amadey | 2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621

Analysis

max time kernel
95s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe
Size

1.0MB
MD5

03091751ca94a24190fb3519b9222729
SHA1

be0939d65c17852032c3bf7dcabe6b38d25fef65
SHA256

2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621
SHA512

85415e405a4cda7cf99ad05102a842377cff4579a6b87ec3fbb7299f97768cf4df351a8fe7adbcff337b6eea19a62579bb6b5d0cd1ec5d379911e7c23971beff
SSDEEP

24576:RyoyC2v2rn4XpyXx6jME7Ww51b3WMWKMomTL6O74h:ElCT4XYEgtwjb3qKMFLu

Score

10^/10

amadey redline renta rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

renta

176.113.115.145:4125

Attributes

auth_value
359596fd5b36e9925ade4d9a1846bafb

Extracted

Family

amadey

Version

3.68

31.41.244.200/games/category/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

bu294602.execor9478.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bu294602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu294602.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor9478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor9478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor9478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu294602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu294602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu294602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu294602.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor9478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor9478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor9478.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4980-213-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-215-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-217-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-219-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-221-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-223-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-225-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-227-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-229-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-231-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-233-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-235-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-237-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-239-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-241-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-243-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-245-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/4980-247-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ge394942.exemetafor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	ge394942.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	metafor.exe

Executes dropped EXE 10 IoCs

Processes:

kina4053.exekina8550.exekina2520.exebu294602.execor9478.exedei99s18.exeen269242.exege394942.exemetafor.exemetafor.exe

pid	process
220	kina4053.exe
4704	kina8550.exe
4008	kina2520.exe
3836	bu294602.exe
2148	cor9478.exe
4980	dei99s18.exe
2608	en269242.exe
2132	ge394942.exe
3376	metafor.exe
3144	metafor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bu294602.execor9478.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu294602.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor9478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor9478.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exekina4053.exekina8550.exekina2520.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina4053.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina4053.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina8550.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina8550.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina2520.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina2520.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2968 2148 WerFault.exe cor9478.exe
704 4980 WerFault.exe dei99s18.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3420 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

bu294602.execor9478.exedei99s18.exeen269242.exe

pid process

3836 bu294602.exe
3836 bu294602.exe
2148 cor9478.exe
2148 cor9478.exe
4980 dei99s18.exe
4980 dei99s18.exe
2608 en269242.exe
2608 en269242.exe

pid	pid_target	process	target process
2968	2148	WerFault.exe	cor9478.exe
704	4980	WerFault.exe	dei99s18.exe

pid	process
3420	schtasks.exe

pid	process
3836	bu294602.exe
3836	bu294602.exe
2148	cor9478.exe
2148	cor9478.exe
4980	dei99s18.exe
4980	dei99s18.exe
2608	en269242.exe
2608	en269242.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bu294602.execor9478.exedei99s18.exeen269242.exe

description	pid	process
Token: SeDebugPrivilege	3836	bu294602.exe
Token: SeDebugPrivilege	2148	cor9478.exe
Token: SeDebugPrivilege	4980	dei99s18.exe
Token: SeDebugPrivilege	2608	en269242.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exekina4053.exekina8550.exekina2520.exege394942.exemetafor.execmd.exe

