amadey | 71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa

Analysis

max time kernel
92s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe
Size

1.0MB
MD5

9a95ac594b53729fdf45773de79b15c7
SHA1

c4f6baa07febaa1b9b28b581302684732246e7ba
SHA256

71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa
SHA512

a6e62e6a8fc21b60423a90aec170acf88ac96d9e0fd33e2b2644479aa025d8a5f4df7b44b09332f698c506d2529bab5515670012147dc14a339f9356297023f9
SSDEEP

12288:RMruy90xFuOnzyUR3LW7JSdK0adQziL392RiNs69L8GqSuKz3y4Ogr/bzZGlrHz+:zymFuOzx3GOziDIN69L8zSuy3FDzZ8a

Score

10^/10

amadey redline renta rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

renta

176.113.115.145:4125

Attributes

auth_value
359596fd5b36e9925ade4d9a1846bafb

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

cor7402.exebu512569.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor7402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor7402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor7402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor7402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor7402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor7402.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bu512569.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu512569.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu512569.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu512569.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu512569.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu512569.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4812-209-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-210-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-212-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-214-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-216-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-218-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-220-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-223-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-227-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-230-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-232-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-234-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-236-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-238-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-240-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-244-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-242-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/4812-246-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge065010.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	ge065010.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 10 IoCs

Processes:

kina4238.exekina5426.exekina9858.exebu512569.execor7402.exedOg65s44.exeen919005.exege065010.exemetafor.exemetafor.exe

pid	process
3876	kina4238.exe
3452	kina5426.exe
4884	kina9858.exe
3176	bu512569.exe
732	cor7402.exe
4812	dOg65s44.exe
4472	en919005.exe
924	ge065010.exe
4464	metafor.exe
1156	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bu512569.execor7402.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu512569.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor7402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor7402.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kina5426.exekina9858.exe71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exekina4238.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina5426.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina9858.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina9858.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina4238.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina4238.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina5426.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

452 732 WerFault.exe cor7402.exe
4904 4812 WerFault.exe dOg65s44.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4708 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bu512569.execor7402.exedOg65s44.exeen919005.exe

pid process

3176 bu512569.exe
3176 bu512569.exe
732 cor7402.exe
732 cor7402.exe
4812 dOg65s44.exe
4812 dOg65s44.exe
4472 en919005.exe
4472 en919005.exe

pid	pid_target	process	target process
452	732	WerFault.exe	cor7402.exe
4904	4812	WerFault.exe	dOg65s44.exe

pid	process
4708	schtasks.exe

pid	process
3176	bu512569.exe
3176	bu512569.exe
732	cor7402.exe
732	cor7402.exe
4812	dOg65s44.exe
4812	dOg65s44.exe
4472	en919005.exe
4472	en919005.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bu512569.execor7402.exedOg65s44.exeen919005.exe

description	pid	process
Token: SeDebugPrivilege	3176	bu512569.exe
Token: SeDebugPrivilege	732	cor7402.exe
Token: SeDebugPrivilege	4812	dOg65s44.exe
Token: SeDebugPrivilege	4472	en919005.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exekina4238.exekina5426.exekina9858.exege065010.exemetafor.execmd.exe

