amadey | f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb

Analysis

max time kernel
129s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe
Size

1005KB
MD5

9d78afead148834502cfe7f8d704cba3
SHA1

9c90a9c8e58a992ec614ca80f2e6677aab257393
SHA256

f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb
SHA512

072f57a2f96df4232f9190b5b95287e603dd33d85757419169104da0adbb075193a8dcf7826180272f5dc95096c8efc00b476cb9f32bb16a76316b81d0d76e63
SSDEEP

24576:VyOkRmf3hP7CTNGQVra2uOaZ3+2kmHuycmJVxHQag1ujUan84KD+D:wZINdQVm2VaZ3bkhycmhkIAaP0+

Score

10^/10

amadey redline renta rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

renta

176.113.115.145:4125

Attributes

auth_value
359596fd5b36e9925ade4d9a1846bafb

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

bu872587.execor4070.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu872587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor4070.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor4070.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu872587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu872587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu872587.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor4070.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor4070.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor4070.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor4070.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bu872587.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu872587.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/560-209-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-210-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-212-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-214-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-216-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-218-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-220-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-222-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-224-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-226-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-228-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-230-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-232-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-234-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-236-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-238-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-240-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-242-0x0000000003BD0000-0x0000000003C0F000-memory.dmp	family_redline
behavioral1/memory/560-326-0x0000000006160000-0x0000000006170000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge506019.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	ge506019.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 11 IoCs

Processes:

kina3412.exekina9642.exekina1954.exebu872587.execor4070.exedFo47s44.exeen798428.exege506019.exemetafor.exemetafor.exemetafor.exe

pid	process
4868	kina3412.exe
4840	kina9642.exe
4532	kina1954.exe
4268	bu872587.exe
4432	cor4070.exe
560	dFo47s44.exe
3848	en798428.exe
876	ge506019.exe
1528	metafor.exe
4220	metafor.exe
3408	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bu872587.execor4070.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu872587.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor4070.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor4070.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exekina3412.exekina9642.exekina1954.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina3412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina3412.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina9642.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina9642.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina1954.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina1954.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3196 4432 WerFault.exe cor4070.exe
3936 560 WerFault.exe dFo47s44.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1724 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bu872587.execor4070.exedFo47s44.exeen798428.exe

pid process

4268 bu872587.exe
4268 bu872587.exe
4432 cor4070.exe
4432 cor4070.exe
560 dFo47s44.exe
560 dFo47s44.exe
3848 en798428.exe
3848 en798428.exe

pid	pid_target	process	target process
3196	4432	WerFault.exe	cor4070.exe
3936	560	WerFault.exe	dFo47s44.exe

pid	process
1724	schtasks.exe

pid	process
4268	bu872587.exe
4268	bu872587.exe
4432	cor4070.exe
4432	cor4070.exe
560	dFo47s44.exe
560	dFo47s44.exe
3848	en798428.exe
3848	en798428.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bu872587.execor4070.exedFo47s44.exeen798428.exe

description	pid	process
Token: SeDebugPrivilege	4268	bu872587.exe
Token: SeDebugPrivilege	4432	cor4070.exe
Token: SeDebugPrivilege	560	dFo47s44.exe
Token: SeDebugPrivilege	3848	en798428.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exekina3412.exekina9642.exekina1954.exege506019.exemetafor.execmd.exe

