amadey | 8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6

Analysis

max time kernel
100s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe
Size

1004KB
MD5

2ebe8186344cb611cfef5028af04fb7a
SHA1

53e8a17bcff93c244f0230c91b7e23fbd737b192
SHA256

8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6
SHA512

42b98ad66c3570d8e21fc24a23bd989dd2c467b22a162a0115443dc0a978056809adf828e1a1b70e6127834ba9d892202c25aca0fb3ff478d1fe8f834e9c8048
SSDEEP

24576:HyhxSvPOyMombTdYpOnbjSCtpMAWolnaktIIBvAXbn+:ShkXb4bTd2EjpM2VqIB

Score

10^/10

amadey redline renta rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

renta

176.113.115.145:4125

Attributes

auth_value
359596fd5b36e9925ade4d9a1846bafb

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

bu597770.execor8980.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bu597770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu597770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu597770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu597770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor8980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor8980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu597770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu597770.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor8980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor8980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor8980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor8980.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2864-210-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-213-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-211-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-215-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-217-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-219-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-221-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-223-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-225-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-227-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-229-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-231-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-233-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-235-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-237-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-239-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-242-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-246-0x00000000065A0000-0x00000000065DF000-memory.dmp	family_redline
behavioral1/memory/2864-1129-0x0000000005FA0000-0x0000000005FB0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge096203.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	ge096203.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 10 IoCs

Processes:

kina2028.exekina0301.exekina6442.exebu597770.execor8980.exedsb60s64.exeen404029.exege096203.exemetafor.exemetafor.exe

pid	process
3400	kina2028.exe
1476	kina0301.exe
4644	kina6442.exe
3796	bu597770.exe
2704	cor8980.exe
2864	dsb60s64.exe
4212	en404029.exe
5104	ge096203.exe
5060	metafor.exe
3080	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

cor8980.exebu597770.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor8980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor8980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu597770.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exekina2028.exekina0301.exekina6442.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina2028.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina2028.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina0301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina0301.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina6442.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina6442.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3648 2704 WerFault.exe cor8980.exe
3576 2864 WerFault.exe dsb60s64.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3396 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bu597770.execor8980.exedsb60s64.exeen404029.exe

pid process

3796 bu597770.exe
3796 bu597770.exe
2704 cor8980.exe
2704 cor8980.exe
2864 dsb60s64.exe
2864 dsb60s64.exe
4212 en404029.exe
4212 en404029.exe

pid	pid_target	process	target process
3648	2704	WerFault.exe	cor8980.exe
3576	2864	WerFault.exe	dsb60s64.exe

pid	process
3396	schtasks.exe

pid	process
3796	bu597770.exe
3796	bu597770.exe
2704	cor8980.exe
2704	cor8980.exe
2864	dsb60s64.exe
2864	dsb60s64.exe
4212	en404029.exe
4212	en404029.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bu597770.execor8980.exedsb60s64.exeen404029.exe

description	pid	process
Token: SeDebugPrivilege	3796	bu597770.exe
Token: SeDebugPrivilege	2704	cor8980.exe
Token: SeDebugPrivilege	2864	dsb60s64.exe
Token: SeDebugPrivilege	4212	en404029.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exekina2028.exekina0301.exekina6442.exege096203.exemetafor.execmd.exe