description	pid	process	target process
PID 3016 wrote to memory of 3876	3016	71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe	kina4238.exe
PID 3016 wrote to memory of 3876	3016	71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe	kina4238.exe
PID 3016 wrote to memory of 3876	3016	71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe	kina4238.exe
PID 3876 wrote to memory of 3452	3876	kina4238.exe	kina5426.exe
PID 3876 wrote to memory of 3452	3876	kina4238.exe	kina5426.exe
PID 3876 wrote to memory of 3452	3876	kina4238.exe	kina5426.exe
PID 3452 wrote to memory of 4884	3452	kina5426.exe	kina9858.exe
PID 3452 wrote to memory of 4884	3452	kina5426.exe	kina9858.exe
PID 3452 wrote to memory of 4884	3452	kina5426.exe	kina9858.exe
PID 4884 wrote to memory of 3176	4884	kina9858.exe	bu512569.exe
PID 4884 wrote to memory of 3176	4884	kina9858.exe	bu512569.exe
PID 4884 wrote to memory of 732	4884	kina9858.exe	cor7402.exe
PID 4884 wrote to memory of 732	4884	kina9858.exe	cor7402.exe
PID 4884 wrote to memory of 732	4884	kina9858.exe	cor7402.exe
PID 3452 wrote to memory of 4812	3452	kina5426.exe	dOg65s44.exe
PID 3452 wrote to memory of 4812	3452	kina5426.exe	dOg65s44.exe
PID 3452 wrote to memory of 4812	3452	kina5426.exe	dOg65s44.exe
PID 3876 wrote to memory of 4472	3876	kina4238.exe	en919005.exe
PID 3876 wrote to memory of 4472	3876	kina4238.exe	en919005.exe
PID 3876 wrote to memory of 4472	3876	kina4238.exe	en919005.exe
PID 3016 wrote to memory of 924	3016	71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe	ge065010.exe
PID 3016 wrote to memory of 924	3016	71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe	ge065010.exe
PID 3016 wrote to memory of 924	3016	71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe	ge065010.exe
PID 924 wrote to memory of 4464	924	ge065010.exe	metafor.exe
PID 924 wrote to memory of 4464	924	ge065010.exe	metafor.exe
PID 924 wrote to memory of 4464	924	ge065010.exe	metafor.exe
PID 4464 wrote to memory of 4708	4464	metafor.exe	schtasks.exe
PID 4464 wrote to memory of 4708	4464	metafor.exe	schtasks.exe
PID 4464 wrote to memory of 4708	4464	metafor.exe	schtasks.exe
PID 4464 wrote to memory of 2760	4464	metafor.exe	cmd.exe
PID 4464 wrote to memory of 2760	4464	metafor.exe	cmd.exe
PID 4464 wrote to memory of 2760	4464	metafor.exe	cmd.exe
PID 2760 wrote to memory of 2168	2760	cmd.exe	cmd.exe
PID 2760 wrote to memory of 2168	2760	cmd.exe	cmd.exe
PID 2760 wrote to memory of 2168	2760	cmd.exe	cmd.exe
PID 2760 wrote to memory of 3324	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 3324	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 3324	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 3664	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 3664	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 3664	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 3456	2760	cmd.exe	cmd.exe
PID 2760 wrote to memory of 3456	2760	cmd.exe	cmd.exe
PID 2760 wrote to memory of 3456	2760	cmd.exe	cmd.exe
PID 2760 wrote to memory of 3732	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 3732	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 3732	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 4776	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 4776	2760	cmd.exe	cacls.exe
PID 2760 wrote to memory of 4776	2760	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe
"C:\Users\Admin\AppData\Local\Temp\71e98d3db312853e96c8e7a372dc3e2d9315842b68425286ad9072f474b1e1fa.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4238.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4238.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina5426.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina5426.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9858.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9858.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu512569.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu512569.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor7402.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor7402.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 1104
        6⤵
        Program crash
        
        PID:452
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dOg65s44.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dOg65s44.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4812
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1580
        5⤵
        Program crash
        
        PID:4904
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en919005.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en919005.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge065010.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge065010.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
    "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4708
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2168
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:N"
        5⤵
        
        PID:3324
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:R" /E
        5⤵
        
        PID:3664
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3456
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:N"
        5⤵
        
        PID:3732
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:R" /E
        5⤵
        
        PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 732 -ip 732
1⤵
PID:100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4812 -ip 4812
1⤵
PID:3868

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:1156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
2ce38e63ea66f3579eb78e63bafe6b39

SHA1
885e2399a1c1712d35e70c7f52844f10924c72e8

SHA256
9bca65c227017cc01f7c332a5db5e3ada8f5945ab000143fa77597d0dbdd7436

SHA512
30e0511ef22ec8ade2a2f319eafa2491fda4d07e6f57c8c1b65c2f410dce1edbc60cf1050ef6c90235b9115feb3b2a20cf21ed54b87d001f0d866014492a441e

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
2ce38e63ea66f3579eb78e63bafe6b39

SHA1
885e2399a1c1712d35e70c7f52844f10924c72e8

SHA256
9bca65c227017cc01f7c332a5db5e3ada8f5945ab000143fa77597d0dbdd7436

SHA512
30e0511ef22ec8ade2a2f319eafa2491fda4d07e6f57c8c1b65c2f410dce1edbc60cf1050ef6c90235b9115feb3b2a20cf21ed54b87d001f0d866014492a441e

