amadey | 331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f

Analysis

max time kernel
137s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe
Size

1010KB
MD5

e7ae1f7488006025440882377c38aab9
SHA1

537d15d36e55f921cfc93721a3a0774437b895bb
SHA256

331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f
SHA512

6ea2b05a63ca66b707f340c2fd598bb75356017de257feccc6193fef6451d49d47280f14ef9ca76ce32e2887122779e1258313adff0a6cd87cb5ffeb7abb7e2a
SSDEEP

24576:Iydu3v6XazU8IOmLsDU32JIFgBf1KbDqkhR4As3G6FE:Pd46XazUn3LsA32JIeMmkhR4A6

Score

10^/10

amadey redline down roxi discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

roxi

193.233.20.31:4125

Attributes

auth_value
9d8be78c896acc3cf8b8a6637a221376

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

bus3680.execor4832.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bus3680.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bus3680.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bus3680.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bus3680.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor4832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor4832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor4832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bus3680.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bus3680.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor4832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor4832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor4832.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3152-213-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-214-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-216-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-218-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-222-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-224-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-220-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-226-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-228-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-230-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-232-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-234-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-236-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-238-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-240-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-242-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-244-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline
behavioral1/memory/3152-246-0x0000000004C40000-0x0000000004C7E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

metafor.exege265131.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	metafor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	ge265131.exe

Executes dropped EXE 11 IoCs

Processes:

kino6855.exekino7816.exekino2134.exebus3680.execor4832.exedXQ97s25.exeen934868.exege265131.exemetafor.exemetafor.exemetafor.exe

pid	process
4700	kino6855.exe
1504	kino7816.exe
4536	kino2134.exe
2616	bus3680.exe
4960	cor4832.exe
3152	dXQ97s25.exe
4156	en934868.exe
4112	ge265131.exe
3760	metafor.exe
4532	metafor.exe
1076	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

cor4832.exebus3680.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor4832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor4832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bus3680.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kino2134.exe331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exekino6855.exekino7816.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino2134.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kino2134.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino6855.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kino6855.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kino7816.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kino7816.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

724 4960 WerFault.exe cor4832.exe
220 3152 WerFault.exe dXQ97s25.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3856 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bus3680.execor4832.exedXQ97s25.exeen934868.exe

pid process

2616 bus3680.exe
2616 bus3680.exe
4960 cor4832.exe
4960 cor4832.exe
3152 dXQ97s25.exe
3152 dXQ97s25.exe
4156 en934868.exe
4156 en934868.exe

pid	pid_target	process	target process
724	4960	WerFault.exe	cor4832.exe
220	3152	WerFault.exe	dXQ97s25.exe

pid	process
3856	schtasks.exe

pid	process
2616	bus3680.exe
2616	bus3680.exe
4960	cor4832.exe
4960	cor4832.exe
3152	dXQ97s25.exe
3152	dXQ97s25.exe
4156	en934868.exe
4156	en934868.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bus3680.execor4832.exedXQ97s25.exeen934868.exe

description	pid	process
Token: SeDebugPrivilege	2616	bus3680.exe
Token: SeDebugPrivilege	4960	cor4832.exe
Token: SeDebugPrivilege	3152	dXQ97s25.exe
Token: SeDebugPrivilege	4156	en934868.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exekino6855.exekino7816.exekino2134.exege265131.exemetafor.execmd.exe