description	pid	process	target process
PID 4388 wrote to memory of 3400	4388	8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe	kina2028.exe
PID 4388 wrote to memory of 3400	4388	8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe	kina2028.exe
PID 4388 wrote to memory of 3400	4388	8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe	kina2028.exe
PID 3400 wrote to memory of 1476	3400	kina2028.exe	kina0301.exe
PID 3400 wrote to memory of 1476	3400	kina2028.exe	kina0301.exe
PID 3400 wrote to memory of 1476	3400	kina2028.exe	kina0301.exe
PID 1476 wrote to memory of 4644	1476	kina0301.exe	kina6442.exe
PID 1476 wrote to memory of 4644	1476	kina0301.exe	kina6442.exe
PID 1476 wrote to memory of 4644	1476	kina0301.exe	kina6442.exe
PID 4644 wrote to memory of 3796	4644	kina6442.exe	bu597770.exe
PID 4644 wrote to memory of 3796	4644	kina6442.exe	bu597770.exe
PID 4644 wrote to memory of 2704	4644	kina6442.exe	cor8980.exe
PID 4644 wrote to memory of 2704	4644	kina6442.exe	cor8980.exe
PID 4644 wrote to memory of 2704	4644	kina6442.exe	cor8980.exe
PID 1476 wrote to memory of 2864	1476	kina0301.exe	dsb60s64.exe
PID 1476 wrote to memory of 2864	1476	kina0301.exe	dsb60s64.exe
PID 1476 wrote to memory of 2864	1476	kina0301.exe	dsb60s64.exe
PID 3400 wrote to memory of 4212	3400	kina2028.exe	en404029.exe
PID 3400 wrote to memory of 4212	3400	kina2028.exe	en404029.exe
PID 3400 wrote to memory of 4212	3400	kina2028.exe	en404029.exe
PID 4388 wrote to memory of 5104	4388	8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe	ge096203.exe
PID 4388 wrote to memory of 5104	4388	8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe	ge096203.exe
PID 4388 wrote to memory of 5104	4388	8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe	ge096203.exe
PID 5104 wrote to memory of 5060	5104	ge096203.exe	metafor.exe
PID 5104 wrote to memory of 5060	5104	ge096203.exe	metafor.exe
PID 5104 wrote to memory of 5060	5104	ge096203.exe	metafor.exe
PID 5060 wrote to memory of 3396	5060	metafor.exe	schtasks.exe
PID 5060 wrote to memory of 3396	5060	metafor.exe	schtasks.exe
PID 5060 wrote to memory of 3396	5060	metafor.exe	schtasks.exe
PID 5060 wrote to memory of 1608	5060	metafor.exe	cmd.exe
PID 5060 wrote to memory of 1608	5060	metafor.exe	cmd.exe
PID 5060 wrote to memory of 1608	5060	metafor.exe	cmd.exe
PID 1608 wrote to memory of 4716	1608	cmd.exe	cmd.exe
PID 1608 wrote to memory of 4716	1608	cmd.exe	cmd.exe
PID 1608 wrote to memory of 4716	1608	cmd.exe	cmd.exe
PID 1608 wrote to memory of 4404	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 4404	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 4404	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 4632	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 4632	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 4632	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 1772	1608	cmd.exe	cmd.exe
PID 1608 wrote to memory of 1772	1608	cmd.exe	cmd.exe
PID 1608 wrote to memory of 1772	1608	cmd.exe	cmd.exe
PID 1608 wrote to memory of 1112	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 1112	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 1112	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 4112	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 4112	1608	cmd.exe	cacls.exe
PID 1608 wrote to memory of 4112	1608	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe
"C:\Users\Admin\AppData\Local\Temp\8be954f5dcaa944fd2caaefdb6a0675ee5581dd9cd53aa784076f1ec3e4ba5e6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4388

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2028.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2028.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3400

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0301.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0301.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1476

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6442.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6442.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4644

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu597770.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu597770.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8980.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8980.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1092
6⤵
- Program crash
PID:3648

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dsb60s64.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dsb60s64.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 1316
5⤵
- Program crash
PID:3576

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en404029.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en404029.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge096203.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge096203.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
4⤵
- Creates scheduled task(s)
PID:3396

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4716

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:N"
5⤵
PID:4404

C:\Windows\SysWOW64\cacls.exe
CACLS "metafor.exe" /P "Admin:R" /E
5⤵
PID:4632

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1772

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:N"
5⤵
PID:1112

C:\Windows\SysWOW64\cacls.exe
CACLS "..\5975271bda" /P "Admin:R" /E
5⤵
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2704 -ip 2704
1⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2864 -ip 2864
1⤵
PID:1524

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:3080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
227KB

MD5
68fa0884c396703405ccf54d40d38e32

SHA1
06e4b54d0c64bd50bbf0c1a6d1834a2bf4a8bec8

SHA256
213ee70e299c6e7c41d5940791fdae0c4d75f2c574164f180c3034dc40b7327c

SHA512
e27f436e35b5bac3cd87f4a94cda691b015bd1a1d734b60c66bf8ce9c6c807efb4e5c86eba95cb0b0e8c54f2ecda982e7ce277eaa12f8c32539048a3056091ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
227KB