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
2ce38e63ea66f3579eb78e63bafe6b39

SHA1
885e2399a1c1712d35e70c7f52844f10924c72e8

SHA256
9bca65c227017cc01f7c332a5db5e3ada8f5945ab000143fa77597d0dbdd7436

SHA512
30e0511ef22ec8ade2a2f319eafa2491fda4d07e6f57c8c1b65c2f410dce1edbc60cf1050ef6c90235b9115feb3b2a20cf21ed54b87d001f0d866014492a441e

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
2ce38e63ea66f3579eb78e63bafe6b39

SHA1
885e2399a1c1712d35e70c7f52844f10924c72e8

SHA256
9bca65c227017cc01f7c332a5db5e3ada8f5945ab000143fa77597d0dbdd7436

SHA512
30e0511ef22ec8ade2a2f319eafa2491fda4d07e6f57c8c1b65c2f410dce1edbc60cf1050ef6c90235b9115feb3b2a20cf21ed54b87d001f0d866014492a441e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge065010.exe

Filesize
227KB

MD5
2ce38e63ea66f3579eb78e63bafe6b39

SHA1
885e2399a1c1712d35e70c7f52844f10924c72e8

SHA256
9bca65c227017cc01f7c332a5db5e3ada8f5945ab000143fa77597d0dbdd7436

SHA512
30e0511ef22ec8ade2a2f319eafa2491fda4d07e6f57c8c1b65c2f410dce1edbc60cf1050ef6c90235b9115feb3b2a20cf21ed54b87d001f0d866014492a441e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge065010.exe

Filesize
227KB

MD5
2ce38e63ea66f3579eb78e63bafe6b39

SHA1
885e2399a1c1712d35e70c7f52844f10924c72e8

SHA256
9bca65c227017cc01f7c332a5db5e3ada8f5945ab000143fa77597d0dbdd7436

SHA512
30e0511ef22ec8ade2a2f319eafa2491fda4d07e6f57c8c1b65c2f410dce1edbc60cf1050ef6c90235b9115feb3b2a20cf21ed54b87d001f0d866014492a441e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4238.exe

Filesize
846KB

MD5
662359f159956b8e43c8a65155611f6b

SHA1
5416643d73ce11d409e21e6c231a38cd91151f28

SHA256
0281bae87ddfe94cfaafb3d0e1b31f730127212833f7ed996c5e57335f5077d4

SHA512
80568d9000b17eae2fb9d86a56e01eaf02d1f9e5fd41b5eadd093a993abffe9cef1ed426c4b738d567d4a87b2cb8c53ed4e6fb2052f7713bbdd318e16ad4afd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4238.exe

Filesize
846KB

MD5
662359f159956b8e43c8a65155611f6b

SHA1
5416643d73ce11d409e21e6c231a38cd91151f28

SHA256
0281bae87ddfe94cfaafb3d0e1b31f730127212833f7ed996c5e57335f5077d4

SHA512
80568d9000b17eae2fb9d86a56e01eaf02d1f9e5fd41b5eadd093a993abffe9cef1ed426c4b738d567d4a87b2cb8c53ed4e6fb2052f7713bbdd318e16ad4afd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en919005.exe

Filesize
175KB

MD5
703739c121382abeade0b62eb8da579e

SHA1
d18b224a8730649a0108adf15210ce4b0790ad0f

SHA256
8d81eb51950bb421d11ad6dcb454f4d3de702d9fa0b053ee2d27bc5a53bce537

SHA512
12a2c4c62c04fdcff1073930c44b9c2568aac5831fa6c0540b212bff5ce4e1b218cbb30d2b70e51bc4d01117077a6fcc95d9c6a2df4c13dad4f7b24e791eebf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en919005.exe

Filesize
175KB

MD5
703739c121382abeade0b62eb8da579e

SHA1
d18b224a8730649a0108adf15210ce4b0790ad0f

SHA256
8d81eb51950bb421d11ad6dcb454f4d3de702d9fa0b053ee2d27bc5a53bce537

SHA512
12a2c4c62c04fdcff1073930c44b9c2568aac5831fa6c0540b212bff5ce4e1b218cbb30d2b70e51bc4d01117077a6fcc95d9c6a2df4c13dad4f7b24e791eebf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina5426.exe

