Analysis
-
max time kernel
147s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2023 00:04
Static task
static1
General
-
Target
1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe
-
Size
1003KB
-
MD5
25a64b706efb014eeb2bfb13794fa5d9
-
SHA1
607de971e59ebcc78f77f3ff66936d94ced3b00e
-
SHA256
1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462
-
SHA512
39f3e7904adbd5e30bf9a531db0fd46e7af92dcb9be4b0d630392f03dec01627013bcadf72d2b4e4c1b8af799fcf5d22d960150e6cd8f363adf1eadfe29b6bd2
-
SSDEEP
24576:5yUcwynQqmMKQDs+OSWgtC2MvzRUoAkz2HbUb:sDwyQqm9DR2MLL2HbU
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
Rocket
95.217.188.21:7283
-
auth_value
0095203c91b01efccf3842dc176e53f2
Signatures
-
Processes:
v4269Kw.exetz7720.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v4269Kw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v4269Kw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v4269Kw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz7720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz7720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz7720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v4269Kw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v4269Kw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v4269Kw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz7720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz7720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz7720.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1016-211-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-213-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-210-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-215-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-217-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-219-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-221-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-223-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-225-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-227-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-229-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-231-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-233-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-235-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-239-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-237-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-241-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline behavioral1/memory/1016-243-0x0000000002A40000-0x0000000002A7E000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legenda.exey46oh55.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation legenda.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation y46oh55.exe -
Executes dropped EXE 12 IoCs
Processes:
zap0784.exezap0952.exezap3181.exetz7720.exev4269Kw.exew83gn01.exexTwIx15.exey46oh55.exelegenda.exeAlCapone99.exelegenda.exelegenda.exepid process 1904 zap0784.exe 2508 zap0952.exe 2672 zap3181.exe 116 tz7720.exe 4856 v4269Kw.exe 1016 w83gn01.exe 1308 xTwIx15.exe 3620 y46oh55.exe 3832 legenda.exe 756 AlCapone99.exe 3724 legenda.exe 3336 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4632 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz7720.exev4269Kw.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz7720.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v4269Kw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v4269Kw.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap3181.exe1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exezap0784.exezap0952.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap3181.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap0784.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap0784.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap0952.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap0952.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap3181.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
AlCapone99.exedescription pid process target process PID 756 set thread context of 852 756 AlCapone99.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1400 4856 WerFault.exe v4269Kw.exe 4112 1016 WerFault.exe w83gn01.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
tz7720.exev4269Kw.exew83gn01.exexTwIx15.exeAppLaunch.exepid process 116 tz7720.exe 116 tz7720.exe 4856 v4269Kw.exe 4856 v4269Kw.exe 1016 w83gn01.exe 1016 w83gn01.exe 1308 xTwIx15.exe 1308 xTwIx15.exe 852 AppLaunch.exe 852 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
