amadey | 2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4

Analysis

max time kernel
95s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe
Size

1.0MB
MD5

fb7d060b7386b5b1a3797901a82c28df
SHA1

3cbcd0a4c0070fd574a09fe8799a61fd9c9e3b70
SHA256

2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4
SHA512

eef72cfc13bd25870833d25170907a51fbdb356c8c048bca4c7cf2d50ab76026c5e382af1d84274bf97e51015680e017d442a9b20ff3b37ebd977c3354c3f43f
SSDEEP

24576:ryWUPE91FyjYjtdaf9dkNuxbWRlG7xgbw0ownP/wGQuVx:eWUPu2cClUlR49H0rAW

Score

10^/10

amadey redline renta rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

renta

176.113.115.145:4125

Attributes

auth_value
359596fd5b36e9925ade4d9a1846bafb

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

cor1140.exebu330213.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor1140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor1140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor1140.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bu330213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu330213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu330213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu330213.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor1140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor1140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu330213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu330213.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor1140.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5008-209-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-210-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-212-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-214-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-216-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-218-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-220-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-222-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-224-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-226-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-228-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-230-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-232-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-234-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-236-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-238-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-240-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-242-0x0000000002780000-0x00000000027BF000-memory.dmp	family_redline
behavioral1/memory/5008-1126-0x0000000004F20000-0x0000000004F30000-memory.dmp	family_redline
behavioral1/memory/5008-1128-0x0000000004F20000-0x0000000004F30000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

metafor.exege263008.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	metafor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	ge263008.exe

Executes dropped EXE 10 IoCs

Processes:

kina6635.exekina0194.exekina8399.exebu330213.execor1140.exedyC02s17.exeen581655.exege263008.exemetafor.exemetafor.exe

pid	process
2748	kina6635.exe
4764	kina0194.exe
4856	kina8399.exe
4408	bu330213.exe
324	cor1140.exe
5008	dyC02s17.exe
4436	en581655.exe
2220	ge263008.exe
536	metafor.exe
4932	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bu330213.execor1140.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu330213.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor1140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor1140.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kina6635.exekina0194.exekina8399.exe2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina6635.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina6635.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina0194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina0194.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina8399.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina8399.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3576 324 WerFault.exe cor1140.exe
4876 5008 WerFault.exe dyC02s17.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3524 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bu330213.execor1140.exedyC02s17.exeen581655.exe

pid process

4408 bu330213.exe
4408 bu330213.exe
324 cor1140.exe
324 cor1140.exe
5008 dyC02s17.exe
5008 dyC02s17.exe
4436 en581655.exe
4436 en581655.exe

pid	pid_target	process	target process
3576	324	WerFault.exe	cor1140.exe
4876	5008	WerFault.exe	dyC02s17.exe

pid	process
3524	schtasks.exe

pid	process
4408	bu330213.exe
4408	bu330213.exe
324	cor1140.exe
324	cor1140.exe
5008	dyC02s17.exe
5008	dyC02s17.exe
4436	en581655.exe
4436	en581655.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bu330213.execor1140.exedyC02s17.exeen581655.exe

description	pid	process
Token: SeDebugPrivilege	4408	bu330213.exe
Token: SeDebugPrivilege	324	cor1140.exe
Token: SeDebugPrivilege	5008	dyC02s17.exe
Token: SeDebugPrivilege	4436	en581655.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exekina6635.exekina0194.exekina8399.exege263008.exemetafor.execmd.exe