Filesize
704KB

MD5
c13d8d4f18e503cba4bb033bcba0b604

SHA1
f02ddd0e39c5add5c70f76e255b5a2472df8da12

SHA256
cc93147005c3d94224755fb8582a17f12c231bfad85c7b18d546234bbe8712df

SHA512
9cb1f0d67f3fbee344e687d5351c6159f75207fbe158dff9c693ce47758d994bda3001a183fd7f0417c590daa835689a2e03152838c4927e6591e1e779336ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina5426.exe

Filesize
704KB

MD5
c13d8d4f18e503cba4bb033bcba0b604

SHA1
f02ddd0e39c5add5c70f76e255b5a2472df8da12

SHA256
cc93147005c3d94224755fb8582a17f12c231bfad85c7b18d546234bbe8712df

SHA512
9cb1f0d67f3fbee344e687d5351c6159f75207fbe158dff9c693ce47758d994bda3001a183fd7f0417c590daa835689a2e03152838c4927e6591e1e779336ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dOg65s44.exe

Filesize
379KB

MD5
c493feea46cdfafeabde8927ac95285e

SHA1
8936764be36f174c3fe900f649f452b2dd64d4a7

SHA256
750c533ab17abe50259555695bd7317fc6e4a51f4ad0cb9e008ba76bb1514320

SHA512
00ca15a9f5931f64d32dd428430cf2cedca2d62544b4e341ec2ccebfa40d683e15786bf036de4e0c6f3ade297cfab0b9ce26d0140a3632a52c026cef0ea20301

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dOg65s44.exe

Filesize
379KB

MD5
c493feea46cdfafeabde8927ac95285e

SHA1
8936764be36f174c3fe900f649f452b2dd64d4a7

SHA256
750c533ab17abe50259555695bd7317fc6e4a51f4ad0cb9e008ba76bb1514320

SHA512
00ca15a9f5931f64d32dd428430cf2cedca2d62544b4e341ec2ccebfa40d683e15786bf036de4e0c6f3ade297cfab0b9ce26d0140a3632a52c026cef0ea20301

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9858.exe

Filesize
349KB

MD5
89fe3e68531f8f79e3d4da6e8e2611eb

SHA1
add62bb63a8a2d0d8f54745d1810d4566346c724

SHA256
692a0ff3b5fef6972bf6c03fac7f9aeee1fe9cf5698bffd457e88f5802b4a1d5

SHA512
249078775e8e9b6da3eef08c4deebaf7a42a6e5cb7aee4d18a513d3bd4884a9d1d6fd3e300506427f1ce69b57e8d21763a6f8d5b763e569f80679c308224096e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9858.exe

Filesize
349KB

MD5
89fe3e68531f8f79e3d4da6e8e2611eb

SHA1
add62bb63a8a2d0d8f54745d1810d4566346c724

SHA256
692a0ff3b5fef6972bf6c03fac7f9aeee1fe9cf5698bffd457e88f5802b4a1d5

SHA512
249078775e8e9b6da3eef08c4deebaf7a42a6e5cb7aee4d18a513d3bd4884a9d1d6fd3e300506427f1ce69b57e8d21763a6f8d5b763e569f80679c308224096e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu512569.exe

Filesize
11KB

MD5
3f4a7169268f120eee5647e72569b7ac

SHA1
1b84e23142b6b9a2686b891d575b683772fde50a

SHA256
82f20b18adfee2fd76a73fad5c4f4ba76aaa57a668acd266cda19a0f2886bb2f

SHA512
c7c5c4ee269e5768de57564b750c3243bc1d7ab086a624ed779a502380ed652b5cf4b5168b6c42ac7f9c01aa6f0b6603427dab9c7ce3daa6ea98d6756632e9af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu512569.exe

Filesize
11KB

MD5
3f4a7169268f120eee5647e72569b7ac

SHA1
1b84e23142b6b9a2686b891d575b683772fde50a

SHA256
82f20b18adfee2fd76a73fad5c4f4ba76aaa57a668acd266cda19a0f2886bb2f

SHA512
c7c5c4ee269e5768de57564b750c3243bc1d7ab086a624ed779a502380ed652b5cf4b5168b6c42ac7f9c01aa6f0b6603427dab9c7ce3daa6ea98d6756632e9af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor7402.exe

