amadey | 25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe
Size

1.0MB
MD5

518fac8630bee247b6ff4cd33ee86263
SHA1

39ace22d35b525521372d28e42ad6f308d20f2f5
SHA256

25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9
SHA512

f83591ef904964143a77a082cdd62f0806679a9fb73be14e6dd8b01baf12c453a596264ae4ce3c480dc3f740ec5b72a92fbf40744be23b8418977ee4c99d70ab
SSDEEP

24576:YybhUYzinM4i8JBYa7JvbxKMq9YKrcSQyMY4WDeixkUlYuxY:fbhULMp2r7DKnCPkMYLDeixkUOY

Score

10^/10

amadey redline renta rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

renta

176.113.115.145:4125

Attributes

auth_value
359596fd5b36e9925ade4d9a1846bafb

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

bu851411.execor8455.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bu851411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu851411.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor8455.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor8455.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor8455.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor8455.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu851411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu851411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu851411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu851411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor8455.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor8455.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5096-210-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-211-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-213-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-215-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-217-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-219-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-221-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-223-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-225-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-227-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-229-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-231-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-233-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-235-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-237-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-239-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-241-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline
behavioral1/memory/5096-243-0x00000000052F0000-0x000000000532F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge932319.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	ge932319.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 11 IoCs

Processes:

kina1335.exekina7942.exekina5418.exebu851411.execor8455.exedns83s87.exeen271119.exege932319.exemetafor.exemetafor.exemetafor.exe

pid	process
4708	kina1335.exe
4492	kina7942.exe
3960	kina5418.exe
4668	bu851411.exe
1760	cor8455.exe
5096	dns83s87.exe
4628	en271119.exe
1260	ge932319.exe
2340	metafor.exe
2700	metafor.exe
5044	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bu851411.execor8455.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu851411.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor8455.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor8455.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kina7942.exekina5418.exe25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exekina1335.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina7942.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina7942.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina5418.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina5418.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina1335.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina1335.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1644 1760 WerFault.exe cor8455.exe
3972 5096 WerFault.exe dns83s87.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4168 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bu851411.execor8455.exedns83s87.exeen271119.exe

pid process

4668 bu851411.exe
4668 bu851411.exe
1760 cor8455.exe
1760 cor8455.exe
5096 dns83s87.exe
5096 dns83s87.exe
4628 en271119.exe
4628 en271119.exe

pid	pid_target	process	target process
1644	1760	WerFault.exe	cor8455.exe
3972	5096	WerFault.exe	dns83s87.exe

pid	process
4168	schtasks.exe

pid	process
4668	bu851411.exe
4668	bu851411.exe
1760	cor8455.exe
1760	cor8455.exe
5096	dns83s87.exe
5096	dns83s87.exe
4628	en271119.exe
4628	en271119.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bu851411.execor8455.exedns83s87.exeen271119.exe

description	pid	process
Token: SeDebugPrivilege	4668	bu851411.exe
Token: SeDebugPrivilege	1760	cor8455.exe
Token: SeDebugPrivilege	5096	dns83s87.exe
Token: SeDebugPrivilege	4628	en271119.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exekina1335.exekina7942.exekina5418.exege932319.exemetafor.execmd.exe