description	pid	process	target process
PID 632 wrote to memory of 4700	632	331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe	kino6855.exe
PID 632 wrote to memory of 4700	632	331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe	kino6855.exe
PID 632 wrote to memory of 4700	632	331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe	kino6855.exe
PID 4700 wrote to memory of 1504	4700	kino6855.exe	kino7816.exe
PID 4700 wrote to memory of 1504	4700	kino6855.exe	kino7816.exe
PID 4700 wrote to memory of 1504	4700	kino6855.exe	kino7816.exe
PID 1504 wrote to memory of 4536	1504	kino7816.exe	kino2134.exe
PID 1504 wrote to memory of 4536	1504	kino7816.exe	kino2134.exe
PID 1504 wrote to memory of 4536	1504	kino7816.exe	kino2134.exe
PID 4536 wrote to memory of 2616	4536	kino2134.exe	bus3680.exe
PID 4536 wrote to memory of 2616	4536	kino2134.exe	bus3680.exe
PID 4536 wrote to memory of 4960	4536	kino2134.exe	cor4832.exe
PID 4536 wrote to memory of 4960	4536	kino2134.exe	cor4832.exe
PID 4536 wrote to memory of 4960	4536	kino2134.exe	cor4832.exe
PID 1504 wrote to memory of 3152	1504	kino7816.exe	dXQ97s25.exe
PID 1504 wrote to memory of 3152	1504	kino7816.exe	dXQ97s25.exe
PID 1504 wrote to memory of 3152	1504	kino7816.exe	dXQ97s25.exe
PID 4700 wrote to memory of 4156	4700	kino6855.exe	en934868.exe
PID 4700 wrote to memory of 4156	4700	kino6855.exe	en934868.exe
PID 4700 wrote to memory of 4156	4700	kino6855.exe	en934868.exe
PID 632 wrote to memory of 4112	632	331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe	ge265131.exe
PID 632 wrote to memory of 4112	632	331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe	ge265131.exe
PID 632 wrote to memory of 4112	632	331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe	ge265131.exe
PID 4112 wrote to memory of 3760	4112	ge265131.exe	metafor.exe
PID 4112 wrote to memory of 3760	4112	ge265131.exe	metafor.exe
PID 4112 wrote to memory of 3760	4112	ge265131.exe	metafor.exe
PID 3760 wrote to memory of 3856	3760	metafor.exe	schtasks.exe
PID 3760 wrote to memory of 3856	3760	metafor.exe	schtasks.exe
PID 3760 wrote to memory of 3856	3760	metafor.exe	schtasks.exe
PID 3760 wrote to memory of 1360	3760	metafor.exe	cmd.exe
PID 3760 wrote to memory of 1360	3760	metafor.exe	cmd.exe
PID 3760 wrote to memory of 1360	3760	metafor.exe	cmd.exe
PID 1360 wrote to memory of 5052	1360	cmd.exe	cmd.exe
PID 1360 wrote to memory of 5052	1360	cmd.exe	cmd.exe
PID 1360 wrote to memory of 5052	1360	cmd.exe	cmd.exe
PID 1360 wrote to memory of 3520	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 3520	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 3520	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 4148	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 4148	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 4148	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 4632	1360	cmd.exe	cmd.exe
PID 1360 wrote to memory of 4632	1360	cmd.exe	cmd.exe
PID 1360 wrote to memory of 4632	1360	cmd.exe	cmd.exe
PID 1360 wrote to memory of 3252	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 3252	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 3252	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 1912	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 1912	1360	cmd.exe	cacls.exe
PID 1360 wrote to memory of 1912	1360	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe
"C:\Users\Admin\AppData\Local\Temp\331f114139e51e7f46fa1c89163b55e2e7d61ae3ba9d1f7bc0fabe4003abf76f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6855.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6855.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4700

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7816.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7816.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino2134.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino2134.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4536

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3680.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3680.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4832.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4832.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1084
6⤵
- Program crash
PID:724

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dXQ97s25.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dXQ97s25.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1348
5⤵
- Program crash
PID:220

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en934868.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en934868.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge265131.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge265131.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
4⤵
- Creates scheduled task(s)
PID:3856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:5052

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:N"
5⤵
PID:3520

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:R" /E
5⤵
PID:4148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4632

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:N"
5⤵
PID:3252

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:R" /E
5⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4960 -ip 4960
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3152 -ip 3152
1⤵
PID:228

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:1076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge265131.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge265131.exe
Filesize
226KB

MD5
8627ebe3777cc777ed2a14b907162224

SHA1
06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

SHA256
319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

SHA512
9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6855.exe
Filesize
827KB