description	pid	process	target process
PID 4488 wrote to memory of 2748	4488	2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe	kina6635.exe
PID 4488 wrote to memory of 2748	4488	2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe	kina6635.exe
PID 4488 wrote to memory of 2748	4488	2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe	kina6635.exe
PID 2748 wrote to memory of 4764	2748	kina6635.exe	kina0194.exe
PID 2748 wrote to memory of 4764	2748	kina6635.exe	kina0194.exe
PID 2748 wrote to memory of 4764	2748	kina6635.exe	kina0194.exe
PID 4764 wrote to memory of 4856	4764	kina0194.exe	kina8399.exe
PID 4764 wrote to memory of 4856	4764	kina0194.exe	kina8399.exe
PID 4764 wrote to memory of 4856	4764	kina0194.exe	kina8399.exe
PID 4856 wrote to memory of 4408	4856	kina8399.exe	bu330213.exe
PID 4856 wrote to memory of 4408	4856	kina8399.exe	bu330213.exe
PID 4856 wrote to memory of 324	4856	kina8399.exe	cor1140.exe
PID 4856 wrote to memory of 324	4856	kina8399.exe	cor1140.exe
PID 4856 wrote to memory of 324	4856	kina8399.exe	cor1140.exe
PID 4764 wrote to memory of 5008	4764	kina0194.exe	dyC02s17.exe
PID 4764 wrote to memory of 5008	4764	kina0194.exe	dyC02s17.exe
PID 4764 wrote to memory of 5008	4764	kina0194.exe	dyC02s17.exe
PID 2748 wrote to memory of 4436	2748	kina6635.exe	en581655.exe
PID 2748 wrote to memory of 4436	2748	kina6635.exe	en581655.exe
PID 2748 wrote to memory of 4436	2748	kina6635.exe	en581655.exe
PID 4488 wrote to memory of 2220	4488	2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe	ge263008.exe
PID 4488 wrote to memory of 2220	4488	2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe	ge263008.exe
PID 4488 wrote to memory of 2220	4488	2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe	ge263008.exe
PID 2220 wrote to memory of 536	2220	ge263008.exe	metafor.exe
PID 2220 wrote to memory of 536	2220	ge263008.exe	metafor.exe
PID 2220 wrote to memory of 536	2220	ge263008.exe	metafor.exe
PID 536 wrote to memory of 3524	536	metafor.exe	schtasks.exe
PID 536 wrote to memory of 3524	536	metafor.exe	schtasks.exe
PID 536 wrote to memory of 3524	536	metafor.exe	schtasks.exe
PID 536 wrote to memory of 2620	536	metafor.exe	cmd.exe
PID 536 wrote to memory of 2620	536	metafor.exe	cmd.exe
PID 536 wrote to memory of 2620	536	metafor.exe	cmd.exe
PID 2620 wrote to memory of 4240	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 4240	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 4240	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 4716	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 4716	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 4716	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 4792	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 4792	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 4792	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 732	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 732	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 732	2620	cmd.exe	cmd.exe
PID 2620 wrote to memory of 3380	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 3380	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 3380	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 5044	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 5044	2620	cmd.exe	cacls.exe
PID 2620 wrote to memory of 5044	2620	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe
"C:\Users\Admin\AppData\Local\Temp\2fbe1124891eea516b426f412800d124c50ca73507db9c22849a55124cfe05d4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6635.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6635.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0194.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0194.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina8399.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina8399.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu330213.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu330213.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1140.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1140.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 1080
        6⤵
        Program crash
        
        PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dyC02s17.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dyC02s17.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1328
        5⤵
        Program crash
        
        PID:4876
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en581655.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en581655.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge263008.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge263008.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
    "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3524
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4240
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:N"
        5⤵
        
        PID:4716
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:R" /E
        5⤵
        
        PID:4792
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:732
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:N"
        5⤵
        
        PID:3380
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:R" /E
        5⤵
        
        PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 324 -ip 324
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5008 -ip 5008
1⤵
PID:4460

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:4932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
e2e64ab16b03d03a29870cae171ee9b1

SHA1
86cdb3a3da357c7fb9acff2227cd3c7c7e7ef759

SHA256
7975aa06db7e8cd4e2f450aa2024b747db1a233b307bf9296ec8c54f413d1615

SHA512
7a90c3aeefa0322366d6b29cb90c283ffd069f0ac79fb802a3f35ccc44a98525a3b260e801e2fc69502f6607952802910b313af2540f9f3ce7b0cf5f6277ba58

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
e2e64ab16b03d03a29870cae171ee9b1

SHA1
86cdb3a3da357c7fb9acff2227cd3c7c7e7ef759

SHA256
7975aa06db7e8cd4e2f450aa2024b747db1a233b307bf9296ec8c54f413d1615

SHA512
7a90c3aeefa0322366d6b29cb90c283ffd069f0ac79fb802a3f35ccc44a98525a3b260e801e2fc69502f6607952802910b313af2540f9f3ce7b0cf5f6277ba58

