Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
11/08/2026, 12:34
General
- Target RTN Markets MT5.exe
- Size 1.3MB
- Sample260811-prxt8staph
- SHA256 74a40beb334d9fd14d39f34a4f98be3e8a4f568a51d3600daed9b28ea3271ad6
Malware Config
Signatures
- Family: MetaQuotes
MetaQuotes is a Windows adware family.
- Detects MetaQuotes adware 3 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RTN Markets MT5.exe"C:\Users\Admin\AppData\Local\Temp\RTN Markets MT5.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4588-0-0x0000000000070000-0x00000000003D2000-memory.dmp
memory/4588-1-0x0000000000070000-0x00000000003D2000-memory.dmp
memory/4588-4-0x0000000001A30000-0x0000000001ADC000-memory.dmp
memory/4588-6-0x0000000001C40000-0x0000000001C6B000-memory.dmp
memory/4588-7-0x0000000001C90000-0x0000000001DBA000-memory.dmp
memory/4588-8-0x0000000001DC0000-0x0000000001E8D000-memory.dmp
memory/4588-5-0x0000000001AE0000-0x0000000001C36000-memory.dmp
memory/4588-11-0x0000000002630000-0x00000000027D1000-memory.dmp
memory/4588-14-0x0000000002AF0000-0x0000000002CD4000-memory.dmp
memory/4588-24-0x0000000003260000-0x000000000336B000-memory.dmp
memory/4588-43-0x0000000001DC0000-0x0000000001E8D000-memory.dmp
memory/4588-42-0x0000000001C90000-0x0000000001DBA000-memory.dmp
memory/4588-65-0x000000000A5D0000-0x000000000A5F3000-memory.dmp
memory/4588-91-0x0000000000070000-0x00000000003D2000-memory.dmp
memory/4588-64-0x000000000A3D0000-0x000000000A3F6000-memory.dmp
memory/4588-63-0x000000000A3A0000-0x000000000A3C7000-memory.dmp
memory/4588-62-0x000000000A360000-0x000000000A39B000-memory.dmp
memory/4588-61-0x000000000A340000-0x000000000A355000-memory.dmp
memory/4588-60-0x000000000A290000-0x000000000A33C000-memory.dmp
memory/4588-59-0x00000000087A0000-0x0000000008831000-memory.dmp
memory/4588-58-0x0000000008630000-0x000000000863D000-memory.dmp
memory/4588-57-0x00000000068A0000-0x00000000068AA000-memory.dmp
memory/4588-56-0x0000000006890000-0x0000000006898000-memory.dmp
memory/4588-55-0x0000000006850000-0x000000000688B000-memory.dmp
memory/4588-54-0x0000000006780000-0x000000000684C000-memory.dmp
memory/4588-53-0x0000000006710000-0x000000000677A000-memory.dmp
memory/4588-52-0x0000000006300000-0x000000000630C000-memory.dmp
memory/4588-51-0x00000000061E0000-0x00000000062F5000-memory.dmp
memory/4588-50-0x00000000061B0000-0x00000000061D7000-memory.dmp
memory/4588-49-0x0000000006170000-0x00000000061A4000-memory.dmp
memory/4588-48-0x0000000005F80000-0x0000000005F98000-memory.dmp
memory/4588-47-0x0000000005F60000-0x0000000005F72000-memory.dmp
memory/4588-36-0x0000000005DC0000-0x0000000005E43000-memory.dmp
memory/4588-46-0x0000000002630000-0x00000000027D1000-memory.dmp
memory/4588-45-0x00000000025D0000-0x0000000002625000-memory.dmp
memory/4588-41-0x0000000001C40000-0x0000000001C6B000-memory.dmp
memory/4588-40-0x0000000001AE0000-0x0000000001C36000-memory.dmp
memory/4588-38-0x0000000001590000-0x0000000001859000-memory.dmp
memory/4588-37-0x00000000014D0000-0x000000000158E000-memory.dmp
memory/4588-31-0x0000000000070000-0x00000000003D2000-memory.dmp
memory/4588-35-0x0000000005D90000-0x0000000005DA2000-memory.dmp
memory/4588-34-0x0000000005CF0000-0x0000000005D8E000-memory.dmp
memory/4588-33-0x0000000005900000-0x00000000059AD000-memory.dmp
memory/4588-32-0x0000000003880000-0x00000000038AC000-memory.dmp
memory/4588-30-0x0000000005170000-0x0000000005900000-memory.dmp
memory/4588-44-0x0000000001E90000-0x00000000025CF000-memory.dmp
memory/4588-29-0x0000000003850000-0x000000000387C000-memory.dmp
memory/4588-28-0x0000000003800000-0x0000000003830000-memory.dmp
memory/4588-27-0x0000000003770000-0x00000000037A1000-memory.dmp
memory/4588-26-0x00000000036D0000-0x000000000376D000-memory.dmp
memory/4588-25-0x0000000003370000-0x00000000036C5000-memory.dmp
memory/4588-23-0x0000000003230000-0x0000000003252000-memory.dmp
memory/4588-22-0x0000000003130000-0x0000000003230000-memory.dmp
memory/4588-21-0x0000000003000000-0x000000000312A000-memory.dmp
memory/4588-20-0x0000000002F60000-0x0000000002FFB000-memory.dmp
memory/4588-19-0x0000000002EC0000-0x0000000002F5E000-memory.dmp
memory/4588-18-0x0000000002EB0000-0x0000000002EBA000-memory.dmp
memory/4588-17-0x0000000002EA0000-0x0000000002EAC000-memory.dmp
memory/4588-16-0x0000000002E90000-0x0000000002E97000-memory.dmp
memory/4588-15-0x0000000002CE0000-0x0000000002E89000-memory.dmp
memory/4588-13-0x0000000002850000-0x0000000002AEA000-memory.dmp
memory/4588-12-0x00000000027E0000-0x000000000284B000-memory.dmp
memory/4588-10-0x00000000025D0000-0x0000000002625000-memory.dmp
memory/4588-9-0x0000000001E90000-0x00000000025CF000-memory.dmp
memory/4588-3-0x0000000001590000-0x0000000001859000-memory.dmp
memory/4588-2-0x00000000014D0000-0x000000000158E000-memory.dmp