amadey | 1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1

Analysis

max time kernel
143s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe
Size

1008KB
MD5

1b27608671865680a7edeb0adde8f8b9
SHA1

6ad84e7cc8de26734e1173e77d743473a2a3f6cc
SHA256

1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1
SHA512

97ac2efd9c2f309ac31b5f3a4f2d4a188ee46df8ebf20dd42624d5a4abd52429770e123c350bc2e5f0c1b5bebd987a0af4ddbd18e281d7d85ca9bd8627da8d47
SSDEEP

24576:VyjSpbAk/yvmSwcK8VHsuPXD428DbYdmBzS4CoKi7LVqeY:wOjy4r8VMufD42M/BzS46

Score

10^/10

amadey redline down roxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

roxi

193.233.20.31:4125

Attributes

auth_value
9d8be78c896acc3cf8b8a6637a221376

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

bus6225.execor1400.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bus6225.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor1400.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor1400.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor1400.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor1400.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor1400.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bus6225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bus6225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bus6225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bus6225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bus6225.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor1400.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1088-209-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-210-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-212-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-214-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-216-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-218-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-220-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-222-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-224-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-226-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-228-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-230-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-232-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-234-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-236-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-238-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-240-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-242-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/1088-1128-0x00000000073E0000-0x00000000073F0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge274330.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	ge274330.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 10 IoCs

Processes:

kino2404.exekino6518.exekino3117.exebus6225.execor1400.exedNM57s91.exeen208698.exege274330.exemetafor.exemetafor.exe

pid	process
4740	kino2404.exe
4040	kino6518.exe
4596	kino3117.exe
4900	bus6225.exe
3224	cor1400.exe
1088	dNM57s91.exe
1772	en208698.exe
4624	ge274330.exe
4048	metafor.exe
228	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bus6225.execor1400.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bus6225.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor1400.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor1400.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kino6518.exekino3117.exe1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exekino2404.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino6518.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kino6518.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino3117.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kino3117.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino2404.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kino2404.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1072 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3032 3224 WerFault.exe cor1400.exe
4632 1088 WerFault.exe dNM57s91.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1008 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bus6225.execor1400.exedNM57s91.exeen208698.exe

pid process

4900 bus6225.exe
4900 bus6225.exe
3224 cor1400.exe
3224 cor1400.exe
1088 dNM57s91.exe
1088 dNM57s91.exe
1772 en208698.exe
1772 en208698.exe

pid	process
1072	sc.exe

pid	pid_target	process	target process
3032	3224	WerFault.exe	cor1400.exe
4632	1088	WerFault.exe	dNM57s91.exe

pid	process
1008	schtasks.exe

pid	process
4900	bus6225.exe
4900	bus6225.exe
3224	cor1400.exe
3224	cor1400.exe
1088	dNM57s91.exe
1088	dNM57s91.exe
1772	en208698.exe
1772	en208698.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bus6225.execor1400.exedNM57s91.exeen208698.exe

description	pid	process
Token: SeDebugPrivilege	4900	bus6225.exe
Token: SeDebugPrivilege	3224	cor1400.exe
Token: SeDebugPrivilege	1088	dNM57s91.exe
Token: SeDebugPrivilege	1772	en208698.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exekino2404.exekino6518.exekino3117.exege274330.exemetafor.execmd.exe

