amadey | c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c

Analysis

max time kernel
127s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe
Size

1005KB
MD5

ecb050e69d3b317985ee7abf0a7d91dc
SHA1

99c350cc9f51a93379085bb69f2497af2af9a587
SHA256

c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c
SHA512

10d3cb956b02ae2b7946818b004e6de03c74fa22a7a29a9532ce38cd057abb52f313b8512872dafc337c249c293f9dfebdfa5b813ef91f48b02408bf667ed4dd
SSDEEP

24576:cypSAepGSXgp863WGAGabzsRsPgWOaMA60fkScJ:LuXoAGABbwsbmtC

Score

10^/10

amadey redline renta rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

renta

176.113.115.145:4125

Attributes

auth_value
359596fd5b36e9925ade4d9a1846bafb

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

cor8904.exebu995257.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor8904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor8904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu995257.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu995257.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu995257.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor8904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor8904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor8904.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bu995257.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu995257.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu995257.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor8904.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1408-211-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-213-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-210-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-215-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-217-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-219-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-221-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-223-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-225-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-227-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-229-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-231-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-233-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-235-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-237-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-239-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-241-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-243-0x0000000003870000-0x00000000038AF000-memory.dmp	family_redline
behavioral1/memory/1408-364-0x00000000036E0000-0x00000000036F0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge974330.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	ge974330.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 11 IoCs

Processes:

kina7214.exekina4280.exekina8000.exebu995257.execor8904.exedKR44s64.exeen120514.exege974330.exemetafor.exemetafor.exemetafor.exe

pid	process
5084	kina7214.exe
3228	kina4280.exe
4504	kina8000.exe
2184	bu995257.exe
220	cor8904.exe
1408	dKR44s64.exe
4916	en120514.exe
3168	ge974330.exe
4352	metafor.exe
4836	metafor.exe
1612	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bu995257.execor8904.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu995257.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor8904.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor8904.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exekina7214.exekina4280.exekina8000.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina7214.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina7214.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina4280.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina4280.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina8000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina8000.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2748 220 WerFault.exe cor8904.exe
1228 1408 WerFault.exe dKR44s64.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4996 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bu995257.execor8904.exedKR44s64.exeen120514.exe

pid process

2184 bu995257.exe
2184 bu995257.exe
220 cor8904.exe
220 cor8904.exe
1408 dKR44s64.exe
1408 dKR44s64.exe
4916 en120514.exe
4916 en120514.exe

pid	pid_target	process	target process
2748	220	WerFault.exe	cor8904.exe
1228	1408	WerFault.exe	dKR44s64.exe

pid	process
4996	schtasks.exe

pid	process
2184	bu995257.exe
2184	bu995257.exe
220	cor8904.exe
220	cor8904.exe
1408	dKR44s64.exe
1408	dKR44s64.exe
4916	en120514.exe
4916	en120514.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bu995257.execor8904.exedKR44s64.exeen120514.exe

description	pid	process
Token: SeDebugPrivilege	2184	bu995257.exe
Token: SeDebugPrivilege	220	cor8904.exe
Token: SeDebugPrivilege	1408	dKR44s64.exe
Token: SeDebugPrivilege	4916	en120514.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exekina7214.exekina4280.exekina8000.exege974330.exemetafor.execmd.exe