description	pid	process	target process
PID 2492 wrote to memory of 220	2492	2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe	kina4053.exe
PID 2492 wrote to memory of 220	2492	2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe	kina4053.exe
PID 2492 wrote to memory of 220	2492	2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe	kina4053.exe
PID 220 wrote to memory of 4704	220	kina4053.exe	kina8550.exe
PID 220 wrote to memory of 4704	220	kina4053.exe	kina8550.exe
PID 220 wrote to memory of 4704	220	kina4053.exe	kina8550.exe
PID 4704 wrote to memory of 4008	4704	kina8550.exe	kina2520.exe
PID 4704 wrote to memory of 4008	4704	kina8550.exe	kina2520.exe
PID 4704 wrote to memory of 4008	4704	kina8550.exe	kina2520.exe
PID 4008 wrote to memory of 3836	4008	kina2520.exe	bu294602.exe
PID 4008 wrote to memory of 3836	4008	kina2520.exe	bu294602.exe
PID 4008 wrote to memory of 2148	4008	kina2520.exe	cor9478.exe
PID 4008 wrote to memory of 2148	4008	kina2520.exe	cor9478.exe
PID 4008 wrote to memory of 2148	4008	kina2520.exe	cor9478.exe
PID 4704 wrote to memory of 4980	4704	kina8550.exe	dei99s18.exe
PID 4704 wrote to memory of 4980	4704	kina8550.exe	dei99s18.exe
PID 4704 wrote to memory of 4980	4704	kina8550.exe	dei99s18.exe
PID 220 wrote to memory of 2608	220	kina4053.exe	en269242.exe
PID 220 wrote to memory of 2608	220	kina4053.exe	en269242.exe
PID 220 wrote to memory of 2608	220	kina4053.exe	en269242.exe
PID 2492 wrote to memory of 2132	2492	2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe	ge394942.exe
PID 2492 wrote to memory of 2132	2492	2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe	ge394942.exe
PID 2492 wrote to memory of 2132	2492	2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe	ge394942.exe
PID 2132 wrote to memory of 3376	2132	ge394942.exe	metafor.exe
PID 2132 wrote to memory of 3376	2132	ge394942.exe	metafor.exe
PID 2132 wrote to memory of 3376	2132	ge394942.exe	metafor.exe
PID 3376 wrote to memory of 3420	3376	metafor.exe	schtasks.exe
PID 3376 wrote to memory of 3420	3376	metafor.exe	schtasks.exe
PID 3376 wrote to memory of 3420	3376	metafor.exe	schtasks.exe
PID 3376 wrote to memory of 4124	3376	metafor.exe	cmd.exe
PID 3376 wrote to memory of 4124	3376	metafor.exe	cmd.exe
PID 3376 wrote to memory of 4124	3376	metafor.exe	cmd.exe
PID 4124 wrote to memory of 4772	4124	cmd.exe	cmd.exe
PID 4124 wrote to memory of 4772	4124	cmd.exe	cmd.exe
PID 4124 wrote to memory of 4772	4124	cmd.exe	cmd.exe
PID 4124 wrote to memory of 4808	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 4808	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 4808	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 2580	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 2580	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 2580	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 2324	4124	cmd.exe	cmd.exe
PID 4124 wrote to memory of 2324	4124	cmd.exe	cmd.exe
PID 4124 wrote to memory of 2324	4124	cmd.exe	cmd.exe
PID 4124 wrote to memory of 2808	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 2808	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 2808	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 3836	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 3836	4124	cmd.exe	cacls.exe
PID 4124 wrote to memory of 3836	4124	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe
"C:\Users\Admin\AppData\Local\Temp\2ca73c98718634ba8689c88c2f3de840a2bc7c9501bfbe7a6d6d957048660621.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4053.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4053.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8550.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8550.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2520.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2520.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu294602.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu294602.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor9478.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor9478.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1076
        6⤵
        Program crash
        
        PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dei99s18.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dei99s18.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 1360
        5⤵
        Program crash
        
        PID:704
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en269242.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en269242.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge394942.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge394942.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
    "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3420
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4772
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:N"
        5⤵
        
        PID:4808
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "metafor.exe" /P "Admin:R" /E
        5⤵
        
        PID:2580
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2324
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:N"
        5⤵
        
        PID:2808
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5975271bda" /P "Admin:R" /E
        5⤵
        
        PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2148 -ip 2148
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4980 -ip 4980
1⤵
PID:1884

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
1⤵
- Executes dropped EXE
PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
b0bb285e8190e9d2366715812baf7f6b

SHA1
15e08fbb36e359d409a7de016b27fbd760529ac9

SHA256
1cb5c53142e55b453bc9c0a0e9d22d0cbc078e84c09568689f8b1aa006970792

SHA512
8b22a3d4e8a43128599fda58e458d2b3aeef9b7eff85adda724e37ee79b409e46eb28960fec1a5fe48f4acc20e277cb20497915de2415bea14ad328bef0b91f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
b0bb285e8190e9d2366715812baf7f6b