description	pid	process	target process
PID 4940 wrote to memory of 4708	4940	25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe	kina1335.exe
PID 4940 wrote to memory of 4708	4940	25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe	kina1335.exe
PID 4940 wrote to memory of 4708	4940	25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe	kina1335.exe
PID 4708 wrote to memory of 4492	4708	kina1335.exe	kina7942.exe
PID 4708 wrote to memory of 4492	4708	kina1335.exe	kina7942.exe
PID 4708 wrote to memory of 4492	4708	kina1335.exe	kina7942.exe
PID 4492 wrote to memory of 3960	4492	kina7942.exe	kina5418.exe
PID 4492 wrote to memory of 3960	4492	kina7942.exe	kina5418.exe
PID 4492 wrote to memory of 3960	4492	kina7942.exe	kina5418.exe
PID 3960 wrote to memory of 4668	3960	kina5418.exe	bu851411.exe
PID 3960 wrote to memory of 4668	3960	kina5418.exe	bu851411.exe
PID 3960 wrote to memory of 1760	3960	kina5418.exe	cor8455.exe
PID 3960 wrote to memory of 1760	3960	kina5418.exe	cor8455.exe
PID 3960 wrote to memory of 1760	3960	kina5418.exe	cor8455.exe
PID 4492 wrote to memory of 5096	4492	kina7942.exe	dns83s87.exe
PID 4492 wrote to memory of 5096	4492	kina7942.exe	dns83s87.exe
PID 4492 wrote to memory of 5096	4492	kina7942.exe	dns83s87.exe
PID 4708 wrote to memory of 4628	4708	kina1335.exe	en271119.exe
PID 4708 wrote to memory of 4628	4708	kina1335.exe	en271119.exe
PID 4708 wrote to memory of 4628	4708	kina1335.exe	en271119.exe
PID 4940 wrote to memory of 1260	4940	25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe	ge932319.exe
PID 4940 wrote to memory of 1260	4940	25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe	ge932319.exe
PID 4940 wrote to memory of 1260	4940	25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe	ge932319.exe
PID 1260 wrote to memory of 2340	1260	ge932319.exe	metafor.exe
PID 1260 wrote to memory of 2340	1260	ge932319.exe	metafor.exe
PID 1260 wrote to memory of 2340	1260	ge932319.exe	metafor.exe
PID 2340 wrote to memory of 4168	2340	metafor.exe	schtasks.exe
PID 2340 wrote to memory of 4168	2340	metafor.exe	schtasks.exe
PID 2340 wrote to memory of 4168	2340	metafor.exe	schtasks.exe
PID 2340 wrote to memory of 440	2340	metafor.exe	cmd.exe
PID 2340 wrote to memory of 440	2340	metafor.exe	cmd.exe
PID 2340 wrote to memory of 440	2340	metafor.exe	cmd.exe
PID 440 wrote to memory of 2536	440	cmd.exe	cmd.exe
PID 440 wrote to memory of 2536	440	cmd.exe	cmd.exe
PID 440 wrote to memory of 2536	440	cmd.exe	cmd.exe
PID 440 wrote to memory of 1316	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 1316	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 1316	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 1640	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 1640	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 1640	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 1236	440	cmd.exe	cmd.exe
PID 440 wrote to memory of 1236	440	cmd.exe	cmd.exe
PID 440 wrote to memory of 1236	440	cmd.exe	cmd.exe
PID 440 wrote to memory of 4292	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 4292	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 4292	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 3392	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 3392	440	cmd.exe	cacls.exe
PID 440 wrote to memory of 3392	440	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe
"C:\Users\Admin\AppData\Local\Temp\25c1553734973a6416e2ef2605ba8885b208d3304eff2e46df1f5e06544f47e9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1335.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1335.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina7942.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina7942.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5418.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5418.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu851411.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu851411.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8455.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8455.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 1084
        6⤵
        Program crash
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dns83s87.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dns83s87.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1336
        5⤵
        Program crash
        
        PID:3972
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en271119.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en271119.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge932319.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge932319.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
    "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4168
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:440
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2536
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:N"
        5⤵
        
        PID:1316
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:R" /E
        5⤵
        
        PID:1640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1236
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:N"
        5⤵
        
        PID:4292
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:R" /E
        5⤵
        
        PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1760 -ip 1760
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5096 -ip 5096
1⤵
PID:3216

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:5044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
496136c7c02979f88cceb464d5fcc57e

SHA1
1d8e68293bd41bdce19624accd90c4e3dc8dc851

SHA256
fff656ae9c61a5d2399149f213679b090d8cf7db1651d6ef0434126fc244bc24

SHA512
ef3872bfe0c0a7816bf1ad47ca8139c61459f526f4db67c624a9d7d0f2ff9694e21a7ba7af9a3cdb491559c9e1b37edae75c6c02683569597fada82be58b9315

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
496136c7c02979f88cceb464d5fcc57e