tz7720.exev4269Kw.exew83gn01.exexTwIx15.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 116 tz7720.exe Token: SeDebugPrivilege 4856 v4269Kw.exe Token: SeDebugPrivilege 1016 w83gn01.exe Token: SeDebugPrivilege 1308 xTwIx15.exe Token: SeDebugPrivilege 852 AppLaunch.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exezap0784.exezap0952.exezap3181.exey46oh55.exelegenda.execmd.exeAlCapone99.exedescription pid process target process PID 932 wrote to memory of 1904 932 1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe zap0784.exe PID 932 wrote to memory of 1904 932 1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe zap0784.exe PID 932 wrote to memory of 1904 932 1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe zap0784.exe PID 1904 wrote to memory of 2508 1904 zap0784.exe zap0952.exe PID 1904 wrote to memory of 2508 1904 zap0784.exe zap0952.exe PID 1904 wrote to memory of 2508 1904 zap0784.exe zap0952.exe PID 2508 wrote to memory of 2672 2508 zap0952.exe zap3181.exe PID 2508 wrote to memory of 2672 2508 zap0952.exe zap3181.exe PID 2508 wrote to memory of 2672 2508 zap0952.exe zap3181.exe PID 2672 wrote to memory of 116 2672 zap3181.exe tz7720.exe PID 2672 wrote to memory of 116 2672 zap3181.exe tz7720.exe PID 2672 wrote to memory of 4856 2672 zap3181.exe v4269Kw.exe PID 2672 wrote to memory of 4856 2672 zap3181.exe v4269Kw.exe PID 2672 wrote to memory of 4856 2672 zap3181.exe v4269Kw.exe PID 2508 wrote to memory of 1016 2508 zap0952.exe w83gn01.exe PID 2508 wrote to memory of 1016 2508 zap0952.exe w83gn01.exe PID 2508 wrote to memory of 1016 2508 zap0952.exe w83gn01.exe PID 1904 wrote to memory of 1308 1904 zap0784.exe xTwIx15.exe PID 1904 wrote to memory of 1308 1904 zap0784.exe xTwIx15.exe PID 1904 wrote to memory of 1308 1904 zap0784.exe xTwIx15.exe PID 932 wrote to memory of 3620 932 1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe y46oh55.exe PID 932 wrote to memory of 3620 932 1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe y46oh55.exe PID 932 wrote to memory of 3620 932 1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe y46oh55.exe PID 3620 wrote to memory of 3832 3620 y46oh55.exe legenda.exe PID 3620 wrote to memory of 3832 3620 y46oh55.exe legenda.exe PID 3620 wrote to memory of 3832 3620 y46oh55.exe legenda.exe PID 3832 wrote to memory of 2224 3832 legenda.exe schtasks.exe PID 3832 wrote to memory of 2224 3832 legenda.exe schtasks.exe PID 3832 wrote to memory of 2224 3832 legenda.exe schtasks.exe PID 3832 wrote to memory of 1500 3832 legenda.exe cmd.exe PID 3832 wrote to memory of 1500 3832 legenda.exe cmd.exe PID 3832 wrote to memory of 1500 3832 legenda.exe cmd.exe PID 1500 wrote to memory of 4200 1500 cmd.exe cmd.exe PID 1500 wrote to memory of 4200 1500 cmd.exe cmd.exe PID 1500 wrote to memory of 4200 1500 cmd.exe cmd.exe PID 1500 wrote to memory of 3308 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 3308 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 3308 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 4992 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 4992 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 4992 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 4124 1500 cmd.exe cmd.exe PID 1500 wrote to memory of 4124 1500 cmd.exe cmd.exe PID 1500 wrote to memory of 4124 1500 cmd.exe cmd.exe PID 1500 wrote to memory of 4912 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 4912 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 4912 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 4308 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 4308 1500 cmd.exe cacls.exe PID 1500 wrote to memory of 4308 1500 cmd.exe cacls.exe PID 3832 wrote to memory of 756 3832 legenda.exe AlCapone99.exe PID 3832 wrote to memory of 756 3832 legenda.exe AlCapone99.exe PID 3832 wrote to memory of 756 3832 legenda.exe AlCapone99.exe PID 756 wrote to memory of 852 756 AlCapone99.exe AppLaunch.exe PID 756 wrote to memory of 852 756 AlCapone99.exe AppLaunch.exe PID 756 wrote to memory of 852 756 AlCapone99.exe AppLaunch.exe PID 756 wrote to memory of 852 756 AlCapone99.exe AppLaunch.exe PID 756 wrote to memory of 852 756 AlCapone99.exe AppLaunch.exe PID 3832 wrote to memory of 4632 3832 legenda.exe rundll32.exe PID 3832 wrote to memory of 4632 3832 legenda.exe rundll32.exe PID 3832 wrote to memory of 4632 3832 legenda.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe"C:\Users\Admin\AppData\Local\Temp\1e14c42675fe1b63d95dceb8204d370d23f1168ce6b77e4a3151b0fde1ef9462.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0784.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0784.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0952.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0952.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3181.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3181.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7720.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7720.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4269Kw.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4269Kw.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 10766⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w83gn01.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w83gn01.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 13685⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTwIx15.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTwIx15.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y46oh55.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y46oh55.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000079001\AlCapone99.exe"C:\Users\Admin\AppData\Local\Temp\1000079001\AlCapone99.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4856 -ip 48561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1016 -ip 10161⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000079001\AlCapone99.exeFilesize