SHA1
15e08fbb36e359d409a7de016b27fbd760529ac9

SHA256
1cb5c53142e55b453bc9c0a0e9d22d0cbc078e84c09568689f8b1aa006970792

SHA512
8b22a3d4e8a43128599fda58e458d2b3aeef9b7eff85adda724e37ee79b409e46eb28960fec1a5fe48f4acc20e277cb20497915de2415bea14ad328bef0b91f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
b0bb285e8190e9d2366715812baf7f6b

SHA1
15e08fbb36e359d409a7de016b27fbd760529ac9

SHA256
1cb5c53142e55b453bc9c0a0e9d22d0cbc078e84c09568689f8b1aa006970792

SHA512
8b22a3d4e8a43128599fda58e458d2b3aeef9b7eff85adda724e37ee79b409e46eb28960fec1a5fe48f4acc20e277cb20497915de2415bea14ad328bef0b91f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

Filesize
227KB

MD5
b0bb285e8190e9d2366715812baf7f6b

SHA1
15e08fbb36e359d409a7de016b27fbd760529ac9

SHA256
1cb5c53142e55b453bc9c0a0e9d22d0cbc078e84c09568689f8b1aa006970792

SHA512
8b22a3d4e8a43128599fda58e458d2b3aeef9b7eff85adda724e37ee79b409e46eb28960fec1a5fe48f4acc20e277cb20497915de2415bea14ad328bef0b91f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge394942.exe

Filesize
227KB

MD5
b0bb285e8190e9d2366715812baf7f6b

SHA1
15e08fbb36e359d409a7de016b27fbd760529ac9

SHA256
1cb5c53142e55b453bc9c0a0e9d22d0cbc078e84c09568689f8b1aa006970792

SHA512
8b22a3d4e8a43128599fda58e458d2b3aeef9b7eff85adda724e37ee79b409e46eb28960fec1a5fe48f4acc20e277cb20497915de2415bea14ad328bef0b91f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge394942.exe

Filesize
227KB

MD5
b0bb285e8190e9d2366715812baf7f6b

SHA1
15e08fbb36e359d409a7de016b27fbd760529ac9

SHA256
1cb5c53142e55b453bc9c0a0e9d22d0cbc078e84c09568689f8b1aa006970792

SHA512
8b22a3d4e8a43128599fda58e458d2b3aeef9b7eff85adda724e37ee79b409e46eb28960fec1a5fe48f4acc20e277cb20497915de2415bea14ad328bef0b91f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4053.exe

Filesize
846KB

MD5
2bbe65c3dbcaba7d829c89c725b49e39

SHA1
170f88376a90d593370109ec166d4da2123434eb

SHA256
7eac815558888dbb9c3bdaf3b0e9ce3d657d7543d03300ded96fac26e9f278cd

SHA512
aeace2879d8e62394c7ca926a673959b0133cd0246c20e7e4f2e08be36a51a6fc28efbc91ca2f7ab02b4ec94d125310bc107382ba3f2bbfd3e266b053df9b527

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4053.exe

Filesize
846KB

MD5
2bbe65c3dbcaba7d829c89c725b49e39

SHA1
170f88376a90d593370109ec166d4da2123434eb

SHA256
7eac815558888dbb9c3bdaf3b0e9ce3d657d7543d03300ded96fac26e9f278cd

SHA512
aeace2879d8e62394c7ca926a673959b0133cd0246c20e7e4f2e08be36a51a6fc28efbc91ca2f7ab02b4ec94d125310bc107382ba3f2bbfd3e266b053df9b527