description	pid	process	target process
PID 220 wrote to memory of 4740	220	1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe	kino2404.exe
PID 220 wrote to memory of 4740	220	1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe	kino2404.exe
PID 220 wrote to memory of 4740	220	1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe	kino2404.exe
PID 4740 wrote to memory of 4040	4740	kino2404.exe	kino6518.exe
PID 4740 wrote to memory of 4040	4740	kino2404.exe	kino6518.exe
PID 4740 wrote to memory of 4040	4740	kino2404.exe	kino6518.exe
PID 4040 wrote to memory of 4596	4040	kino6518.exe	kino3117.exe
PID 4040 wrote to memory of 4596	4040	kino6518.exe	kino3117.exe
PID 4040 wrote to memory of 4596	4040	kino6518.exe	kino3117.exe
PID 4596 wrote to memory of 4900	4596	kino3117.exe	bus6225.exe
PID 4596 wrote to memory of 4900	4596	kino3117.exe	bus6225.exe
PID 4596 wrote to memory of 3224	4596	kino3117.exe	cor1400.exe
PID 4596 wrote to memory of 3224	4596	kino3117.exe	cor1400.exe
PID 4596 wrote to memory of 3224	4596	kino3117.exe	cor1400.exe
PID 4040 wrote to memory of 1088	4040	kino6518.exe	dNM57s91.exe
PID 4040 wrote to memory of 1088	4040	kino6518.exe	dNM57s91.exe
PID 4040 wrote to memory of 1088	4040	kino6518.exe	dNM57s91.exe
PID 4740 wrote to memory of 1772	4740	kino2404.exe	en208698.exe
PID 4740 wrote to memory of 1772	4740	kino2404.exe	en208698.exe
PID 4740 wrote to memory of 1772	4740	kino2404.exe	en208698.exe
PID 220 wrote to memory of 4624	220	1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe	ge274330.exe
PID 220 wrote to memory of 4624	220	1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe	ge274330.exe
PID 220 wrote to memory of 4624	220	1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe	ge274330.exe
PID 4624 wrote to memory of 4048	4624	ge274330.exe	metafor.exe
PID 4624 wrote to memory of 4048	4624	ge274330.exe	metafor.exe
PID 4624 wrote to memory of 4048	4624	ge274330.exe	metafor.exe
PID 4048 wrote to memory of 1008	4048	metafor.exe	schtasks.exe
PID 4048 wrote to memory of 1008	4048	metafor.exe	schtasks.exe
PID 4048 wrote to memory of 1008	4048	metafor.exe	schtasks.exe
PID 4048 wrote to memory of 2260	4048	metafor.exe	cmd.exe
PID 4048 wrote to memory of 2260	4048	metafor.exe	cmd.exe
PID 4048 wrote to memory of 2260	4048	metafor.exe	cmd.exe
PID 2260 wrote to memory of 3608	2260	cmd.exe	cmd.exe
PID 2260 wrote to memory of 3608	2260	cmd.exe	cmd.exe
PID 2260 wrote to memory of 3608	2260	cmd.exe	cmd.exe
PID 2260 wrote to memory of 1240	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 1240	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 1240	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 2264	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 2264	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 2264	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 2036	2260	cmd.exe	cmd.exe
PID 2260 wrote to memory of 2036	2260	cmd.exe	cmd.exe
PID 2260 wrote to memory of 2036	2260	cmd.exe	cmd.exe
PID 2260 wrote to memory of 1744	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 1744	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 1744	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 4140	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 4140	2260	cmd.exe	cacls.exe
PID 2260 wrote to memory of 4140	2260	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe
"C:\Users\Admin\AppData\Local\Temp\1a059a8c598db4d1545349badf578f92cdd603223de4daf6863cd9c6f89578e1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:220

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino2404.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino2404.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4740

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6518.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6518.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4040

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3117.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3117.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4596

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus6225.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus6225.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1400.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1400.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1080
6⤵
- Program crash
PID:3032

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dNM57s91.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dNM57s91.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1856
5⤵
- Program crash
PID:4632

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en208698.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en208698.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge274330.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge274330.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
4⤵
- Creates scheduled task(s)
PID:1008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3608

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:N"
5⤵
PID:1240

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:R" /E
5⤵
PID:2264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2036

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:N"
5⤵
PID:1744

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:R" /E
5⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3224 -ip 3224
1⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1088 -ip 1088
1⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:228

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge274330.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge274330.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino2404.exe
Filesize
826KB

MD5
12db099100d84996ea79e4531693ad95

SHA1
748a666cf7f79b15e99a14246b49322e0159f94c

SHA256
f6e6f05d7638004397542eaf5fb51af90efebb03f0840778bf41dfd44d069472

SHA512
d3436934c79aaf4dc676b8e392ee28289c80612d5c37d0bf930362bb60f803b4e848ebeb64639004888602aded9ed2153f355442c4c2b728c1adf618064a4d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino2404.exe
Filesize
826KB