MD5
68fa0884c396703405ccf54d40d38e32

SHA1
06e4b54d0c64bd50bbf0c1a6d1834a2bf4a8bec8

SHA256
213ee70e299c6e7c41d5940791fdae0c4d75f2c574164f180c3034dc40b7327c

SHA512
e27f436e35b5bac3cd87f4a94cda691b015bd1a1d734b60c66bf8ce9c6c807efb4e5c86eba95cb0b0e8c54f2ecda982e7ce277eaa12f8c32539048a3056091ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
227KB

MD5
68fa0884c396703405ccf54d40d38e32

SHA1
06e4b54d0c64bd50bbf0c1a6d1834a2bf4a8bec8

SHA256
213ee70e299c6e7c41d5940791fdae0c4d75f2c574164f180c3034dc40b7327c

SHA512
e27f436e35b5bac3cd87f4a94cda691b015bd1a1d734b60c66bf8ce9c6c807efb4e5c86eba95cb0b0e8c54f2ecda982e7ce277eaa12f8c32539048a3056091ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
Filesize
227KB

MD5
68fa0884c396703405ccf54d40d38e32

SHA1
06e4b54d0c64bd50bbf0c1a6d1834a2bf4a8bec8

SHA256
213ee70e299c6e7c41d5940791fdae0c4d75f2c574164f180c3034dc40b7327c

SHA512
e27f436e35b5bac3cd87f4a94cda691b015bd1a1d734b60c66bf8ce9c6c807efb4e5c86eba95cb0b0e8c54f2ecda982e7ce277eaa12f8c32539048a3056091ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge096203.exe
Filesize
227KB

MD5
68fa0884c396703405ccf54d40d38e32

SHA1
06e4b54d0c64bd50bbf0c1a6d1834a2bf4a8bec8

SHA256
213ee70e299c6e7c41d5940791fdae0c4d75f2c574164f180c3034dc40b7327c

SHA512
e27f436e35b5bac3cd87f4a94cda691b015bd1a1d734b60c66bf8ce9c6c807efb4e5c86eba95cb0b0e8c54f2ecda982e7ce277eaa12f8c32539048a3056091ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge096203.exe
Filesize
227KB

MD5
68fa0884c396703405ccf54d40d38e32

SHA1
06e4b54d0c64bd50bbf0c1a6d1834a2bf4a8bec8

SHA256
213ee70e299c6e7c41d5940791fdae0c4d75f2c574164f180c3034dc40b7327c

SHA512
e27f436e35b5bac3cd87f4a94cda691b015bd1a1d734b60c66bf8ce9c6c807efb4e5c86eba95cb0b0e8c54f2ecda982e7ce277eaa12f8c32539048a3056091ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2028.exe
Filesize
822KB

MD5
ae74e08344c2b994b3936033e6c6f11f

SHA1
015daa052dc95ea853f780abbc7dd97c351484be

SHA256
117809892c812f431d028c6659437a28b391da6aa2c2c3151af47a82c6660bbf

SHA512
6ec6ce11431395aae8b3fe54c088ab14f9ceffe0382938e256f1c8d1eb1c17449f917cf53565d5c88657915fb7c38931a044bf6d3929bc33df8ed515de88b236

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2028.exe
Filesize
822KB

MD5
ae74e08344c2b994b3936033e6c6f11f

SHA1
015daa052dc95ea853f780abbc7dd97c351484be

SHA256
117809892c812f431d028c6659437a28b391da6aa2c2c3151af47a82c6660bbf

SHA512
6ec6ce11431395aae8b3fe54c088ab14f9ceffe0382938e256f1c8d1eb1c17449f917cf53565d5c88657915fb7c38931a044bf6d3929bc33df8ed515de88b236

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en404029.exe
Filesize
175KB

MD5
43ce804e63cacb957231fdb1b0366c2c

SHA1
ca74f5dbdeffa559cdc7801eecd8e9267cab816d

SHA256
aa62a9c6d3fc575dc0eba06f76915f6ea3ec31bdc848a809c9fa15a0491342c0

SHA512
d587cf849bb0c5e0dd258d08bf9111fb7cd6f51ecac47fc8a5937d101f84750cae5f74f818d4eb2bf35a2fcd23ff97ac7f2744ca0553cd5f79faf8bd3ecb65c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en404029.exe
Filesize
175KB