description	pid	process	target process
PID 4932 wrote to memory of 4868	4932	f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe	kina3412.exe
PID 4932 wrote to memory of 4868	4932	f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe	kina3412.exe
PID 4932 wrote to memory of 4868	4932	f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe	kina3412.exe
PID 4868 wrote to memory of 4840	4868	kina3412.exe	kina9642.exe
PID 4868 wrote to memory of 4840	4868	kina3412.exe	kina9642.exe
PID 4868 wrote to memory of 4840	4868	kina3412.exe	kina9642.exe
PID 4840 wrote to memory of 4532	4840	kina9642.exe	kina1954.exe
PID 4840 wrote to memory of 4532	4840	kina9642.exe	kina1954.exe
PID 4840 wrote to memory of 4532	4840	kina9642.exe	kina1954.exe
PID 4532 wrote to memory of 4268	4532	kina1954.exe	bu872587.exe
PID 4532 wrote to memory of 4268	4532	kina1954.exe	bu872587.exe
PID 4532 wrote to memory of 4432	4532	kina1954.exe	cor4070.exe
PID 4532 wrote to memory of 4432	4532	kina1954.exe	cor4070.exe
PID 4532 wrote to memory of 4432	4532	kina1954.exe	cor4070.exe
PID 4840 wrote to memory of 560	4840	kina9642.exe	dFo47s44.exe
PID 4840 wrote to memory of 560	4840	kina9642.exe	dFo47s44.exe
PID 4840 wrote to memory of 560	4840	kina9642.exe	dFo47s44.exe
PID 4868 wrote to memory of 3848	4868	kina3412.exe	en798428.exe
PID 4868 wrote to memory of 3848	4868	kina3412.exe	en798428.exe
PID 4868 wrote to memory of 3848	4868	kina3412.exe	en798428.exe
PID 4932 wrote to memory of 876	4932	f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe	ge506019.exe
PID 4932 wrote to memory of 876	4932	f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe	ge506019.exe
PID 4932 wrote to memory of 876	4932	f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe	ge506019.exe
PID 876 wrote to memory of 1528	876	ge506019.exe	metafor.exe
PID 876 wrote to memory of 1528	876	ge506019.exe	metafor.exe
PID 876 wrote to memory of 1528	876	ge506019.exe	metafor.exe
PID 1528 wrote to memory of 1724	1528	metafor.exe	schtasks.exe
PID 1528 wrote to memory of 1724	1528	metafor.exe	schtasks.exe
PID 1528 wrote to memory of 1724	1528	metafor.exe	schtasks.exe
PID 1528 wrote to memory of 2580	1528	metafor.exe	cmd.exe
PID 1528 wrote to memory of 2580	1528	metafor.exe	cmd.exe
PID 1528 wrote to memory of 2580	1528	metafor.exe	cmd.exe
PID 2580 wrote to memory of 4108	2580	cmd.exe	cmd.exe
PID 2580 wrote to memory of 4108	2580	cmd.exe	cmd.exe
PID 2580 wrote to memory of 4108	2580	cmd.exe	cmd.exe
PID 2580 wrote to memory of 5076	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 5076	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 5076	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 4760	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 4760	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 4760	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 4940	2580	cmd.exe	cmd.exe
PID 2580 wrote to memory of 4940	2580	cmd.exe	cmd.exe
PID 2580 wrote to memory of 4940	2580	cmd.exe	cmd.exe
PID 2580 wrote to memory of 3796	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 3796	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 3796	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 2112	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 2112	2580	cmd.exe	cacls.exe
PID 2580 wrote to memory of 2112	2580	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe
"C:\Users\Admin\AppData\Local\Temp\f80533153d08d97597c09d5cb522a5dff6092a6259c13f31bdb56bb91207a8fb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3412.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3412.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9642.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9642.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina1954.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina1954.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu872587.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu872587.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4070.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4070.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 1008
        6⤵
        Program crash
        
        PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dFo47s44.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dFo47s44.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 1348
        5⤵
        Program crash
        
        PID:3936
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en798428.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en798428.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge506019.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge506019.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
    "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1724
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4108
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:N"
        5⤵
        
        PID:5076
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:R" /E
        5⤵
        
        PID:4760
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:N"
        5⤵
        
        PID:3796
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:R" /E
        5⤵
        
        PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4432 -ip 4432
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 560 -ip 560
1⤵
PID:3216

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:3408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
5eb14023c462ea11b378ca31199f85e8

SHA1
39501cd7bd08753920994bb314311c5e0ac459a0

SHA256
4db25123756e071d340c8ba13e20a82b225bf4bf95954b6e9056624f1f772b3d

SHA512
d9204e81c2afd3eb1bb5101dddc0f1fb40a8e3bae49a7ac1a8e0a32e5d7fa9422b4a747018a02bf6de2965a47b98e04a89b0cadad4cf5211e0f98a8b2fa48d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
5eb14023c462ea11b378ca31199f85e8

SHA1
39501cd7bd08753920994bb314311c5e0ac459a0

SHA256
4db25123756e071d340c8ba13e20a82b225bf4bf95954b6e9056624f1f772b3d

SHA512
d9204e81c2afd3eb1bb5101dddc0f1fb40a8e3bae49a7ac1a8e0a32e5d7fa9422b4a747018a02bf6de2965a47b98e04a89b0cadad4cf5211e0f98a8b2fa48d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
5eb14023c462ea11b378ca31199f85e8