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
e2e64ab16b03d03a29870cae171ee9b1

SHA1
86cdb3a3da357c7fb9acff2227cd3c7c7e7ef759

SHA256
7975aa06db7e8cd4e2f450aa2024b747db1a233b307bf9296ec8c54f413d1615

SHA512
7a90c3aeefa0322366d6b29cb90c283ffd069f0ac79fb802a3f35ccc44a98525a3b260e801e2fc69502f6607952802910b313af2540f9f3ce7b0cf5f6277ba58

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
e2e64ab16b03d03a29870cae171ee9b1

SHA1
86cdb3a3da357c7fb9acff2227cd3c7c7e7ef759

SHA256
7975aa06db7e8cd4e2f450aa2024b747db1a233b307bf9296ec8c54f413d1615

SHA512
7a90c3aeefa0322366d6b29cb90c283ffd069f0ac79fb802a3f35ccc44a98525a3b260e801e2fc69502f6607952802910b313af2540f9f3ce7b0cf5f6277ba58

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge263008.exe

Filesize
227KB

MD5
e2e64ab16b03d03a29870cae171ee9b1

SHA1
86cdb3a3da357c7fb9acff2227cd3c7c7e7ef759

SHA256
7975aa06db7e8cd4e2f450aa2024b747db1a233b307bf9296ec8c54f413d1615

SHA512
7a90c3aeefa0322366d6b29cb90c283ffd069f0ac79fb802a3f35ccc44a98525a3b260e801e2fc69502f6607952802910b313af2540f9f3ce7b0cf5f6277ba58

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge263008.exe

Filesize
227KB

MD5
e2e64ab16b03d03a29870cae171ee9b1

SHA1
86cdb3a3da357c7fb9acff2227cd3c7c7e7ef759

SHA256
7975aa06db7e8cd4e2f450aa2024b747db1a233b307bf9296ec8c54f413d1615

SHA512
7a90c3aeefa0322366d6b29cb90c283ffd069f0ac79fb802a3f35ccc44a98525a3b260e801e2fc69502f6607952802910b313af2540f9f3ce7b0cf5f6277ba58

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6635.exe

Filesize
857KB

MD5
44a7e621d78ff2a14146c7f0b786aef6

SHA1
ff09568d425f398447ca057728842e558f69ee77

SHA256
56ce4d12aae4122d75570f9a52e30352017eb9bf24a77e54bebbb66f4e5cbd29

SHA512
d80931e3809e26c395bc9b66c8ca25144fa4cbe6a8eaa7737842eb133c6d5961067751f09ea9a79f0f21c9d8c352c606e06e81b27ee7ef7df0163ccdc5824804

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6635.exe

Filesize
857KB

MD5
44a7e621d78ff2a14146c7f0b786aef6

SHA1
ff09568d425f398447ca057728842e558f69ee77

SHA256
56ce4d12aae4122d75570f9a52e30352017eb9bf24a77e54bebbb66f4e5cbd29

SHA512
d80931e3809e26c395bc9b66c8ca25144fa4cbe6a8eaa7737842eb133c6d5961067751f09ea9a79f0f21c9d8c352c606e06e81b27ee7ef7df0163ccdc5824804

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en581655.exe

Filesize
175KB

MD5
55991f40584864d5e3e828ea9b8c8bd1

SHA1
0b01baede738d0a3d498b92e88b7ffdd6d1bba8f

SHA256
37f0baa6ae70ad28b5adb3cf5de0b6b7ff84c6033f4bd5b263ffa065d1eb310e

SHA512
473a483a13070dad3894b32ad5f10584019c1881dc7a2e1d5f4d89ee0b8b636534b9bbb7b40a6f8f6f1fc46c476109f4a1a4328e001f600ebe99b13f13b9017c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en581655.exe