Filesize
322KB

MD5
0489f889f1ab297221d95568508384f6

SHA1
8433709090e8a95f529d86e9ace9c90e51f37df6

SHA256
75ee4b30c638aebdd3fe5606d6d39c44d2088d7316d0f9b037d91d2b479116fe

SHA512
ea6dfc11c01d0dae8ac68344c56e413d726b62a75bc04bba0731c606133db60d818497cba44f586df1f6e192b43eb4defe0daeee2f3e868db034eb9006addb3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor7402.exe

Filesize
322KB

MD5
0489f889f1ab297221d95568508384f6

SHA1
8433709090e8a95f529d86e9ace9c90e51f37df6

SHA256
75ee4b30c638aebdd3fe5606d6d39c44d2088d7316d0f9b037d91d2b479116fe

SHA512
ea6dfc11c01d0dae8ac68344c56e413d726b62a75bc04bba0731c606133db60d818497cba44f586df1f6e192b43eb4defe0daeee2f3e868db034eb9006addb3f

Download Submit
memory/732-185-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-200-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/732-183-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-181-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-177-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-187-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-189-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-191-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-193-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-195-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-197-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-198-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/732-199-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/732-179-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-202-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/732-203-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/732-204-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/732-167-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

Filesize
180KB

Download
memory/732-175-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-171-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-173-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-170-0x0000000007230000-0x0000000007242000-memory.dmp

Filesize
72KB

Download
memory/732-169-0x0000000007370000-0x0000000007914000-memory.dmp

Filesize
5.6MB

Download
memory/732-168-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3176-161-0x00000000001D0000-0x00000000001DA000-memory.dmp

Filesize
40KB

Download
memory/4472-1142-0x00000000056D0000-0x00000000056E0000-memory.dmp

Filesize
64KB

Download
memory/4472-1141-0x00000000056D0000-0x00000000056E0000-memory.dmp

Filesize
64KB

Download
memory/4472-1140-0x0000000000DF0000-0x0000000000E22000-memory.dmp

Filesize
200KB

Download
memory/4812-216-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-226-0x0000000007100000-0x0000000007110000-memory.dmp

Filesize
64KB

Download
memory/4812-228-0x0000000007100000-0x0000000007110000-memory.dmp

Filesize
64KB

Download
memory/4812-230-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-232-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-234-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-236-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-238-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-240-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-244-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-242-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-246-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-1119-0x0000000007790000-0x0000000007DA8000-memory.dmp

Filesize
6.1MB

Download
memory/4812-1120-0x0000000007E30000-0x0000000007F3A000-memory.dmp

Filesize
1.0MB

Download
memory/4812-1121-0x0000000007100000-0x0000000007110000-memory.dmp

Filesize
64KB

Download
memory/4812-1122-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/4812-1123-0x0000000007F90000-0x0000000007FCC000-memory.dmp

Filesize
240KB

Download
memory/4812-1125-0x0000000008280000-0x0000000008312000-memory.dmp

Filesize
584KB

Download
memory/4812-1126-0x0000000008320000-0x0000000008386000-memory.dmp

Filesize
408KB

Download
memory/4812-1127-0x0000000008A20000-0x0000000008A96000-memory.dmp

Filesize
472KB

Download
memory/4812-1128-0x0000000008AB0000-0x0000000008B00000-memory.dmp

Filesize
320KB

Download
memory/4812-1129-0x0000000007100000-0x0000000007110000-memory.dmp

Filesize
64KB

Download
memory/4812-1130-0x0000000007100000-0x0000000007110000-memory.dmp

Filesize
64KB

Download
memory/4812-1131-0x0000000007100000-0x0000000007110000-memory.dmp

Filesize
64KB

Download
memory/4812-1132-0x0000000008D60000-0x0000000008F22000-memory.dmp

Filesize
1.8MB

Download
memory/4812-1133-0x0000000008F40000-0x000000000946C000-memory.dmp

Filesize
5.2MB

Download
memory/4812-227-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-222-0x0000000002B90000-0x0000000002BDB000-memory.dmp

Filesize
300KB

Download
memory/4812-225-0x0000000007100000-0x0000000007110000-memory.dmp

Filesize
64KB

Download
memory/4812-223-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-220-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-218-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-214-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-212-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-210-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-209-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/4812-1134-0x0000000007100000-0x0000000007110000-memory.dmp

Filesize
64KB

Download