description	pid	process	target process
PID 748 wrote to memory of 5084	748	c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe	kina7214.exe
PID 748 wrote to memory of 5084	748	c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe	kina7214.exe
PID 748 wrote to memory of 5084	748	c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe	kina7214.exe
PID 5084 wrote to memory of 3228	5084	kina7214.exe	kina4280.exe
PID 5084 wrote to memory of 3228	5084	kina7214.exe	kina4280.exe
PID 5084 wrote to memory of 3228	5084	kina7214.exe	kina4280.exe
PID 3228 wrote to memory of 4504	3228	kina4280.exe	kina8000.exe
PID 3228 wrote to memory of 4504	3228	kina4280.exe	kina8000.exe
PID 3228 wrote to memory of 4504	3228	kina4280.exe	kina8000.exe
PID 4504 wrote to memory of 2184	4504	kina8000.exe	bu995257.exe
PID 4504 wrote to memory of 2184	4504	kina8000.exe	bu995257.exe
PID 4504 wrote to memory of 220	4504	kina8000.exe	cor8904.exe
PID 4504 wrote to memory of 220	4504	kina8000.exe	cor8904.exe
PID 4504 wrote to memory of 220	4504	kina8000.exe	cor8904.exe
PID 3228 wrote to memory of 1408	3228	kina4280.exe	dKR44s64.exe
PID 3228 wrote to memory of 1408	3228	kina4280.exe	dKR44s64.exe
PID 3228 wrote to memory of 1408	3228	kina4280.exe	dKR44s64.exe
PID 5084 wrote to memory of 4916	5084	kina7214.exe	en120514.exe
PID 5084 wrote to memory of 4916	5084	kina7214.exe	en120514.exe
PID 5084 wrote to memory of 4916	5084	kina7214.exe	en120514.exe
PID 748 wrote to memory of 3168	748	c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe	ge974330.exe
PID 748 wrote to memory of 3168	748	c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe	ge974330.exe
PID 748 wrote to memory of 3168	748	c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe	ge974330.exe
PID 3168 wrote to memory of 4352	3168	ge974330.exe	metafor.exe
PID 3168 wrote to memory of 4352	3168	ge974330.exe	metafor.exe
PID 3168 wrote to memory of 4352	3168	ge974330.exe	metafor.exe
PID 4352 wrote to memory of 4996	4352	metafor.exe	schtasks.exe
PID 4352 wrote to memory of 4996	4352	metafor.exe	schtasks.exe
PID 4352 wrote to memory of 4996	4352	metafor.exe	schtasks.exe
PID 4352 wrote to memory of 4592	4352	metafor.exe	cmd.exe
PID 4352 wrote to memory of 4592	4352	metafor.exe	cmd.exe
PID 4352 wrote to memory of 4592	4352	metafor.exe	cmd.exe
PID 4592 wrote to memory of 2996	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 2996	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 2996	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 3084	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 3084	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 3084	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 4272	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 4272	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 4272	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 1100	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 1100	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 1100	4592	cmd.exe	cmd.exe
PID 4592 wrote to memory of 4484	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 4484	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 4484	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 1796	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 1796	4592	cmd.exe	cacls.exe
PID 4592 wrote to memory of 1796	4592	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe
"C:\Users\Admin\AppData\Local\Temp\c406bbf360ec0ac9e0e658de90c6b94b8a5216b624293b8da73baa9d0925623c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7214.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7214.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5084

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4280.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4280.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3228

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina8000.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina8000.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4504

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu995257.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu995257.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8904.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8904.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 1088
6⤵
- Program crash
PID:2748

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dKR44s64.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dKR44s64.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1356
5⤵
- Program crash
PID:1228

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en120514.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en120514.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge974330.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge974330.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
4⤵
- Creates scheduled task(s)
PID:4996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2996

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:N"
5⤵
PID:3084

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:R" /E
5⤵
PID:4272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1100

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:N"
5⤵
PID:4484

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:R" /E
5⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 220 -ip 220
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1408 -ip 1408
1⤵
PID:4408

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:4836

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
baa988e6c030bba5556b058f813d524b

SHA1
b122fa45a74c8395b4c0b8f638b06a34f4daadb5

SHA256
a920d597dae7544af7ccb315686203edc3316b4ad45103c478f2e1f855ab1fb4

SHA512
28d8852a5442ebd8e2f2c1ae212eb5235e8747eeda38086d40776bc89440c2aeadfad221c44c90cc7a41ac39567f0f338e92fa2c6f27b238fabfb3eb0363a9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
baa988e6c030bba5556b058f813d524b

SHA1
b122fa45a74c8395b4c0b8f638b06a34f4daadb5

SHA256
a920d597dae7544af7ccb315686203edc3316b4ad45103c478f2e1f855ab1fb4

SHA512
28d8852a5442ebd8e2f2c1ae212eb5235e8747eeda38086d40776bc89440c2aeadfad221c44c90cc7a41ac39567f0f338e92fa2c6f27b238fabfb3eb0363a9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
baa988e6c030bba5556b058f813d524b