SHA1
39501cd7bd08753920994bb314311c5e0ac459a0

SHA256
4db25123756e071d340c8ba13e20a82b225bf4bf95954b6e9056624f1f772b3d

SHA512
d9204e81c2afd3eb1bb5101dddc0f1fb40a8e3bae49a7ac1a8e0a32e5d7fa9422b4a747018a02bf6de2965a47b98e04a89b0cadad4cf5211e0f98a8b2fa48d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
5eb14023c462ea11b378ca31199f85e8

SHA1
39501cd7bd08753920994bb314311c5e0ac459a0

SHA256
4db25123756e071d340c8ba13e20a82b225bf4bf95954b6e9056624f1f772b3d

SHA512
d9204e81c2afd3eb1bb5101dddc0f1fb40a8e3bae49a7ac1a8e0a32e5d7fa9422b4a747018a02bf6de2965a47b98e04a89b0cadad4cf5211e0f98a8b2fa48d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
5eb14023c462ea11b378ca31199f85e8

SHA1
39501cd7bd08753920994bb314311c5e0ac459a0

SHA256
4db25123756e071d340c8ba13e20a82b225bf4bf95954b6e9056624f1f772b3d

SHA512
d9204e81c2afd3eb1bb5101dddc0f1fb40a8e3bae49a7ac1a8e0a32e5d7fa9422b4a747018a02bf6de2965a47b98e04a89b0cadad4cf5211e0f98a8b2fa48d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge506019.exe

Filesize
227KB

MD5
5eb14023c462ea11b378ca31199f85e8

SHA1
39501cd7bd08753920994bb314311c5e0ac459a0

SHA256
4db25123756e071d340c8ba13e20a82b225bf4bf95954b6e9056624f1f772b3d

SHA512
d9204e81c2afd3eb1bb5101dddc0f1fb40a8e3bae49a7ac1a8e0a32e5d7fa9422b4a747018a02bf6de2965a47b98e04a89b0cadad4cf5211e0f98a8b2fa48d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge506019.exe

Filesize
227KB

MD5
5eb14023c462ea11b378ca31199f85e8

SHA1
39501cd7bd08753920994bb314311c5e0ac459a0

SHA256
4db25123756e071d340c8ba13e20a82b225bf4bf95954b6e9056624f1f772b3d

SHA512
d9204e81c2afd3eb1bb5101dddc0f1fb40a8e3bae49a7ac1a8e0a32e5d7fa9422b4a747018a02bf6de2965a47b98e04a89b0cadad4cf5211e0f98a8b2fa48d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3412.exe

Filesize
822KB

MD5
613c98ea7ae5183a11c8e5d54a8323db

SHA1
da5080f55b4578528f0356af806c9c6c50dfd830

SHA256
242fb1720d904233b6df7a68bc16d581a84a1e7ac0c1ad88a4d30694d70252f1

SHA512
8e916c9739abf52c4491fca5169b1ccdfd7dfafb3e499cb87e3d9d06571d19aa4d7a2345cbcad31c17cae837b3587fb2c30130c3accceb67f57b540f5221a6a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3412.exe

Filesize
822KB

MD5
613c98ea7ae5183a11c8e5d54a8323db

SHA1
da5080f55b4578528f0356af806c9c6c50dfd830

SHA256
242fb1720d904233b6df7a68bc16d581a84a1e7ac0c1ad88a4d30694d70252f1

SHA512
8e916c9739abf52c4491fca5169b1ccdfd7dfafb3e499cb87e3d9d06571d19aa4d7a2345cbcad31c17cae837b3587fb2c30130c3accceb67f57b540f5221a6a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en798428.exe

Filesize
175KB

MD5
a511cdb269d86e6495bf8837d874cfc0

SHA1
8b639a685dd827463df20821ce29074f7c577cfd

SHA256
7d61f286f42047668558fdae8713abfc470cfa251b2c56891133a6db57cc8bc5

SHA512
05ec7803eabe78649294e2cb0d19581163ae2713004b62814844c25160347b94f564bbf298f28270cb59e2ed257caad71272f8b0d5efefc831c50385f2921e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en798428.exe