SHA1
1d8e68293bd41bdce19624accd90c4e3dc8dc851

SHA256
fff656ae9c61a5d2399149f213679b090d8cf7db1651d6ef0434126fc244bc24

SHA512
ef3872bfe0c0a7816bf1ad47ca8139c61459f526f4db67c624a9d7d0f2ff9694e21a7ba7af9a3cdb491559c9e1b37edae75c6c02683569597fada82be58b9315

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
496136c7c02979f88cceb464d5fcc57e

SHA1
1d8e68293bd41bdce19624accd90c4e3dc8dc851

SHA256
fff656ae9c61a5d2399149f213679b090d8cf7db1651d6ef0434126fc244bc24

SHA512
ef3872bfe0c0a7816bf1ad47ca8139c61459f526f4db67c624a9d7d0f2ff9694e21a7ba7af9a3cdb491559c9e1b37edae75c6c02683569597fada82be58b9315

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
496136c7c02979f88cceb464d5fcc57e

SHA1
1d8e68293bd41bdce19624accd90c4e3dc8dc851

SHA256
fff656ae9c61a5d2399149f213679b090d8cf7db1651d6ef0434126fc244bc24

SHA512
ef3872bfe0c0a7816bf1ad47ca8139c61459f526f4db67c624a9d7d0f2ff9694e21a7ba7af9a3cdb491559c9e1b37edae75c6c02683569597fada82be58b9315

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
496136c7c02979f88cceb464d5fcc57e

SHA1
1d8e68293bd41bdce19624accd90c4e3dc8dc851

SHA256
fff656ae9c61a5d2399149f213679b090d8cf7db1651d6ef0434126fc244bc24

SHA512
ef3872bfe0c0a7816bf1ad47ca8139c61459f526f4db67c624a9d7d0f2ff9694e21a7ba7af9a3cdb491559c9e1b37edae75c6c02683569597fada82be58b9315

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge932319.exe

Filesize
227KB

MD5
496136c7c02979f88cceb464d5fcc57e

SHA1
1d8e68293bd41bdce19624accd90c4e3dc8dc851

SHA256
fff656ae9c61a5d2399149f213679b090d8cf7db1651d6ef0434126fc244bc24

SHA512
ef3872bfe0c0a7816bf1ad47ca8139c61459f526f4db67c624a9d7d0f2ff9694e21a7ba7af9a3cdb491559c9e1b37edae75c6c02683569597fada82be58b9315

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge932319.exe

Filesize
227KB

MD5
496136c7c02979f88cceb464d5fcc57e

SHA1
1d8e68293bd41bdce19624accd90c4e3dc8dc851

SHA256
fff656ae9c61a5d2399149f213679b090d8cf7db1651d6ef0434126fc244bc24

SHA512
ef3872bfe0c0a7816bf1ad47ca8139c61459f526f4db67c624a9d7d0f2ff9694e21a7ba7af9a3cdb491559c9e1b37edae75c6c02683569597fada82be58b9315

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1335.exe

Filesize
857KB

MD5
4f76a0a81fc6f24eceadff74a31a4aef

SHA1
6e9c11ec8e9938aecefd3840f03e6d08dd5af796

SHA256
a07e874e243f7fd8739e79d483057cabd8e1af53e854febcf0d617413922396c

SHA512
3f1abff613c0cad10eee12a7ff2d336e21fa8e5966c3e37b08e7e64db87056f9a62f7dfe5abbd9401b196b0e8da50de8bce23c27ff4da383dd849109e5ab7abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1335.exe

Filesize
857KB

MD5
4f76a0a81fc6f24eceadff74a31a4aef

SHA1
6e9c11ec8e9938aecefd3840f03e6d08dd5af796

SHA256
a07e874e243f7fd8739e79d483057cabd8e1af53e854febcf0d617413922396c

SHA512
3f1abff613c0cad10eee12a7ff2d336e21fa8e5966c3e37b08e7e64db87056f9a62f7dfe5abbd9401b196b0e8da50de8bce23c27ff4da383dd849109e5ab7abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en271119.exe

Filesize
175KB

MD5
5f00efd3ad003cfa1f5774b1743617ef

SHA1
908d964c54d4e7be3662ad76ea322f2b6dc6d325

SHA256
5623f8726f7861c9088f85fcdde95a348e41c57afc4972b99f5c65a928bfb070

SHA512
75702520918b068b15bc0d333db9bc1962b214d4598c00da16dbc611a8001f293ff2a3979dd71039b02e2fbe242cd0ff36d67d47a90745d4987d80545fe3834b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en271119.exe