SHA1
b122fa45a74c8395b4c0b8f638b06a34f4daadb5

SHA256
a920d597dae7544af7ccb315686203edc3316b4ad45103c478f2e1f855ab1fb4

SHA512
28d8852a5442ebd8e2f2c1ae212eb5235e8747eeda38086d40776bc89440c2aeadfad221c44c90cc7a41ac39567f0f338e92fa2c6f27b238fabfb3eb0363a9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
baa988e6c030bba5556b058f813d524b

SHA1
b122fa45a74c8395b4c0b8f638b06a34f4daadb5

SHA256
a920d597dae7544af7ccb315686203edc3316b4ad45103c478f2e1f855ab1fb4

SHA512
28d8852a5442ebd8e2f2c1ae212eb5235e8747eeda38086d40776bc89440c2aeadfad221c44c90cc7a41ac39567f0f338e92fa2c6f27b238fabfb3eb0363a9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
baa988e6c030bba5556b058f813d524b

SHA1
b122fa45a74c8395b4c0b8f638b06a34f4daadb5

SHA256
a920d597dae7544af7ccb315686203edc3316b4ad45103c478f2e1f855ab1fb4

SHA512
28d8852a5442ebd8e2f2c1ae212eb5235e8747eeda38086d40776bc89440c2aeadfad221c44c90cc7a41ac39567f0f338e92fa2c6f27b238fabfb3eb0363a9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge974330.exe

Filesize
227KB

MD5
baa988e6c030bba5556b058f813d524b

SHA1
b122fa45a74c8395b4c0b8f638b06a34f4daadb5

SHA256
a920d597dae7544af7ccb315686203edc3316b4ad45103c478f2e1f855ab1fb4

SHA512
28d8852a5442ebd8e2f2c1ae212eb5235e8747eeda38086d40776bc89440c2aeadfad221c44c90cc7a41ac39567f0f338e92fa2c6f27b238fabfb3eb0363a9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge974330.exe

Filesize
227KB

MD5
baa988e6c030bba5556b058f813d524b

SHA1
b122fa45a74c8395b4c0b8f638b06a34f4daadb5

SHA256
a920d597dae7544af7ccb315686203edc3316b4ad45103c478f2e1f855ab1fb4

SHA512
28d8852a5442ebd8e2f2c1ae212eb5235e8747eeda38086d40776bc89440c2aeadfad221c44c90cc7a41ac39567f0f338e92fa2c6f27b238fabfb3eb0363a9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7214.exe

Filesize
823KB

MD5
c1305ee9f612a73a1281d8a9fc2cce68

SHA1
25ca7e05b8b7e5fb7b7127716d3f1ebb98d4d5d4

SHA256
f169a225e7e38e8b07a5fca3b6e7871922bd1da5ea6b30f093ccd3d4766fbef1

SHA512
3bb2afdc3578a1fbbc6b7b1ce6876adcb0f416f0e37a063c6045d71d4588f6e4112e96b0ce632c07d7577dddcbea9898036357c0be9d834ef003d35f0c06b20a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7214.exe

Filesize
823KB

MD5
c1305ee9f612a73a1281d8a9fc2cce68

SHA1
25ca7e05b8b7e5fb7b7127716d3f1ebb98d4d5d4

SHA256
f169a225e7e38e8b07a5fca3b6e7871922bd1da5ea6b30f093ccd3d4766fbef1

SHA512
3bb2afdc3578a1fbbc6b7b1ce6876adcb0f416f0e37a063c6045d71d4588f6e4112e96b0ce632c07d7577dddcbea9898036357c0be9d834ef003d35f0c06b20a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en120514.exe

Filesize
175KB

MD5
04bfd87a52f271e6815e13d8f7e6aa22

SHA1
8c101f52a7b892dacff420a39957580b8ff4607f

SHA256
083b420eada6c7f5561f13380a13e34c84143487500940519281b9bff2d3fc14

SHA512
9b84eb7e95f59bcdb2e7161edb3e9963c3d62dc9f2407ada79ae66c520b2764e1648bfcc6e8d02efa7133ca4714f81fe5cb1d61fef5485a55d83ad60d399911a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en120514.exe

Filesize
175KB

MD5
04bfd87a52f271e6815e13d8f7e6aa22

SHA1
8c101f52a7b892dacff420a39957580b8ff4607f

SHA256
083b420eada6c7f5561f13380a13e34c84143487500940519281b9bff2d3fc14

SHA512
9b84eb7e95f59bcdb2e7161edb3e9963c3d62dc9f2407ada79ae66c520b2764e1648bfcc6e8d02efa7133ca4714f81fe5cb1d61fef5485a55d83ad60d399911a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4280.exe