MD5
fc3cd6a43feb30391701effe7d7d9e55

SHA1
01b179f6b88434ea5874741fb273b4423629fa1c

SHA256
31312e12715cf15b7d189bd52bc3b3caae96b9766274b79d3fe2d26e14c7578c

SHA512
359556afa7ca0c75c774d6251792506c52df37003c655a7621a4e757d623562590fa2a26661f4ebbfa02a2f909d71dccf562032b35ff1aecbc6d18181defae76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6855.exe
Filesize
827KB

MD5
fc3cd6a43feb30391701effe7d7d9e55

SHA1
01b179f6b88434ea5874741fb273b4423629fa1c

SHA256
31312e12715cf15b7d189bd52bc3b3caae96b9766274b79d3fe2d26e14c7578c

SHA512
359556afa7ca0c75c774d6251792506c52df37003c655a7621a4e757d623562590fa2a26661f4ebbfa02a2f909d71dccf562032b35ff1aecbc6d18181defae76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en934868.exe
Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en934868.exe
Filesize
175KB

MD5
30bf410db5f6c05f0dee763f5a0fe5b7

SHA1
1f4187925e1af163603a12bb116e869f8f137455

SHA256
d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

SHA512
5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7816.exe
Filesize
685KB

MD5
4bb2e3e829d633c8ffd9fce536f4719f

SHA1
5c5dcbff0b2413bc7aae653e023ba9629af63ce3

SHA256
2c08ebaf1b0cc178908f0a9b79bd19c3a97f9cfd7cf216503dbf07a00fecde97

SHA512
05e2817fd846cfe5b9fcaf6c8c50d70c7d35abc70da2a50b55b61df1d997ebe6d1faaf4c8104173e60cf60c100e7b00a79421dcb60e599bf0e58df67b4adde9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7816.exe
Filesize
685KB

MD5
4bb2e3e829d633c8ffd9fce536f4719f

SHA1
5c5dcbff0b2413bc7aae653e023ba9629af63ce3

SHA256
2c08ebaf1b0cc178908f0a9b79bd19c3a97f9cfd7cf216503dbf07a00fecde97

SHA512
05e2817fd846cfe5b9fcaf6c8c50d70c7d35abc70da2a50b55b61df1d997ebe6d1faaf4c8104173e60cf60c100e7b00a79421dcb60e599bf0e58df67b4adde9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dXQ97s25.exe
Filesize
355KB

MD5
b375cd8ee9d5c7faf7401339161ae6ed

SHA1
172e510ad73fcc38599caa1447d83dbfe47364f5

SHA256
c6909c4360bc2a6b9f0ad6d8044a75187d62af40a3480cac8d799f16a5db111d

SHA512
8dd72a9fcbc0760492a6f819a59fb8c4b347b66536efdfbbbebe0187622f9b8db33ca002ce30a18393f1c86e55e9b85600af7e746a8e78d32b780122a5da3216

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dXQ97s25.exe
Filesize
355KB

MD5
b375cd8ee9d5c7faf7401339161ae6ed

SHA1
172e510ad73fcc38599caa1447d83dbfe47364f5

SHA256
c6909c4360bc2a6b9f0ad6d8044a75187d62af40a3480cac8d799f16a5db111d

SHA512
8dd72a9fcbc0760492a6f819a59fb8c4b347b66536efdfbbbebe0187622f9b8db33ca002ce30a18393f1c86e55e9b85600af7e746a8e78d32b780122a5da3216

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino2134.exe
Filesize
339KB

MD5
9e7609c9225afa25cb84d517644efdbf

SHA1
9e0f0099cf2176d2c30d4f03c4227958fc75333b

SHA256
88d050ed2661ea8c0b40176c738633f43eeda593e45d656524f804ea5d73cd5a

SHA512
a1888186cf9f7cad60c633029df092230f1b31b714d444372bb8d4c375ef033ade2ad8cb8883eaf1e972e68d46b7faccbd4889f58b21093e4d4ca24bc2a2aa60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino2134.exe
Filesize
339KB