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en269242.exe

Filesize
175KB

MD5
0aff4b5157cf01ebfda7fbc475832896

SHA1
21ad90800fa63e743baf167982a1ea159a8103cc

SHA256
70cbae56ba223e05cd350050cce5e5226b20f66d1658cf0ebe7a427cf59c1412

SHA512
63bb097469638a7af6bb30d1816d86af43999d646510723fcdddc5d611675d851096eed374e7ed5fc12238395af77d74c43aaceaf8656dda10779e57b4db963c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en269242.exe

Filesize
175KB

MD5
0aff4b5157cf01ebfda7fbc475832896

SHA1
21ad90800fa63e743baf167982a1ea159a8103cc

SHA256
70cbae56ba223e05cd350050cce5e5226b20f66d1658cf0ebe7a427cf59c1412

SHA512
63bb097469638a7af6bb30d1816d86af43999d646510723fcdddc5d611675d851096eed374e7ed5fc12238395af77d74c43aaceaf8656dda10779e57b4db963c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8550.exe

Filesize
704KB

MD5
75f7437f1a14d58d468055cbd595d6fc

SHA1
fc675108bf2e9f6a21f4d77390168051209e3b23

SHA256
9434c7b2fea235ec386ee39ec54f6c2d07681efa4a8d911ada121a563affbe35

SHA512
222f069fc9bfa476530041e163addb169f66248e3c92ee35ea93ba88f642c49a258bf98dbbe82745f4812d83f5851a6937027b804bebe1ef24c259f020143ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8550.exe

Filesize
704KB

MD5
75f7437f1a14d58d468055cbd595d6fc

SHA1
fc675108bf2e9f6a21f4d77390168051209e3b23

SHA256
9434c7b2fea235ec386ee39ec54f6c2d07681efa4a8d911ada121a563affbe35

SHA512
222f069fc9bfa476530041e163addb169f66248e3c92ee35ea93ba88f642c49a258bf98dbbe82745f4812d83f5851a6937027b804bebe1ef24c259f020143ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dei99s18.exe

Filesize
380KB

MD5
830b0737c8d54f2ea4cf6e3f967e7fb1

SHA1
34500fe5da95424491a9a7dfb966f3a298e6812f

SHA256
3663a2765f358039b17a218b3560572361faea13c4de931e5316137bec63f7cb

SHA512
ede15854d94aa06788d198200cc493c3222f10bd61a95591b2466d8c58912b402c01d88d4ed13658ee1879d4356949a9239724f90b6a8a7659049f299c8c8c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dei99s18.exe

Filesize
380KB

MD5
830b0737c8d54f2ea4cf6e3f967e7fb1

SHA1
34500fe5da95424491a9a7dfb966f3a298e6812f

SHA256
3663a2765f358039b17a218b3560572361faea13c4de931e5316137bec63f7cb

SHA512
ede15854d94aa06788d198200cc493c3222f10bd61a95591b2466d8c58912b402c01d88d4ed13658ee1879d4356949a9239724f90b6a8a7659049f299c8c8c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2520.exe

Filesize
349KB

MD5
e1ce9a9cf46be4b7cb48609e2ca7f049

SHA1
d207f8a51bcf1c873f93508db35a7f7c3c6e84be

SHA256
6f43b4ebcdb1ad678bba436f2b94ff5490a1881cc7389a8a573580d0be475633

SHA512
9dfc4be246fd9fbe6404b5e856381572a349ad38e52c79b5e8d00288e1d3102c2583c04e0787187c40e7f42db068fbe3597a12d665379f68f6847d8798d801ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2520.exe

Filesize
349KB

MD5
e1ce9a9cf46be4b7cb48609e2ca7f049

SHA1
d207f8a51bcf1c873f93508db35a7f7c3c6e84be

SHA256
6f43b4ebcdb1ad678bba436f2b94ff5490a1881cc7389a8a573580d0be475633

SHA512
9dfc4be246fd9fbe6404b5e856381572a349ad38e52c79b5e8d00288e1d3102c2583c04e0787187c40e7f42db068fbe3597a12d665379f68f6847d8798d801ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu294602.exe