Filesize
680KB

MD5
f36ba85c10f68e4a679eec1455c0eef8

SHA1
881de0e870f2e58f36f91aa8b14fa506256f5f7a

SHA256
46625bdc72b609bc80149c3df4340d379e39a9b895a1df20cae75c14fd45ca9f

SHA512
022430a05afaf58210f634c00372e5919c0c4a8e9574210eae90d0a15b2135e427c5629c052202c679ba6df9141f49bbd887c58f4a32928514322265a8fd0703

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4280.exe

Filesize
680KB

MD5
f36ba85c10f68e4a679eec1455c0eef8

SHA1
881de0e870f2e58f36f91aa8b14fa506256f5f7a

SHA256
46625bdc72b609bc80149c3df4340d379e39a9b895a1df20cae75c14fd45ca9f

SHA512
022430a05afaf58210f634c00372e5919c0c4a8e9574210eae90d0a15b2135e427c5629c052202c679ba6df9141f49bbd887c58f4a32928514322265a8fd0703

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dKR44s64.exe

Filesize
345KB

MD5
e85b1bb21333246c5f3633348d30a7fe

SHA1
76900c2603bd3a7c4dc3cc88eff9938e4b678054

SHA256
e7e905831b15867869023f5a1ccee0be25a55affb5953e65e393613b731dc594

SHA512
a261e7eb896d87d09eea77d1572989dd61f7511b509a39a0473db538fc2f7a57748bc16acfe075daeeafb765c906bf44f17ab4c9bffb0ff9b102cc635dc6df7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dKR44s64.exe

Filesize
345KB

MD5
e85b1bb21333246c5f3633348d30a7fe

SHA1
76900c2603bd3a7c4dc3cc88eff9938e4b678054

SHA256
e7e905831b15867869023f5a1ccee0be25a55affb5953e65e393613b731dc594

SHA512
a261e7eb896d87d09eea77d1572989dd61f7511b509a39a0473db538fc2f7a57748bc16acfe075daeeafb765c906bf44f17ab4c9bffb0ff9b102cc635dc6df7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina8000.exe

Filesize
345KB

MD5
3a0dce7e4b70f07a7982ada1e501e432

SHA1
d4eda9322a26662a5062acb892c795f56e946b9d

SHA256
b4a439e8147021c4c988a9d52b2ca05aa237857c261db239b25fdf22e35e416c

SHA512
9734e78217cbd766f08b4be812861725126789f638b622bd778c97337f2db02539b527e03c51bb8ad9c4cdce18edf94d031f1d67e80933cfd47f23ae59fd4173

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina8000.exe

Filesize
345KB

MD5
3a0dce7e4b70f07a7982ada1e501e432

SHA1
d4eda9322a26662a5062acb892c795f56e946b9d

SHA256
b4a439e8147021c4c988a9d52b2ca05aa237857c261db239b25fdf22e35e416c

SHA512
9734e78217cbd766f08b4be812861725126789f638b622bd778c97337f2db02539b527e03c51bb8ad9c4cdce18edf94d031f1d67e80933cfd47f23ae59fd4173

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu995257.exe

Filesize
11KB

MD5
146962475a0c6acf46ffea87ba4c02e9

SHA1
bff0c87d6c85fe90ee1cb2704cda1cb2752edc30

SHA256
9cec94f1adb851c4eee77f81214c6b00d2e1418af464e4d62f1ec29de1993250

SHA512
626395f4f288d92b482c6611b188d41febb8441ff96ff8a702a4768ce16cb058bf11bd2eedd4464e42377b0bb67ce6837bf11bfc662e41bf8f6b6513f18e52c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu995257.exe

Filesize
11KB

MD5
146962475a0c6acf46ffea87ba4c02e9

SHA1
bff0c87d6c85fe90ee1cb2704cda1cb2752edc30

SHA256
9cec94f1adb851c4eee77f81214c6b00d2e1418af464e4d62f1ec29de1993250

SHA512
626395f4f288d92b482c6611b188d41febb8441ff96ff8a702a4768ce16cb058bf11bd2eedd4464e42377b0bb67ce6837bf11bfc662e41bf8f6b6513f18e52c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8904.exe