MD5
12db099100d84996ea79e4531693ad95

SHA1
748a666cf7f79b15e99a14246b49322e0159f94c

SHA256
f6e6f05d7638004397542eaf5fb51af90efebb03f0840778bf41dfd44d069472

SHA512
d3436934c79aaf4dc676b8e392ee28289c80612d5c37d0bf930362bb60f803b4e848ebeb64639004888602aded9ed2153f355442c4c2b728c1adf618064a4d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en208698.exe
Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en208698.exe
Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6518.exe
Filesize
685KB

MD5
909ee5e0cb4b8faa276995c30256500b

SHA1
601776c449e4e2d6c43005481c5ce5eee47c8d5c

SHA256
aac4ef8c2632a5c9818d06206874d73be88425c8e6b61b97eff2d875c551fe76

SHA512
5a87a6592f0d4fd3235a216e43b6faf60411fdec16e65611d10988097591dbb3de1daf7372428542a5b1eaa35b1c9564665f0e5ada2cbb8f8a85415bd998c725

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6518.exe
Filesize
685KB

MD5
909ee5e0cb4b8faa276995c30256500b

SHA1
601776c449e4e2d6c43005481c5ce5eee47c8d5c

SHA256
aac4ef8c2632a5c9818d06206874d73be88425c8e6b61b97eff2d875c551fe76

SHA512
5a87a6592f0d4fd3235a216e43b6faf60411fdec16e65611d10988097591dbb3de1daf7372428542a5b1eaa35b1c9564665f0e5ada2cbb8f8a85415bd998c725

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dNM57s91.exe
Filesize
355KB

MD5
5f5f8fc13b5c56a7c17b063139dbc107

SHA1
01b5aa6d217109ec670322a66de3f7302f2f9879

SHA256
d36d3a71cc1a21c88e6a5fa403db4a124d1d67100490c6490d470460b0d01b03

SHA512
bae258b6fb2f9baf662896e5d30ffe20531552d767fec611d5d177719bdc343c9e83a99330cb2473e1b21da60fb96b008ba196547b613ca36d0207543fdc4b53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dNM57s91.exe
Filesize
355KB

MD5
5f5f8fc13b5c56a7c17b063139dbc107

SHA1
01b5aa6d217109ec670322a66de3f7302f2f9879

SHA256
d36d3a71cc1a21c88e6a5fa403db4a124d1d67100490c6490d470460b0d01b03

SHA512
bae258b6fb2f9baf662896e5d30ffe20531552d767fec611d5d177719bdc343c9e83a99330cb2473e1b21da60fb96b008ba196547b613ca36d0207543fdc4b53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3117.exe
Filesize
340KB

MD5
e4954f59ddceab410ed0f099ccb2dd7f

SHA1
e08ae1fabcc654283166231b515048f58753f335

SHA256
da3f8d94fcb33621a0a192521740298daf7fc2669b238034e884b13e359d0980

SHA512
0a5b2863e66e819ed2e632f7a48b1af0d4113c6bf97af7ca3b8188690c9e3faa63be21b7e4dc5939227d4de1358fa52c88ac9753d5062b9be5908df89e2b6fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3117.exe
Filesize
340KB

MD5
e4954f59ddceab410ed0f099ccb2dd7f

SHA1
e08ae1fabcc654283166231b515048f58753f335

SHA256
da3f8d94fcb33621a0a192521740298daf7fc2669b238034e884b13e359d0980

SHA512
0a5b2863e66e819ed2e632f7a48b1af0d4113c6bf97af7ca3b8188690c9e3faa63be21b7e4dc5939227d4de1358fa52c88ac9753d5062b9be5908df89e2b6fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus6225.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus6225.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1400.exe
Filesize
298KB