MD5
9e7609c9225afa25cb84d517644efdbf

SHA1
9e0f0099cf2176d2c30d4f03c4227958fc75333b

SHA256
88d050ed2661ea8c0b40176c738633f43eeda593e45d656524f804ea5d73cd5a

SHA512
a1888186cf9f7cad60c633029df092230f1b31b714d444372bb8d4c375ef033ade2ad8cb8883eaf1e972e68d46b7faccbd4889f58b21093e4d4ca24bc2a2aa60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3680.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3680.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4832.exe
Filesize
298KB

MD5
5a99afd09f5716db4d0119c1645a5b9e

SHA1
a0e5ff44c7b96b3425145a034a3612836e4b9478

SHA256
dacbd8336287da3966f59fea673cd52506f9128017f2b6108341d8ee935521fe

SHA512
8cfb3aaacc30766b934a05f3a34e67d32c2e82b71f84dd43cbb1fa2da662638394dddaf0babea712bd475591e314338df6ba255a018fe6cf7aa7bcf7aaa3ee25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4832.exe
Filesize
298KB

MD5
5a99afd09f5716db4d0119c1645a5b9e

SHA1
a0e5ff44c7b96b3425145a034a3612836e4b9478

SHA256
dacbd8336287da3966f59fea673cd52506f9128017f2b6108341d8ee935521fe

SHA512
8cfb3aaacc30766b934a05f3a34e67d32c2e82b71f84dd43cbb1fa2da662638394dddaf0babea712bd475591e314338df6ba255a018fe6cf7aa7bcf7aaa3ee25

Download Submit
memory/2616-161-0x0000000000B80000-0x0000000000B8A000-memory.dmp

Filesize
40KB

Download
memory/3152-1123-0x00000000072A0000-0x00000000072DC000-memory.dmp

Filesize
240KB

Download
memory/3152-236-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-1135-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3152-1133-0x0000000009690000-0x00000000096E0000-memory.dmp

Filesize
320KB

Download
memory/3152-1132-0x0000000009600000-0x0000000009676000-memory.dmp

Filesize
472KB

Download
memory/3152-1131-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3152-1130-0x0000000008FA0000-0x00000000094CC000-memory.dmp

Filesize
5.2MB

Download
memory/3152-1129-0x0000000008DC0000-0x0000000008F82000-memory.dmp

Filesize
1.8MB

Download
memory/3152-1128-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3152-1127-0x0000000008320000-0x0000000008386000-memory.dmp

Filesize
408KB

Download
memory/3152-1126-0x0000000008280000-0x0000000008312000-memory.dmp

Filesize
584KB

Download
memory/3152-1124-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3152-1122-0x0000000007280000-0x0000000007292000-memory.dmp

Filesize
72KB

Download
memory/3152-1121-0x0000000007EC0000-0x0000000007FCA000-memory.dmp

Filesize
1.0MB

Download
memory/3152-1120-0x00000000078A0000-0x0000000007EB8000-memory.dmp

Filesize
6.1MB

Download
memory/3152-262-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3152-210-0x0000000002C80000-0x0000000002CCB000-memory.dmp

Filesize
300KB

Download
memory/3152-211-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3152-212-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3152-213-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-214-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-216-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-218-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-222-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-224-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-220-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-226-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-228-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-230-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-232-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-234-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-246-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-238-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-240-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-242-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/3152-244-0x0000000004C40000-0x0000000004C7E000-memory.dmp

Filesize
248KB

Download
memory/4156-1140-0x00000000001D0000-0x0000000000202000-memory.dmp

Filesize
200KB

Download
memory/4156-1141-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/4960-203-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/4960-190-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-192-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-182-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-188-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-202-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/4960-200-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/4960-180-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-198-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/4960-197-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/4960-196-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-194-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-204-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/4960-205-0x0000000000400000-0x0000000002B79000-memory.dmp

Filesize
39.5MB

Download
memory/4960-199-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/4960-178-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-186-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-184-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-176-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-174-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-172-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-170-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-169-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/4960-168-0x0000000007350000-0x00000000078F4000-memory.dmp

Filesize
5.6MB

Download
memory/4960-167-0x0000000002B80000-0x0000000002BAD000-memory.dmp

Filesize
180KB

Download