20beda8d802b697d8cdbb961916240bc1bc563061fd4fbcf80

SHA512
f194f01facd2a7e3c16172d43cee7f7a952a64763923e5dfaffed03ef3124500a44ec0d44c9fd35495d2a2eb7279f838a100d87f637e692329f4b5c30673ab27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dgJ80s56.exe
Filesize
355KB

MD5
60ad287ffdeba532a0f89d2b02b46fdc

SHA1
44faa7ad3434b2b7f489aadeecb0b6fe8922ff6b

SHA256
8c502e393c8222a553fc1dcfb32c8225b3406560c73d57d64788d3c351bbda58

SHA512
dd9c28791f8e4b7f2612c7e3de26389a85a4308741a2c7d53bc763c3399620045092509b175cd71c27f83a1bb713cd1f744c94f4ea77c466eb9123accd3a3bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dgJ80s56.exe
Filesize
355KB

MD5
60ad287ffdeba532a0f89d2b02b46fdc

SHA1
44faa7ad3434b2b7f489aadeecb0b6fe8922ff6b

SHA256
8c502e393c8222a553fc1dcfb32c8225b3406560c73d57d64788d3c351bbda58

SHA512
dd9c28791f8e4b7f2612c7e3de26389a85a4308741a2c7d53bc763c3399620045092509b175cd71c27f83a1bb713cd1f744c94f4ea77c466eb9123accd3a3bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4943.exe
Filesize
340KB

MD5
b81f798faa0b63e938219d4f6427ff69

SHA1
756d6215faebe7628b9e35e7fb81c048c87b1ce1

SHA256
9d611a8ec4667e956c32d3a4a5c9fe28e10f714663cbbca658e1a09a888a1e5d

SHA512
186e5a1d29d5c590e578d9b5447e47bcd40331195c0924231187682a272ecdeff919dc6b2481d4585cc87644f5820eac32a3c2b9ec153b005034645543b88aaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4943.exe
Filesize
340KB

MD5
b81f798faa0b63e938219d4f6427ff69

SHA1
756d6215faebe7628b9e35e7fb81c048c87b1ce1

SHA256
9d611a8ec4667e956c32d3a4a5c9fe28e10f714663cbbca658e1a09a888a1e5d

SHA512
186e5a1d29d5c590e578d9b5447e47bcd40331195c0924231187682a272ecdeff919dc6b2481d4585cc87644f5820eac32a3c2b9ec153b005034645543b88aaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7298.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7298.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor0741.exe
Filesize
298KB

MD5
5e32472c6b4e97c9c34249f1730a1f72

SHA1
095d63f17c88d64ff30fa4c7816e1a856eb7ecc1

SHA256
c3c69db996b18c48f3f23d1256da1a5d820e86492fb4111533642ee76aaa8c74

SHA512
9cb9dabd448d21db31c161669ade4633b2a3b6aeeba32ebc485dc0d3d372900e700bf65edd7404d060620c356a2563adc311b4f158d1c42c58d9ce4af31c28c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor0741.exe
Filesize
298KB

MD5
5e32472c6b4e97c9c34249f1730a1f72

SHA1
095d63f17c88d64ff30fa4c7816e1a856eb7ecc1

SHA256
c3c69db996b18c48f3f23d1256da1a5d820e86492fb4111533642ee76aaa8c74

SHA512
9cb9dabd448d21db31c161669ade4633b2a3b6aeeba32ebc485dc0d3d372900e700bf65edd7404d060620c356a2563adc311b4f158d1c42c58d9ce4af31c28c9

Download Submit
memory/1672-177-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-200-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/1672-179-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-181-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-183-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-185-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-187-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-189-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-191-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-193-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-195-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-197-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-199-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-167-0x0000000002B80000-0x0000000002BAD000-memory.dmp

Filesize
180KB

Download
memory/1672-202-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/1672-168-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1672-175-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-173-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-172-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/1672-171-0x00000000073A0000-0x0000000007944000-memory.dmp

Filesize
5.6MB

Download
memory/1672-170-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1672-169-0x0000000007390000-0x00000000073A0000-memory.dmp

Filesize
64KB

Download
memory/1784-161-0x0000000000B90000-0x0000000000B9A000-memory.dmp

Filesize
40KB

Download
memory/3656-1137-0x0000000000BA0000-0x0000000000BD2000-memory.dmp

Filesize
200KB

Download
memory/3656-1138-0x0000000005790000-0x00000000057A0000-memory.dmp

Filesize
64KB

Download
memory/4900-212-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-218-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-224-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-226-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-228-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-230-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-232-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-234-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-236-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-238-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-240-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-242-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-244-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-1117-0x00000000077D0000-0x0000000007DE8000-memory.dmp

Filesize
6.1MB

Download
memory/4900-1118-0x0000000007E30000-0x0000000007F3A000-memory.dmp

Filesize
1.0MB

Download
memory/4900-1119-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/4900-1120-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/4900-1121-0x0000000007F90000-0x0000000007FCC000-memory.dmp

Filesize
240KB

Download
memory/4900-1123-0x0000000008280000-0x0000000008312000-memory.dmp

Filesize
584KB

Download
memory/4900-1124-0x0000000008320000-0x0000000008386000-memory.dmp

Filesize
408KB

Download
memory/4900-1125-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/4900-1126-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/4900-1127-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/4900-1128-0x0000000008C80000-0x0000000008CF6000-memory.dmp

Filesize
472KB

Download
memory/4900-1129-0x0000000008D10000-0x0000000008D60000-memory.dmp

Filesize
320KB

Download
memory/4900-222-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-221-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/4900-219-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/4900-214-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-217-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/4900-215-0x0000000002CB0000-0x0000000002CFB000-memory.dmp

Filesize
300KB

Download
memory/4900-210-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-208-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-207-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/4900-1130-0x0000000008EB0000-0x0000000009072000-memory.dmp

Filesize
1.8MB

Download
memory/4900-1131-0x0000000009080000-0x00000000095AC000-memory.dmp

Filesize
5.2MB

Download