Filesize
175KB

MD5
a511cdb269d86e6495bf8837d874cfc0

SHA1
8b639a685dd827463df20821ce29074f7c577cfd

SHA256
7d61f286f42047668558fdae8713abfc470cfa251b2c56891133a6db57cc8bc5

SHA512
05ec7803eabe78649294e2cb0d19581163ae2713004b62814844c25160347b94f564bbf298f28270cb59e2ed257caad71272f8b0d5efefc831c50385f2921e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9642.exe

Filesize
680KB

MD5
06338d4fa74d4d837d0bd04ae7a4f56e

SHA1
795107d2ff03159ec216e99a80367115c50af8e9

SHA256
8883f1d824e5de7b6916a491ce117dddccc55558c8b825a8e0f045fbbb5bb26d

SHA512
2794b717abc5bcb54af3f7aee01af3635345a2145f18203969c2be06aef6ea4e57ff3ec6fe91dfe10bae2e7215ed3a1cafab52f0bfc1e52762045d369966810e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9642.exe

Filesize
680KB

MD5
06338d4fa74d4d837d0bd04ae7a4f56e

SHA1
795107d2ff03159ec216e99a80367115c50af8e9

SHA256
8883f1d824e5de7b6916a491ce117dddccc55558c8b825a8e0f045fbbb5bb26d

SHA512
2794b717abc5bcb54af3f7aee01af3635345a2145f18203969c2be06aef6ea4e57ff3ec6fe91dfe10bae2e7215ed3a1cafab52f0bfc1e52762045d369966810e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dFo47s44.exe

Filesize
345KB

MD5
77e67d688475485491aae3c97711387f

SHA1
ba47b6afe4c210ba9b84e33a8ddc8b3770c66083

SHA256
67c25eb226adcbfd40ce5a4a587fb579d19a13ba14e4f4b8321b584f1bdd6bd2

SHA512
c3ff78e3284f177b39b85b501836ca7e3cf61d4acd9db5145271b04383562db78569c6961e751389eda1b270886ae0e4b63ecd3bd6d63fba01500548c972a3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dFo47s44.exe

Filesize
345KB

MD5
77e67d688475485491aae3c97711387f

SHA1
ba47b6afe4c210ba9b84e33a8ddc8b3770c66083

SHA256
67c25eb226adcbfd40ce5a4a587fb579d19a13ba14e4f4b8321b584f1bdd6bd2

SHA512
c3ff78e3284f177b39b85b501836ca7e3cf61d4acd9db5145271b04383562db78569c6961e751389eda1b270886ae0e4b63ecd3bd6d63fba01500548c972a3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina1954.exe

Filesize
344KB

MD5
15f5282deed7715bdcb5001c001ab8f8

SHA1
94f454bc0187cda523113127e0c310f5c0b90c1f

SHA256
a9376b43ee83ec3ab2f0e5d64a820a37f31f1afa091159f0c916a40ae1f01d5b

SHA512
29a272b5c7775ddd4ad0e7d5027ee348e499273a72635a9dbe134de205c5b6f6902f68363289d4734ed9837f22d60c14cd65fb9f860fc9f01cf7ac393649a029

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina1954.exe

Filesize
344KB

MD5
15f5282deed7715bdcb5001c001ab8f8

SHA1
94f454bc0187cda523113127e0c310f5c0b90c1f

SHA256
a9376b43ee83ec3ab2f0e5d64a820a37f31f1afa091159f0c916a40ae1f01d5b

SHA512
29a272b5c7775ddd4ad0e7d5027ee348e499273a72635a9dbe134de205c5b6f6902f68363289d4734ed9837f22d60c14cd65fb9f860fc9f01cf7ac393649a029

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu872587.exe

Filesize
11KB

MD5
bfb021ee92c77cbc7e6a3e9dab6d7e39

SHA1
f8ca0495e46dbd8f8767ce526784d3ddd13354b5

SHA256
f182bbb8cbed0380c781352562bf002b18909b01144ea6ac395fe84e56db44b8

SHA512
4bf8d20c4a038baff16ce365b4e37d8f75754d5a499dee4aad90b732559de239963e28b8f56895525282b4e0d44c1145c763f3dae16a64ae5a78d0345eefa58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu872587.exe

Filesize
11KB

MD5
bfb021ee92c77cbc7e6a3e9dab6d7e39

SHA1
f8ca0495e46dbd8f8767ce526784d3ddd13354b5

SHA256
f182bbb8cbed0380c781352562bf002b18909b01144ea6ac395fe84e56db44b8

SHA512
4bf8d20c4a038baff16ce365b4e37d8f75754d5a499dee4aad90b732559de239963e28b8f56895525282b4e0d44c1145c763f3dae16a64ae5a78d0345eefa58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4070.exe