Filesize
11KB

MD5
8ee045de3cbb12486403589829ecf932

SHA1
3b8b0f8007804754dbe545015f96fecb00b24c82

SHA256
0c42fb41e76a4371bde10f3971068ff1fb31f45f89dfc91b2ac38c24a9a4dc33

SHA512
56199dbaf15306fa7086ca96972cd61e4c030d6ea295796afaecbb3565ce51285f117174a75b5f5c4a830cb2020785ec9bf9b228aacdcc72bc6403180c13e8da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu294602.exe

Filesize
11KB

MD5
8ee045de3cbb12486403589829ecf932

SHA1
3b8b0f8007804754dbe545015f96fecb00b24c82

SHA256
0c42fb41e76a4371bde10f3971068ff1fb31f45f89dfc91b2ac38c24a9a4dc33

SHA512
56199dbaf15306fa7086ca96972cd61e4c030d6ea295796afaecbb3565ce51285f117174a75b5f5c4a830cb2020785ec9bf9b228aacdcc72bc6403180c13e8da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor9478.exe

Filesize
321KB

MD5
a3c123ebe792b6cbe27fa5b0d960b715

SHA1
8a0de633125b3adbf47d7e2e36652465d179ea89

SHA256
4a59c02394e569205e8391914c80b05190547d5038ac68f6c0dc16760ab77c31

SHA512
561341c057b44ceb9225fef0b9eed8e4999fa9870f8f6a4a7a0e0c163679931eeded86b393310e6edf546914a6e470c0278df4c7ac706054afe6fe8ab87b0f56

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor9478.exe

Filesize
321KB

MD5
a3c123ebe792b6cbe27fa5b0d960b715

SHA1
8a0de633125b3adbf47d7e2e36652465d179ea89

SHA256
4a59c02394e569205e8391914c80b05190547d5038ac68f6c0dc16760ab77c31

SHA512
561341c057b44ceb9225fef0b9eed8e4999fa9870f8f6a4a7a0e0c163679931eeded86b393310e6edf546914a6e470c0278df4c7ac706054afe6fe8ab87b0f56

Download Submit
memory/2148-185-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-200-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/2148-181-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-183-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-175-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-187-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-189-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-191-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-193-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-195-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-197-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-198-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/2148-199-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/2148-179-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-201-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/2148-203-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/2148-204-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/2148-205-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/2148-167-0x0000000002B80000-0x0000000002BAD000-memory.dmp

Filesize
180KB

Download
memory/2148-177-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-173-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-171-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-170-0x0000000007100000-0x0000000007112000-memory.dmp

Filesize
72KB

Download
memory/2148-169-0x0000000007220000-0x00000000077C4000-memory.dmp

Filesize
5.6MB

Download
memory/2148-168-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/2608-1142-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/2608-1141-0x00000000000D0000-0x0000000000102000-memory.dmp

Filesize
200KB

Download
memory/3836-161-0x00000000007D0000-0x00000000007DA000-memory.dmp

Filesize
40KB

Download
memory/4980-215-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-225-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-227-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-229-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-231-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-233-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-235-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-237-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-239-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-241-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-243-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-245-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-247-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-1120-0x00000000078D0000-0x0000000007EE8000-memory.dmp

Filesize
6.1MB

Download
memory/4980-1121-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/4980-1122-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/4980-1123-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/4980-1124-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/4980-1126-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/4980-1127-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/4980-1128-0x0000000008B90000-0x0000000008D52000-memory.dmp

Filesize
1.8MB

Download
memory/4980-1129-0x0000000008D60000-0x000000000928C000-memory.dmp

Filesize
5.2MB

Download
memory/4980-1130-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/4980-1131-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/4980-1132-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/4980-1133-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/4980-1134-0x0000000009600000-0x0000000009676000-memory.dmp

Filesize
472KB

Download
memory/4980-223-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-221-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-219-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-217-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-211-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/4980-212-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/4980-214-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/4980-213-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/4980-210-0x0000000002C60000-0x0000000002CAB000-memory.dmp

Filesize
300KB

Download
memory/4980-1135-0x0000000009680000-0x00000000096D0000-memory.dmp

Filesize
320KB

Download