Filesize
175KB

MD5
5f00efd3ad003cfa1f5774b1743617ef

SHA1
908d964c54d4e7be3662ad76ea322f2b6dc6d325

SHA256
5623f8726f7861c9088f85fcdde95a348e41c57afc4972b99f5c65a928bfb070

SHA512
75702520918b068b15bc0d333db9bc1962b214d4598c00da16dbc611a8001f293ff2a3979dd71039b02e2fbe242cd0ff36d67d47a90745d4987d80545fe3834b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina7942.exe

Filesize
715KB

MD5
0cc3e86ec16d8bd8cc5f4f6dcc946048

SHA1
a3cb6975d97ab7acf89cae4a0f045e69fa34ecfd

SHA256
e443d85a3bd778e8fa04ac212fcd2391f71f561d8fa3981c8b233dc91a2d1922

SHA512
6fa304294dc2299649a38c355c38b510acc353eda207b6aaf6fc9b0933b63190049d83d6f9b064c3c5127350f28f8b25008f32cbea94f56345387846d57f2356

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina7942.exe

Filesize
715KB

MD5
0cc3e86ec16d8bd8cc5f4f6dcc946048

SHA1
a3cb6975d97ab7acf89cae4a0f045e69fa34ecfd

SHA256
e443d85a3bd778e8fa04ac212fcd2391f71f561d8fa3981c8b233dc91a2d1922

SHA512
6fa304294dc2299649a38c355c38b510acc353eda207b6aaf6fc9b0933b63190049d83d6f9b064c3c5127350f28f8b25008f32cbea94f56345387846d57f2356

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dns83s87.exe

Filesize
365KB

MD5
2bb65b5024e2ebe18f36e65e3b548dd9

SHA1
7c5c341d2d9426c0d7198747c7f8315f4a3249c9

SHA256
4774c67987b4a4fee0c30cc03d546c5f7e8a0f1b0ef6574dca4fa6e2fa445e13

SHA512
237a90bcd5ed94e1e6bb022f423e58207f4453c781dc0c8f8754b8ff1537eb45e131e581194962f3a0ce8ecab8d38eeedf606d135859522951820d5b093a0eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dns83s87.exe

Filesize
365KB

MD5
2bb65b5024e2ebe18f36e65e3b548dd9

SHA1
7c5c341d2d9426c0d7198747c7f8315f4a3249c9

SHA256
4774c67987b4a4fee0c30cc03d546c5f7e8a0f1b0ef6574dca4fa6e2fa445e13

SHA512
237a90bcd5ed94e1e6bb022f423e58207f4453c781dc0c8f8754b8ff1537eb45e131e581194962f3a0ce8ecab8d38eeedf606d135859522951820d5b093a0eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5418.exe

Filesize
354KB

MD5
57186e036e235e3bbccc2e66859b8c19

SHA1
25b9e8917735cfcc07b7ca47a34e3727769005f8

SHA256
110871d338b0ec294dfa467764c04abe11556fbe7f018327c69bc883c7aa3940

SHA512
b42700c2b3179725cd0bc8af4c63ecdf204b87b5534193de9c93a43a7b1e6ba74abdf10f9d8dc9094b9ed4acd5de98d0883a2eeea2be7a0ae4a777d76fba59c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5418.exe

Filesize
354KB

MD5
57186e036e235e3bbccc2e66859b8c19

SHA1
25b9e8917735cfcc07b7ca47a34e3727769005f8

SHA256
110871d338b0ec294dfa467764c04abe11556fbe7f018327c69bc883c7aa3940

SHA512
b42700c2b3179725cd0bc8af4c63ecdf204b87b5534193de9c93a43a7b1e6ba74abdf10f9d8dc9094b9ed4acd5de98d0883a2eeea2be7a0ae4a777d76fba59c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu851411.exe