261KB
MD53db6d94b8df4916aa7cb0d67f2bba3f6
SHA1b27b508ce16462268b6a96a727007755fe62c8a1
SHA25615b31a3a4ab58991a4e7c7e2cc49fdec1002ea907effb2402b949263dcf0a0bd
SHA51247495567ab11743ec6e16ca61f86904a27383c6feb6c6d45015215679549a7137ca007164bc8ed9e5aa6a26006433327600679c4803ebb98d4c980e92dd0c1d4
-
C:\Users\Admin\AppData\Local\Temp\1000079001\AlCapone99.exeFilesize
261KB
MD53db6d94b8df4916aa7cb0d67f2bba3f6
SHA1b27b508ce16462268b6a96a727007755fe62c8a1
SHA25615b31a3a4ab58991a4e7c7e2cc49fdec1002ea907effb2402b949263dcf0a0bd
SHA51247495567ab11743ec6e16ca61f86904a27383c6feb6c6d45015215679549a7137ca007164bc8ed9e5aa6a26006433327600679c4803ebb98d4c980e92dd0c1d4
-
C:\Users\Admin\AppData\Local\Temp\1000079001\AlCapone99.exeFilesize
261KB
MD53db6d94b8df4916aa7cb0d67f2bba3f6
SHA1b27b508ce16462268b6a96a727007755fe62c8a1
SHA25615b31a3a4ab58991a4e7c7e2cc49fdec1002ea907effb2402b949263dcf0a0bd
SHA51247495567ab11743ec6e16ca61f86904a27383c6feb6c6d45015215679549a7137ca007164bc8ed9e5aa6a26006433327600679c4803ebb98d4c980e92dd0c1d4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y46oh55.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y46oh55.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0784.exeFilesize
818KB
MD5bee30d4d99a46c7f618559e9b5660d0f
SHA175a59613c98ee3a6521971978ba5315d70ef6b6e
SHA256dda0b1dacd0229f46ee277b9628af06afbc9992b5c7e74d7ba5c26b4005a1c71
SHA512c9275128112e4dea078f7653eb05f6fc48e9d3351e9bb7fa434b3ed4c6a7ae9236b4c7d5bd4c94b8e00846dc4efa84eb61a159443ae1295a6f20fe6ec44aa92f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0784.exeFilesize
818KB
MD5bee30d4d99a46c7f618559e9b5660d0f
SHA175a59613c98ee3a6521971978ba5315d70ef6b6e
SHA256dda0b1dacd0229f46ee277b9628af06afbc9992b5c7e74d7ba5c26b4005a1c71
SHA512c9275128112e4dea078f7653eb05f6fc48e9d3351e9bb7fa434b3ed4c6a7ae9236b4c7d5bd4c94b8e00846dc4efa84eb61a159443ae1295a6f20fe6ec44aa92f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTwIx15.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTwIx15.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0952.exeFilesize
676KB
MD518e74978fbbd6cb5a981925c60f19fb6
SHA182636c7c4c089dbbd5551075e04a162ae7d750ad
SHA256830e22d430b4a7b458d4aece93ef95a9423fc81c7d79278885186dc3d6b1b289
SHA512f9e3e20969c5c775cd7682fb3623e8305e6126da771f09e235364815c4c222d4b1794692820cdf118d8d72370a32583fd1febfa28095e476c3ba2fbfcf305000
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0952.exeFilesize
676KB
MD518e74978fbbd6cb5a981925c60f19fb6
SHA182636c7c4c089dbbd5551075e04a162ae7d750ad
SHA256830e22d430b4a7b458d4aece93ef95a9423fc81c7d79278885186dc3d6b1b289
SHA512f9e3e20969c5c775cd7682fb3623e8305e6126da771f09e235364815c4c222d4b1794692820cdf118d8d72370a32583fd1febfa28095e476c3ba2fbfcf305000
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w83gn01.exeFilesize
349KB
MD5cde99d12e29e2ab311c653964fa5892e
SHA1eb24a17d119c13b53dbb7fc0e957a21c335a3c7c
SHA2567e350bb4fa10ae30e63886a888d6de0f95fd7838570a6b41ea71992ecd1f2fbb
SHA512fd1379ab4b2b780df0f94fd64eae1a08967f728fd734ddc1821a3275c3033b3752fd484e2029c7f88e7d159c2df6b429da43793575861bd43d5ea9e91ef40a18
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w83gn01.exeFilesize
349KB
MD5cde99d12e29e2ab311c653964fa5892e
SHA1eb24a17d119c13b53dbb7fc0e957a21c335a3c7c
SHA2567e350bb4fa10ae30e63886a888d6de0f95fd7838570a6b41ea71992ecd1f2fbb
SHA512fd1379ab4b2b780df0f94fd64eae1a08967f728fd734ddc1821a3275c3033b3752fd484e2029c7f88e7d159c2df6b429da43793575861bd43d5ea9e91ef40a18
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3181.exeFilesize
334KB
MD562b7618c8d9999fdd4c00ff51c909c48
SHA1d5056cf3dec3a83fdb31cb313edd3b9088612500
SHA256e35d835fc541b5782faf9543358529d524a0c5ed77ed4f6701065f02e0013691
SHA512d8e5a7bf9cd641db0142764fed4656a289d135cf6adde64692136accb4279a9ef8414b14ed16812e3d81947fcbd1589ffe93d2ed8f10a1e349e79a09fe6d9b26
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3181.exeFilesize
334KB
MD562b7618c8d9999fdd4c00ff51c909c48
SHA1d5056cf3dec3a83fdb31cb313edd3b9088612500
SHA256e35d835fc541b5782faf9543358529d524a0c5ed77ed4f6701065f02e0013691
SHA512d8e5a7bf9cd641db0142764fed4656a289d135cf6adde64692136accb4279a9ef8414b14ed16812e3d81947fcbd1589ffe93d2ed8f10a1e349e79a09fe6d9b26
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7720.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7720.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4269Kw.exeFilesize
290KB
MD5ed61c9700738936f130dd694e68f6c22
SHA187368d77b0d132d13f81ccd30e33bff1ce15391b
SHA256cc6c2803381f5808ae1816117c90a6543259324c8de5827e88010ae6254a1051