MD5
46b1b833aa012289d6cc27d577dfecab

SHA1
24249e932d9ed29b5e658e3ef0db8f341bce2297

SHA256
c8adf85d35eff0a2708b340025cd1b15800d2ad0128d10b3481def79e7f8d663

SHA512
209886181da8d85c3f51eef7464f2a4c85918b3b61a696ffd098755f983b14e18ef2869ff108ea1ba7d717038682a1d6ea053f43ad3ee16899b17ec02cce5fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1400.exe
Filesize
298KB

MD5
46b1b833aa012289d6cc27d577dfecab

SHA1
24249e932d9ed29b5e658e3ef0db8f341bce2297

SHA256
c8adf85d35eff0a2708b340025cd1b15800d2ad0128d10b3481def79e7f8d663

SHA512
209886181da8d85c3f51eef7464f2a4c85918b3b61a696ffd098755f983b14e18ef2869ff108ea1ba7d717038682a1d6ea053f43ad3ee16899b17ec02cce5fb6

Download Submit
memory/1088-1123-0x00000000073E0000-0x00000000073F0000-memory.dmp

Filesize
64KB

Download
memory/1088-1127-0x00000000073E0000-0x00000000073F0000-memory.dmp

Filesize
64KB

Download
memory/1088-1135-0x00000000073E0000-0x00000000073F0000-memory.dmp

Filesize
64KB

Download
memory/1088-1133-0x0000000009090000-0x00000000095BC000-memory.dmp

Filesize
5.2MB

Download
memory/1088-1132-0x0000000008EC0000-0x0000000009082000-memory.dmp

Filesize
1.8MB

Download
memory/1088-1131-0x0000000008E60000-0x0000000008EB0000-memory.dmp

Filesize
320KB

Download
memory/1088-1130-0x0000000008DC0000-0x0000000008E36000-memory.dmp

Filesize
472KB

Download
memory/1088-1129-0x00000000073E0000-0x00000000073F0000-memory.dmp

Filesize
64KB

Download
memory/1088-1128-0x00000000073E0000-0x00000000073F0000-memory.dmp

Filesize
64KB

Download
memory/1088-1126-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/1088-1125-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/1088-1122-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/1088-1121-0x00000000073C0000-0x00000000073D2000-memory.dmp

Filesize
72KB

Download
memory/1088-1120-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/1088-1119-0x00000000079A0000-0x0000000007FB8000-memory.dmp

Filesize
6.1MB

Download
memory/1088-277-0x00000000073E0000-0x00000000073F0000-memory.dmp

Filesize
64KB

Download
memory/1088-275-0x00000000073E0000-0x00000000073F0000-memory.dmp

Filesize
64KB

Download
memory/1088-209-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-210-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-212-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-214-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-216-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-218-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-220-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-222-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-224-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-226-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-228-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-230-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-232-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-234-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-236-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-238-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-240-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-242-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/1088-273-0x00000000073E0000-0x00000000073F0000-memory.dmp

Filesize
64KB

Download
memory/1088-271-0x0000000002C20000-0x0000000002C6B000-memory.dmp

Filesize
300KB

Download
memory/1772-1140-0x0000000000630000-0x0000000000662000-memory.dmp

Filesize
200KB

Download
memory/1772-1141-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/3224-191-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-175-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-187-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-200-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/3224-185-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-199-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-197-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-183-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-195-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-193-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-177-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-189-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-201-0x0000000007300000-0x0000000007310000-memory.dmp

Filesize
64KB

Download
memory/3224-202-0x0000000007300000-0x0000000007310000-memory.dmp

Filesize
64KB

Download
memory/3224-181-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-173-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-172-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-204-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/3224-179-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/3224-171-0x0000000007310000-0x00000000078B4000-memory.dmp

Filesize
5.6MB

Download
memory/3224-170-0x0000000007300000-0x0000000007310000-memory.dmp

Filesize
64KB

Download
memory/3224-169-0x0000000007300000-0x0000000007310000-memory.dmp

Filesize
64KB

Download
memory/3224-168-0x0000000007300000-0x0000000007310000-memory.dmp

Filesize
64KB

Download
memory/3224-167-0x0000000002C50000-0x0000000002C7D000-memory.dmp

Filesize
180KB

Download
memory/4900-161-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download