Procedure examples

metaMain can collect files and system information from a compromised host.

metaMain's module file has been encrypted via XOR.

metaMain can collect the username from a compromised host.

metaMain can upload collected files and data to its C2 server.

metaMain can inject the loader file, Speech02.db, into a process.

metaMain can log mouse events.

metaMain has the ability to log keyboard events.

metaMain can enumerate the processes that run on the platform.

metaMain has deleted collected items after uploading the content to its C2 server.

metaMain can change the `CreationTime`, `LastAccessTime`, and `LastWriteTime` file time attributes when executed with `SYSTEM` privileges.

metaMain can use HTTP for C2 communications.

metaMain has stored the collected system files in a working directory.

metaMain can collect the computer name from a compromised host.

metaMain can recursively enumerate files in an operator-provided directory.

metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.

metaMain can establish an indirect and raw TCP socket-based connection to the C2 server.

metaMain can download files onto compromised systems.

metaMain can execute an operator-provided Windows command by leveraging functions such as `WinExec`, `WriteFile`, and `ReadFile`.

metaMain can write the process ID of a target process into the `HKEY_LOCAL_MACHINE\SOFTWARE\DDE\tpid` Registry value as part of its reflective loading activity.

metaMain can take and save screenshots.

metaMain can decrypt and load other modules.

metaMain has authenticated itself to a different implant, Cryshell, through a port knocking and handshake procedure.

metaMain has delayed execution for five to six minutes during its persistence establishment process.

metaMain registered a WMI event subscription consumer called "hard_disk_stat" to establish persistence.

metaMain has used XOR-based encryption for collected files before exfiltration.

metaMain can encrypt the data that it sends and receives from the C2 server using an RC4 encryption algorithm.

metaMain can support an HKCMD sideloading start method.

metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.