Filesize
291KB

MD5
14466d53f84201e4ce915b92e4b70de1

SHA1
8d7811c4fdc2f1975f33fc532d60688758ed5e46

SHA256
e23947546d69c41c50c7abf9425afbe8387b9a78b7d83aac1f4b0c76fa6732b0

SHA512
5683c55125914bf2cacab13426cec81e8be5ba7bf5ddcd04347b043ac5df974fa027a5b0d36d020e3e9171c4ee764710e77f39da6b7bbcae822158aa94a9636b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8904.exe

Filesize
291KB

MD5
14466d53f84201e4ce915b92e4b70de1

SHA1
8d7811c4fdc2f1975f33fc532d60688758ed5e46

SHA256
e23947546d69c41c50c7abf9425afbe8387b9a78b7d83aac1f4b0c76fa6732b0

SHA512
5683c55125914bf2cacab13426cec81e8be5ba7bf5ddcd04347b043ac5df974fa027a5b0d36d020e3e9171c4ee764710e77f39da6b7bbcae822158aa94a9636b

Download Submit
memory/220-180-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-200-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/220-182-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-184-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-186-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-188-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-190-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-192-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-194-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-196-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-197-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/220-198-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/220-199-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/220-178-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-203-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/220-204-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/220-202-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/220-205-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/220-176-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-174-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-172-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-170-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-169-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/220-168-0x00000000050B0000-0x0000000005654000-memory.dmp

Filesize
5.6MB

Download
memory/220-167-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/1408-215-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-1124-0x0000000007260000-0x00000000072F2000-memory.dmp

Filesize
584KB

Download
memory/1408-227-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-229-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-231-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-233-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-235-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-237-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-239-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-241-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-243-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-362-0x0000000001B30000-0x0000000001B7B000-memory.dmp

Filesize
300KB

Download
memory/1408-364-0x00000000036E0000-0x00000000036F0000-memory.dmp

Filesize
64KB

Download
memory/1408-365-0x00000000036E0000-0x00000000036F0000-memory.dmp

Filesize
64KB

Download
memory/1408-1119-0x0000000006770000-0x0000000006D88000-memory.dmp

Filesize
6.1MB

Download
memory/1408-1120-0x0000000006E10000-0x0000000006F1A000-memory.dmp

Filesize
1.0MB

Download
memory/1408-1122-0x00000000036E0000-0x00000000036F0000-memory.dmp

Filesize
64KB

Download
memory/1408-1121-0x0000000006F50000-0x0000000006F62000-memory.dmp

Filesize
72KB

Download
memory/1408-1123-0x0000000006F70000-0x0000000006FAC000-memory.dmp

Filesize
240KB

Download
memory/1408-225-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-1125-0x0000000007300000-0x0000000007366000-memory.dmp

Filesize
408KB

Download
memory/1408-1127-0x0000000007B20000-0x0000000007CE2000-memory.dmp

Filesize
1.8MB

Download
memory/1408-1128-0x0000000007D00000-0x000000000822C000-memory.dmp

Filesize
5.2MB

Download
memory/1408-1129-0x0000000008360000-0x00000000083D6000-memory.dmp

Filesize
472KB

Download
memory/1408-1132-0x00000000036E0000-0x00000000036F0000-memory.dmp

Filesize
64KB

Download
memory/1408-1133-0x00000000036E0000-0x00000000036F0000-memory.dmp

Filesize
64KB

Download
memory/1408-1131-0x00000000083F0000-0x0000000008440000-memory.dmp

Filesize
320KB

Download
memory/1408-1130-0x00000000036E0000-0x00000000036F0000-memory.dmp

Filesize
64KB

Download
memory/1408-1134-0x00000000036E0000-0x00000000036F0000-memory.dmp

Filesize
64KB

Download
memory/1408-211-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-213-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-210-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-217-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-223-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-221-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/1408-219-0x0000000003870000-0x00000000038AF000-memory.dmp

Filesize
252KB

Download
memory/2184-161-0x0000000000A80000-0x0000000000A8A000-memory.dmp

Filesize
40KB

Download
memory/4916-1142-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4916-1141-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/4916-1140-0x0000000000470000-0x00000000004A2000-memory.dmp

Filesize
200KB

Download