Filesize
175KB

MD5
55991f40584864d5e3e828ea9b8c8bd1

SHA1
0b01baede738d0a3d498b92e88b7ffdd6d1bba8f

SHA256
37f0baa6ae70ad28b5adb3cf5de0b6b7ff84c6033f4bd5b263ffa065d1eb310e

SHA512
473a483a13070dad3894b32ad5f10584019c1881dc7a2e1d5f4d89ee0b8b636534b9bbb7b40a6f8f6f1fc46c476109f4a1a4328e001f600ebe99b13f13b9017c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0194.exe

Filesize
714KB

MD5
1b3baa43b9f37e0c6b0086672c2ecf43

SHA1
4094f8e8c607a49a46b81b6dbd41c12fc4773bd4

SHA256
5dcbd3038c092f4cd522fb653b4cf67969baed688e88d2a587c28235015eb264

SHA512
d96669ae0dfcfac36688c9022694daab3e980f8f80bba8d015bc33c21078f65536d7b3a492ce69c3384e66b1e037f733d7b505cd8b8848a4f3b08458fcf8beea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0194.exe

Filesize
714KB

MD5
1b3baa43b9f37e0c6b0086672c2ecf43

SHA1
4094f8e8c607a49a46b81b6dbd41c12fc4773bd4

SHA256
5dcbd3038c092f4cd522fb653b4cf67969baed688e88d2a587c28235015eb264

SHA512
d96669ae0dfcfac36688c9022694daab3e980f8f80bba8d015bc33c21078f65536d7b3a492ce69c3384e66b1e037f733d7b505cd8b8848a4f3b08458fcf8beea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dyC02s17.exe

Filesize
365KB

MD5
4a8c56fe4495ca27098a5af19d78afc9

SHA1
ceeb48cb71b9f6bf0153afc96b3337768df22da5

SHA256
c46b5d8ef297bac96ad1b8270eb5567132492ea2b837d81a849f3cd93b627b4c

SHA512
29c93aab366461f60aba39830ba5efdbd40f10f301641a1788302f9dd379d7b177ec9cc7d8809bdb2b1d257ce113eb64e9d79fdb7208c9c8efb30c9b759656eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dyC02s17.exe

Filesize
365KB

MD5
4a8c56fe4495ca27098a5af19d78afc9

SHA1
ceeb48cb71b9f6bf0153afc96b3337768df22da5

SHA256
c46b5d8ef297bac96ad1b8270eb5567132492ea2b837d81a849f3cd93b627b4c

SHA512
29c93aab366461f60aba39830ba5efdbd40f10f301641a1788302f9dd379d7b177ec9cc7d8809bdb2b1d257ce113eb64e9d79fdb7208c9c8efb30c9b759656eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina8399.exe

Filesize
354KB

MD5
446f688392334f80086d41fb87f5545b

SHA1
4aef4528011595cd254811853fac3c9d6e346cc3

SHA256
1a6c20503cfee41bd5fdf37071a9182873acad2397589a4aac98375eb1243dce

SHA512
f03db77ba4bd311f66548597b3cd3230af9f9077fdc0cbc9a220112cb7460f026aa96f23384d2f6899fa1b99c9910fdb2b7278997d069dba49d14eb0dc24f1e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina8399.exe

Filesize
354KB

MD5
446f688392334f80086d41fb87f5545b

SHA1
4aef4528011595cd254811853fac3c9d6e346cc3

SHA256
1a6c20503cfee41bd5fdf37071a9182873acad2397589a4aac98375eb1243dce

SHA512
f03db77ba4bd311f66548597b3cd3230af9f9077fdc0cbc9a220112cb7460f026aa96f23384d2f6899fa1b99c9910fdb2b7278997d069dba49d14eb0dc24f1e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu330213.exe

Filesize
11KB

MD5
a4f89f8dc8ca3450dc0240359e4c002c

SHA1
5b23c62b34d9adcfdb997a039b29115ba117fd1b

SHA256
03454e8aad3ebc11c3a0662fe85773cec8e85d456313438a94f99afc1c2fc42e

SHA512
9e8427ac8d39272ffdfed294238fdbfdd3a54ae379ed5a2d3d9acbe9a62ba19cf5b082b11b6f295ecb75da0f15aeb5c377f95198508c5e406e39406b1383bcab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu330213.exe