SHA512300d06f08e507afebbb757dcf6c26022969094d4da124d95b7887dfe7ebc4874056d8f77720feecc11ca8b3ff2555d2ba7db049754750089c425ad57124e205b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4269Kw.exeFilesize
290KB
MD5ed61c9700738936f130dd694e68f6c22
SHA187368d77b0d132d13f81ccd30e33bff1ce15391b
SHA256cc6c2803381f5808ae1816117c90a6543259324c8de5827e88010ae6254a1051
SHA512300d06f08e507afebbb757dcf6c26022969094d4da124d95b7887dfe7ebc4874056d8f77720feecc11ca8b3ff2555d2ba7db049754750089c425ad57124e205b
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/116-161-0x0000000000F50000-0x0000000000F5A000-memory.dmpFilesize
40KB
-
memory/852-1181-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/852-1180-0x0000000000160000-0x0000000000192000-memory.dmpFilesize
200KB
-
memory/1016-1130-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/1016-1122-0x0000000005D60000-0x0000000005D72000-memory.dmpFilesize
72KB
-
memory/1016-1135-0x00000000084E0000-0x0000000008530000-memory.dmpFilesize
320KB
-
memory/1016-1134-0x0000000008460000-0x00000000084D6000-memory.dmpFilesize
472KB
-
memory/1016-1133-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/1016-1132-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/1016-1131-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/1016-211-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-213-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-210-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-215-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-217-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-219-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-221-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-223-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-225-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-227-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-229-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-231-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-233-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-235-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-239-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-237-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-241-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-243-0x0000000002A40000-0x0000000002A7E000-memory.dmpFilesize
248KB
-
memory/1016-480-0x00000000009C0000-0x0000000000A0B000-memory.dmpFilesize
300KB
-
memory/1016-482-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/1016-486-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/1016-484-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/1016-1120-0x00000000055C0000-0x0000000005BD8000-memory.dmpFilesize
6.1MB
-
memory/1016-1121-0x0000000005C20000-0x0000000005D2A000-memory.dmpFilesize
1.0MB
-
memory/1016-1128-0x0000000006B10000-0x000000000703C000-memory.dmpFilesize
5.2MB
-
memory/1016-1123-0x0000000005D80000-0x0000000005DBC000-memory.dmpFilesize
240KB
-
memory/1016-1124-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/1016-1125-0x0000000006070000-0x0000000006102000-memory.dmpFilesize
584KB
-
memory/1016-1126-0x0000000006110000-0x0000000006176000-memory.dmpFilesize
408KB
-
memory/1016-1127-0x0000000006930000-0x0000000006AF2000-memory.dmpFilesize
1.8MB
-
memory/1308-1141-0x0000000000AC0000-0x0000000000AF2000-memory.dmpFilesize
200KB
-
memory/1308-1142-0x0000000005370000-0x0000000005380000-memory.dmpFilesize
64KB
-
memory/4856-192-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-203-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/4856-188-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-204-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/4856-186-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-197-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/4856-196-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-180-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-198-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/4856-194-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-202-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/4856-190-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-205-0x0000000000400000-0x0000000000830000-memory.dmpFilesize
4.2MB
-
memory/4856-200-0x0000000000400000-0x0000000000830000-memory.dmpFilesize
4.2MB
-
memory/4856-199-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/4856-182-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-184-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-178-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-176-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-172-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-174-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-170-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-169-0x0000000002830000-0x0000000002842000-memory.dmpFilesize
72KB
-
memory/4856-168-0x0000000004F30000-0x00000000054D4000-memory.dmpFilesize
5.6MB
-
memory/4856-167-0x0000000000AC0000-0x0000000000AED000-memory.dmpFilesize
180KB