Filesize
11KB

MD5
b159cb38d2dc1946cdfc8eefd2570666

SHA1
13b093f5fefca72fcd853d6c5ee88ee4e7b726f3

SHA256
c922292e33d7e6f68aa6df774b383efa36ceb6da2962dd53014199a6fab7205a

SHA512
f5fa68ac36590e17a6cd8dbd03c1d7e6aae2b7715ce43f033a71a97bff4bcb7594e791565de179cc3c18ce465ad9fcc9032df1b21098e295e9755f686ac2acb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu851411.exe

Filesize
11KB

MD5
b159cb38d2dc1946cdfc8eefd2570666

SHA1
13b093f5fefca72fcd853d6c5ee88ee4e7b726f3

SHA256
c922292e33d7e6f68aa6df774b383efa36ceb6da2962dd53014199a6fab7205a

SHA512
f5fa68ac36590e17a6cd8dbd03c1d7e6aae2b7715ce43f033a71a97bff4bcb7594e791565de179cc3c18ce465ad9fcc9032df1b21098e295e9755f686ac2acb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8455.exe

Filesize
307KB

MD5
19eb99dee9bb3f236eccc57bcfed3329

SHA1
666a1d6b223606f5731cc42a62f0322823d4b47c

SHA256
6690a77e87d37beedec2d9e16f8286eee62ba0be6699a4a2c11e4acb9857d234

SHA512
a95e47c51efab9fef4b2b33ef79501a13b36c556ee813b78a40ed9a948530aba9386908639d3cb790919434975930080277097459883426b21436070b434b728

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8455.exe

Filesize
307KB

MD5
19eb99dee9bb3f236eccc57bcfed3329

SHA1
666a1d6b223606f5731cc42a62f0322823d4b47c

SHA256
6690a77e87d37beedec2d9e16f8286eee62ba0be6699a4a2c11e4acb9857d234

SHA512
a95e47c51efab9fef4b2b33ef79501a13b36c556ee813b78a40ed9a948530aba9386908639d3cb790919434975930080277097459883426b21436070b434b728

Download Submit
memory/1760-185-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-201-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1760-183-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-179-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-187-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-189-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-191-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-193-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-195-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-197-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-198-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1760-199-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1760-200-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1760-181-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-203-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1760-204-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1760-205-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1760-167-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/1760-177-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-175-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-173-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-171-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-170-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/1760-169-0x0000000004F90000-0x0000000005534000-memory.dmp

Filesize
5.6MB

Download
memory/1760-168-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/4628-1142-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/4628-1141-0x0000000000330000-0x0000000000362000-memory.dmp

Filesize
200KB

Download
memory/4668-161-0x0000000000970000-0x000000000097A000-memory.dmp

Filesize
40KB

Download
memory/5096-215-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-231-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-233-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-235-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-237-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-239-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-241-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-243-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-247-0x0000000000800000-0x000000000084B000-memory.dmp

Filesize
300KB

Download
memory/5096-248-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/5096-250-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/5096-252-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/5096-1120-0x0000000005470000-0x0000000005A88000-memory.dmp

Filesize
6.1MB

Download
memory/5096-1121-0x0000000005B00000-0x0000000005C0A000-memory.dmp

Filesize
1.0MB

Download
memory/5096-1122-0x0000000005C40000-0x0000000005C52000-memory.dmp

Filesize
72KB

Download
memory/5096-1123-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/5096-1124-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/5096-1125-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/5096-1126-0x0000000006620000-0x00000000066B2000-memory.dmp

Filesize
584KB

Download
memory/5096-1128-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/5096-1129-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/5096-1130-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/5096-1131-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/5096-1132-0x0000000007AE0000-0x0000000007CA2000-memory.dmp

Filesize
1.8MB

Download
memory/5096-1133-0x0000000007CB0000-0x00000000081DC000-memory.dmp

Filesize
5.2MB

Download
memory/5096-1134-0x0000000002740000-0x00000000027B6000-memory.dmp

Filesize
472KB

Download
memory/5096-229-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-227-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-225-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-223-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-221-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-219-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-217-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-213-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-211-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-210-0x00000000052F0000-0x000000000532F000-memory.dmp

Filesize
252KB

Download
memory/5096-1135-0x0000000008300000-0x0000000008350000-memory.dmp

Filesize
320KB

Download