Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/08/2026, 12:34
General
- Target RTN Markets MT5.exe
- Size 1.3MB
- Sample260811-prxt8staph
- SHA256 74a40beb334d9fd14d39f34a4f98be3e8a4f568a51d3600daed9b28ea3271ad6
Malware Config
Signatures
- Family: MetaQuotes
MetaQuotes is a Windows adware family.
- Detects MetaQuotes adware 2 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RTN Markets MT5.exe"C:\Users\Admin\AppData\Local\Temp\RTN Markets MT5.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2572-0-0x00000000000A0000-0x0000000000402000-memory.dmp
memory/2572-2-0x0000000000950000-0x0000000000A17000-memory.dmp
memory/2572-11-0x0000000000FF0000-0x000000000101A000-memory.dmp
memory/2572-3-0x0000000000A20000-0x0000000000DC1000-memory.dmp
memory/2572-1-0x00000000000A0000-0x0000000000402000-memory.dmp
memory/2572-9-0x0000000001100000-0x0000000001276000-memory.dmp
memory/2572-15-0x0000000001450000-0x0000000001526000-memory.dmp
memory/2572-23-0x0000000001C30000-0x0000000001C8D000-memory.dmp
memory/2572-22-0x0000000001EE0000-0x0000000002170000-memory.dmp
memory/2572-42-0x0000000003030000-0x0000000003069000-memory.dmp
memory/2572-45-0x0000000004990000-0x0000000004A63000-memory.dmp
memory/2572-43-0x0000000004A80000-0x00000000052AA000-memory.dmp
memory/2572-84-0x00000000000A0000-0x0000000000402000-memory.dmp
memory/2572-56-0x0000000005A50000-0x0000000005B70000-memory.dmp
memory/2572-83-0x0000000006EB0000-0x00000000070DA000-memory.dmp
memory/2572-77-0x000000000B4C0000-0x000000000B628000-memory.dmp
memory/2572-64-0x000000000B1D0000-0x000000000B4B3000-memory.dmp
memory/2572-82-0x000000000BCB0000-0x000000000BCD7000-memory.dmp
memory/2572-81-0x000000000BA70000-0x000000000BA9D000-memory.dmp
memory/2572-80-0x000000000BA20000-0x000000000BA5F000-memory.dmp
memory/2572-79-0x000000000B9E0000-0x000000000BA10000-memory.dmp
memory/2572-78-0x000000000B630000-0x000000000B6F4000-memory.dmp
memory/2572-63-0x000000000A8A0000-0x000000000A9C5000-memory.dmp
memory/2572-62-0x000000000A650000-0x000000000A794000-memory.dmp
memory/2572-61-0x000000000A410000-0x000000000A4BC000-memory.dmp
memory/2572-55-0x00000000058F0000-0x0000000005A49000-memory.dmp
memory/2572-46-0x00000000055F0000-0x000000000569D000-memory.dmp
memory/2572-60-0x0000000005C50000-0x0000000005C5B000-memory.dmp
memory/2572-59-0x0000000005BD0000-0x0000000005BDD000-memory.dmp
memory/2572-58-0x0000000005BC0000-0x0000000005BCA000-memory.dmp
memory/2572-54-0x0000000005880000-0x00000000058E8000-memory.dmp
memory/2572-48-0x00000000056A0000-0x0000000005739000-memory.dmp
memory/2572-53-0x0000000005E80000-0x0000000005EA6000-memory.dmp
memory/2572-52-0x0000000005E70000-0x0000000005E7C000-memory.dmp
memory/2572-51-0x0000000005E30000-0x0000000005E68000-memory.dmp
memory/2572-50-0x0000000005740000-0x000000000575C000-memory.dmp
memory/2572-49-0x00000000030B0000-0x00000000030C3000-memory.dmp
memory/2572-47-0x0000000003090000-0x00000000030AA000-memory.dmp
memory/2572-39-0x0000000002BB0000-0x0000000002F2C000-memory.dmp
memory/2572-37-0x00000000029D0000-0x0000000002AF1000-memory.dmp
memory/2572-35-0x0000000002850000-0x000000000299B000-memory.dmp
memory/2572-34-0x0000000002730000-0x0000000002846000-memory.dmp
memory/2572-57-0x0000000005B80000-0x0000000005BB2000-memory.dmp
memory/2572-33-0x0000000002680000-0x0000000002727000-memory.dmp
memory/2572-28-0x00000000023D0000-0x000000000259A000-memory.dmp
memory/2572-41-0x0000000002FD0000-0x0000000002FFF000-memory.dmp
memory/2572-40-0x0000000002F30000-0x0000000002F78000-memory.dmp
memory/2572-38-0x0000000002B00000-0x0000000002BA3000-memory.dmp
memory/2572-36-0x00000000029A0000-0x00000000029C7000-memory.dmp
memory/2572-32-0x00000000025D0000-0x0000000002679000-memory.dmp
memory/2572-31-0x00000000025C0000-0x00000000025CB000-memory.dmp
memory/2572-30-0x00000000025B0000-0x00000000025BD000-memory.dmp
memory/2572-29-0x00000000025A0000-0x00000000025A8000-memory.dmp
memory/2572-25-0x0000000002180000-0x00000000023C1000-memory.dmp
memory/2572-20-0x0000000001C90000-0x0000000001E53000-memory.dmp
memory/2572-21-0x0000000001E60000-0x0000000001ED4000-memory.dmp
memory/2572-16-0x0000000001530000-0x0000000001C26000-memory.dmp
memory/2572-14-0x00000000012B0000-0x0000000001449000-memory.dmp
memory/2572-7-0x0000000001040000-0x00000000010F2000-memory.dmp