Filesize
291KB

MD5
4bbec52f68708aef13a84ec35787cd1f

SHA1
189069689a8f152c84829943af1225826e13d0c7

SHA256
230d6ade719b7355fda6748ab8e98b8a353793b7a7e071c4110f6c8b410d77d0

SHA512
ded334b1004cfb7aac678c9a4e8da98ceb96caeda1cd3a3e6b31b78fc98e8a172976323bd369689a78d1806f7bd2a6877c1e1c7dfb07db52e0bb6ab2ee67e38e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4070.exe

Filesize
291KB

MD5
4bbec52f68708aef13a84ec35787cd1f

SHA1
189069689a8f152c84829943af1225826e13d0c7

SHA256
230d6ade719b7355fda6748ab8e98b8a353793b7a7e071c4110f6c8b410d77d0

SHA512
ded334b1004cfb7aac678c9a4e8da98ceb96caeda1cd3a3e6b31b78fc98e8a172976323bd369689a78d1806f7bd2a6877c1e1c7dfb07db52e0bb6ab2ee67e38e

Download Submit
memory/560-1123-0x0000000006E90000-0x0000000006ECC000-memory.dmp

Filesize
240KB

Download
memory/560-238-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-1134-0x0000000007CF0000-0x000000000821C000-memory.dmp

Filesize
5.2MB

Download
memory/560-1133-0x0000000007B10000-0x0000000007CD2000-memory.dmp

Filesize
1.8MB

Download
memory/560-1132-0x0000000007AB0000-0x0000000007B00000-memory.dmp

Filesize
320KB

Download
memory/560-1131-0x0000000007A30000-0x0000000007AA6000-memory.dmp

Filesize
472KB

Download
memory/560-1130-0x0000000006160000-0x0000000006170000-memory.dmp

Filesize
64KB

Download
memory/560-1129-0x0000000006160000-0x0000000006170000-memory.dmp

Filesize
64KB

Download
memory/560-1128-0x0000000006160000-0x0000000006170000-memory.dmp

Filesize
64KB

Download
memory/560-1127-0x0000000006160000-0x0000000006170000-memory.dmp

Filesize
64KB

Download
memory/560-1125-0x00000000071C0000-0x0000000007226000-memory.dmp

Filesize
408KB

Download
memory/560-1124-0x0000000007120000-0x00000000071B2000-memory.dmp

Filesize
584KB

Download
memory/560-1122-0x0000000006160000-0x0000000006170000-memory.dmp

Filesize
64KB

Download
memory/560-1121-0x0000000006120000-0x0000000006132000-memory.dmp

Filesize
72KB

Download
memory/560-1120-0x0000000006D40000-0x0000000006E4A000-memory.dmp

Filesize
1.0MB

Download
memory/560-1119-0x0000000006720000-0x0000000006D38000-memory.dmp

Filesize
6.1MB

Download
memory/560-209-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-210-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-212-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-214-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-216-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-218-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-220-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-222-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-224-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-226-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-228-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-230-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-232-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-234-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-236-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-326-0x0000000006160000-0x0000000006170000-memory.dmp

Filesize
64KB

Download
memory/560-240-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-242-0x0000000003BD0000-0x0000000003C0F000-memory.dmp

Filesize
252KB

Download
memory/560-323-0x0000000001B00000-0x0000000001B4B000-memory.dmp

Filesize
300KB

Download
memory/560-324-0x0000000006160000-0x0000000006170000-memory.dmp

Filesize
64KB

Download
memory/560-329-0x0000000006160000-0x0000000006170000-memory.dmp

Filesize
64KB

Download
memory/3848-1140-0x0000000000600000-0x0000000000632000-memory.dmp

Filesize
200KB

Download
memory/3848-1141-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/4268-161-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/4432-201-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/4432-188-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-178-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-184-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-200-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/4432-199-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/4432-198-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-196-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-194-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-192-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-190-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-202-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/4432-186-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-176-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-174-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-204-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/4432-182-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-172-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-171-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/4432-170-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/4432-168-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/4432-169-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/4432-167-0x0000000004E90000-0x0000000005434000-memory.dmp

Filesize
5.6MB

Download
memory/4432-180-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download