MD5
43ce804e63cacb957231fdb1b0366c2c

SHA1
ca74f5dbdeffa559cdc7801eecd8e9267cab816d

SHA256
aa62a9c6d3fc575dc0eba06f76915f6ea3ec31bdc848a809c9fa15a0491342c0

SHA512
d587cf849bb0c5e0dd258d08bf9111fb7cd6f51ecac47fc8a5937d101f84750cae5f74f818d4eb2bf35a2fcd23ff97ac7f2744ca0553cd5f79faf8bd3ecb65c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0301.exe
Filesize
680KB

MD5
3599f5c07cf835cc1df799f17eaf1195

SHA1
8803f591e041383bca1463b93f611856ffdc5353

SHA256
f9848194784cd5cc77f7ce2f93858bb3513ac6eba31063f09e5cd8c30fafe7c2

SHA512
ddaaee2cc1bef63752cefaecd7f1fbd231e17f8351200f183ade9631e475192a70c4b09cae905429d5e96b0216966850558c6bbac045d67e82dfa178742c31cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0301.exe
Filesize
680KB

MD5
3599f5c07cf835cc1df799f17eaf1195

SHA1
8803f591e041383bca1463b93f611856ffdc5353

SHA256
f9848194784cd5cc77f7ce2f93858bb3513ac6eba31063f09e5cd8c30fafe7c2

SHA512
ddaaee2cc1bef63752cefaecd7f1fbd231e17f8351200f183ade9631e475192a70c4b09cae905429d5e96b0216966850558c6bbac045d67e82dfa178742c31cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dsb60s64.exe
Filesize
345KB

MD5
db70f1adce1cc9ae780fb899bedc69be

SHA1
22e219eaaab4f50eceb9a7b8e3f328552c59e551

SHA256
ad70f0bcbf96b26e025d412e39530ec51ad06481099340887a575273915d0b4f

SHA512
cae45e49312a1c1f1274689b9bfe8de7646fa5c110e5e1f35b0f5d4e7d3d44fafa9294362e907260574d0f7ce7f78c3bf6820520cebe3fccff718fce322aeb23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dsb60s64.exe
Filesize
345KB

MD5
db70f1adce1cc9ae780fb899bedc69be

SHA1
22e219eaaab4f50eceb9a7b8e3f328552c59e551

SHA256
ad70f0bcbf96b26e025d412e39530ec51ad06481099340887a575273915d0b4f

SHA512
cae45e49312a1c1f1274689b9bfe8de7646fa5c110e5e1f35b0f5d4e7d3d44fafa9294362e907260574d0f7ce7f78c3bf6820520cebe3fccff718fce322aeb23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6442.exe
Filesize
345KB

MD5
706eaa05451449025e9c080ba9d68c96

SHA1
816fb0c86f3cad0e9ceb1a4508ea1dbb71c5f35c

SHA256
b62e4b70a0e503466861b8dbb486066883d55da2991d7a328457fad9c775ba77

SHA512
a8d68d676a44f91b1a75849e52eb34f06423fd72524b82d2a5148d97b42a9b479b35cea7a8b5895a9aff05e3afbc4b6efd7552168bac4d9d47a56798f1b0c382

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6442.exe
Filesize
345KB

MD5
706eaa05451449025e9c080ba9d68c96

SHA1
816fb0c86f3cad0e9ceb1a4508ea1dbb71c5f35c

SHA256
b62e4b70a0e503466861b8dbb486066883d55da2991d7a328457fad9c775ba77

SHA512
a8d68d676a44f91b1a75849e52eb34f06423fd72524b82d2a5148d97b42a9b479b35cea7a8b5895a9aff05e3afbc4b6efd7552168bac4d9d47a56798f1b0c382

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu597770.exe
Filesize
11KB

MD5
5f64a2a01f57d248a6700e99b52972be

SHA1
147f67db162b54184348d1096d2912e27dd1532a

SHA256
961d4613d76102325b4addbb61b225a465af385bfaa252a636a4d76a62f16f4d

SHA512
e46ab5416202628054e49c45bd6652a48b8f718a32957b7e5c5f055c3b207ec0b16a8c4343873a9353895486f637796ad32f253453410414df53aec10db1e996