Filesize
11KB

MD5
a4f89f8dc8ca3450dc0240359e4c002c

SHA1
5b23c62b34d9adcfdb997a039b29115ba117fd1b

SHA256
03454e8aad3ebc11c3a0662fe85773cec8e85d456313438a94f99afc1c2fc42e

SHA512
9e8427ac8d39272ffdfed294238fdbfdd3a54ae379ed5a2d3d9acbe9a62ba19cf5b082b11b6f295ecb75da0f15aeb5c377f95198508c5e406e39406b1383bcab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1140.exe

Filesize
307KB

MD5
8a59dabdafda29d7c98b8f03202817c5

SHA1
8e15854f09ca5d35db2003a553c45a9fb0330349

SHA256
b96a2f6b67b23d32f07e56681283a3e5f6df4e2b4ace6805624d9cdbaed20fb7

SHA512
f25389b2906a039d5d26048da3dabd7681622c428b99a8befc5effa8893355be3d94dd4ce64e5684ec489dac8a64379a49f2a546c032c419560c93ea44a42991

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1140.exe

Filesize
307KB

MD5
8a59dabdafda29d7c98b8f03202817c5

SHA1
8e15854f09ca5d35db2003a553c45a9fb0330349

SHA256
b96a2f6b67b23d32f07e56681283a3e5f6df4e2b4ace6805624d9cdbaed20fb7

SHA512
f25389b2906a039d5d26048da3dabd7681622c428b99a8befc5effa8893355be3d94dd4ce64e5684ec489dac8a64379a49f2a546c032c419560c93ea44a42991

Download Submit
memory/324-179-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-200-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/324-175-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-181-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-183-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-185-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-187-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-189-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-191-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-193-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-195-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-197-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-199-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-177-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-201-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/324-202-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/324-204-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/324-167-0x0000000004E10000-0x00000000053B4000-memory.dmp

Filesize
5.6MB

Download
memory/324-173-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-172-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/324-170-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/324-171-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/324-169-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/324-168-0x0000000000710000-0x000000000073D000-memory.dmp

Filesize
180KB

Download
memory/4408-161-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Filesize
40KB

Download
memory/4436-1140-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/4436-1139-0x00000000001E0000-0x0000000000212000-memory.dmp

Filesize
200KB

Download
memory/5008-212-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-228-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-230-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-232-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-234-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-236-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-238-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-240-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-242-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-422-0x00000000007F0000-0x000000000083B000-memory.dmp

Filesize
300KB

Download
memory/5008-425-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/5008-427-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/5008-1118-0x00000000054E0000-0x0000000005AF8000-memory.dmp

Filesize
6.1MB

Download
memory/5008-1119-0x0000000004DE0000-0x0000000004EEA000-memory.dmp

Filesize
1.0MB

Download
memory/5008-1120-0x0000000005B00000-0x0000000005B12000-memory.dmp

Filesize
72KB

Download
memory/5008-1121-0x0000000005B20000-0x0000000005B5C000-memory.dmp

Filesize
240KB

Download
memory/5008-1122-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/5008-1123-0x0000000005E10000-0x0000000005E76000-memory.dmp

Filesize
408KB

Download
memory/5008-1124-0x00000000064D0000-0x0000000006562000-memory.dmp

Filesize
584KB

Download
memory/5008-1126-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/5008-1127-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/5008-1128-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download
memory/5008-1129-0x0000000006820000-0x0000000006896000-memory.dmp

Filesize
472KB

Download
memory/5008-1130-0x00000000068A0000-0x00000000068F0000-memory.dmp

Filesize
320KB

Download
memory/5008-1131-0x0000000006A50000-0x0000000006C12000-memory.dmp

Filesize
1.8MB

Download
memory/5008-1132-0x0000000006C20000-0x000000000714C000-memory.dmp

Filesize
5.2MB

Download
memory/5008-226-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-224-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-222-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-220-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-218-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-216-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-214-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-210-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-209-0x0000000002780000-0x00000000027BF000-memory.dmp

Filesize
252KB

Download
memory/5008-1133-0x0000000004F20000-0x0000000004F30000-memory.dmp

Filesize
64KB

Download