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu597770.exe
Filesize
11KB

MD5
5f64a2a01f57d248a6700e99b52972be

SHA1
147f67db162b54184348d1096d2912e27dd1532a

SHA256
961d4613d76102325b4addbb61b225a465af385bfaa252a636a4d76a62f16f4d

SHA512
e46ab5416202628054e49c45bd6652a48b8f718a32957b7e5c5f055c3b207ec0b16a8c4343873a9353895486f637796ad32f253453410414df53aec10db1e996

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8980.exe
Filesize
291KB

MD5
87731bb730f15a5eb84353852c4d5e1d

SHA1
08eb4ed7ca3b660f39e891121d74d631ea627cf1

SHA256
8e13e67878f58d05cf7f04b93d32a9303efde1e21ad7d2ab2c5b256c3b9b91c7

SHA512
7ecc0d1b1b051529791c662c75f388ea9f80a0e320109ac1c5cd2019a1e7d912bad84291f750da9a8d8056e3cff74c85938c4ede90abb2c60a881dfc0af35914

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8980.exe
Filesize
291KB

MD5
87731bb730f15a5eb84353852c4d5e1d

SHA1
08eb4ed7ca3b660f39e891121d74d631ea627cf1

SHA256
8e13e67878f58d05cf7f04b93d32a9303efde1e21ad7d2ab2c5b256c3b9b91c7

SHA512
7ecc0d1b1b051529791c662c75f388ea9f80a0e320109ac1c5cd2019a1e7d912bad84291f750da9a8d8056e3cff74c85938c4ede90abb2c60a881dfc0af35914

Download Submit
memory/2704-182-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-200-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2704-178-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-185-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-184-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/2704-186-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/2704-189-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-188-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/2704-191-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-193-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-195-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-197-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-199-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-180-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-201-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/2704-202-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/2704-203-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/2704-205-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2704-176-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-174-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-172-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-170-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-169-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/2704-168-0x0000000004DF0000-0x0000000005394000-memory.dmp

Filesize
5.6MB

Download
memory/2704-167-0x00000000007F0000-0x000000000081D000-memory.dmp

Filesize
180KB

Download
memory/2864-217-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-1124-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Filesize
64KB

Download
memory/2864-227-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-229-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-231-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-233-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-235-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-237-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-239-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-242-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-241-0x0000000001A30000-0x0000000001A7B000-memory.dmp

Filesize
300KB

Download
memory/2864-243-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Filesize
64KB

Download
memory/2864-245-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Filesize
64KB

Download
memory/2864-246-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-248-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Filesize
64KB

Download
memory/2864-1120-0x0000000006770000-0x0000000006D88000-memory.dmp

Filesize
6.1MB

Download
memory/2864-1121-0x0000000006E10000-0x0000000006F1A000-memory.dmp

Filesize
1.0MB

Download
memory/2864-1122-0x0000000006F50000-0x0000000006F62000-memory.dmp

Filesize
72KB

Download
memory/2864-1123-0x0000000006F70000-0x0000000006FAC000-memory.dmp

Filesize
240KB

Download
memory/2864-225-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-1125-0x0000000007260000-0x00000000072C6000-memory.dmp

Filesize
408KB

Download
memory/2864-1126-0x0000000007930000-0x00000000079C2000-memory.dmp

Filesize
584KB

Download
memory/2864-1128-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Filesize
64KB

Download
memory/2864-1129-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Filesize
64KB

Download
memory/2864-1130-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Filesize
64KB

Download
memory/2864-1131-0x0000000007B20000-0x0000000007CE2000-memory.dmp

Filesize
1.8MB

Download
memory/2864-1132-0x0000000007D00000-0x000000000822C000-memory.dmp

Filesize
5.2MB

Download
memory/2864-1133-0x0000000008350000-0x00000000083C6000-memory.dmp

Filesize
472KB

Download
memory/2864-1134-0x00000000083F0000-0x0000000008440000-memory.dmp

Filesize
320KB

Download
memory/2864-223-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-1135-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Filesize
64KB

Download
memory/2864-210-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-213-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-211-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-221-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-219-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/2864-215-0x00000000065A0000-0x00000000065DF000-memory.dmp

Filesize
252KB

Download
memory/3796-161-0x0000000000950000-0x000000000095A000-memory.dmp

Filesize
40KB

Download
memory/4212-1142-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/4212-1141-0x0000000000F70000-0x0000000000FA2000-memory.dmp

Filesize
200KB

Download