Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 17:21
Static task
static1
General
-
Target
f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe
-
Size
1.0MB
-
MD5
255cf96d9caca4cb38701274fe06edb6
-
SHA1
b3e574b78f16cfe7c394404ff179c40ed72b7656
-
SHA256
f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2
-
SHA512
de4d58899889acf95ef6b4010d0ff6ee6645c0fd815c580223d9d15595a9d69ef62360f19959643f7e345216f6933fc005d696ee6766ad62acfe5028ee0e39a3
-
SSDEEP
12288:NMrky90pVsN7f5F95AbmHXJzSt4FUEn4dQOE4HIDLTG/UlrHpn+cir5RK5W:hyAVsN3sigtS49KX4ujcr5k5W
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
store
193.233.20.32:4125
-
auth_value
e34e5836de4e256271ab56c648765bcd
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
ngan003
199.115.193.116:11300
-
auth_value
b500a5cf0cb429e32a81c6ddcd8d4545
Signatures
-
Processes:
tz0468.exev2433VQ.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz0468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz0468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz0468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz0468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz0468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v2433VQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v2433VQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz0468.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v2433VQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v2433VQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v2433VQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v2433VQ.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/824-210-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-211-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-213-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-215-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-217-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-219-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-221-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-223-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-225-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-227-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-229-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-233-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-235-0x0000000007180000-0x0000000007190000-memory.dmp family_redline behavioral1/memory/824-237-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-239-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-241-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-243-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-245-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-247-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/824-1127-0x0000000007180000-0x0000000007190000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y82mv05.exelegenda.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation y82mv05.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation legenda.exe -
Executes dropped EXE 12 IoCs
Processes:
zap2010.exezap0105.exezap3628.exetz0468.exev2433VQ.exew82QZ85.exexteqX77.exey82mv05.exelegenda.exeSprawl.exeSprawl.exelegenda.exepid process 1276 zap2010.exe 684 zap0105.exe 2028 zap3628.exe 2804 tz0468.exe 3940 v2433VQ.exe 824 w82QZ85.exe 4388 xteqX77.exe 1324 y82mv05.exe 2916 legenda.exe 4984 Sprawl.exe 5076 Sprawl.exe 4112 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1324 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz0468.exev2433VQ.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz0468.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v2433VQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v2433VQ.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap3628.exef332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exezap2010.exezap0105.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap3628.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap2010.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap2010.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap0105.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap0105.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap3628.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Sprawl.exedescription pid process target process PID 4984 set thread context of 5076 4984 Sprawl.exe Sprawl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3736 3940 WerFault.exe v2433VQ.exe 1452 824 WerFault.exe w82QZ85.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
tz0468.exev2433VQ.exew82QZ85.exexteqX77.exeSprawl.exepid process 2804 tz0468.exe 2804 tz0468.exe 3940 v2433VQ.exe 3940 v2433VQ.exe 824 w82QZ85.exe 824 w82QZ85.exe 4388 xteqX77.exe 4388 xteqX77.exe 5076 Sprawl.exe 5076 Sprawl.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
tz0468.exev2433VQ.exew82QZ85.exexteqX77.exeSprawl.exedescription pid process Token: SeDebugPrivilege 2804 tz0468.exe Token: SeDebugPrivilege 3940 v2433VQ.exe Token: SeDebugPrivilege 824 w82QZ85.exe Token: SeDebugPrivilege 4388 xteqX77.exe Token: SeDebugPrivilege 5076 Sprawl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exezap2010.exezap0105.exezap3628.exey82mv05.exelegenda.execmd.exeSprawl.exedescription pid process target process PID 1792 wrote to memory of 1276 1792 f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe zap2010.exe PID 1792 wrote to memory of 1276 1792 f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe zap2010.exe PID 1792 wrote to memory of 1276 1792 f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe zap2010.exe PID 1276 wrote to memory of 684 1276 zap2010.exe zap0105.exe PID 1276 wrote to memory of 684 1276 zap2010.exe zap0105.exe PID 1276 wrote to memory of 684 1276 zap2010.exe zap0105.exe PID 684 wrote to memory of 2028 684 zap0105.exe zap3628.exe PID 684 wrote to memory of 2028 684 zap0105.exe zap3628.exe PID 684 wrote to memory of 2028 684 zap0105.exe zap3628.exe PID 2028 wrote to memory of 2804 2028 zap3628.exe tz0468.exe PID 2028 wrote to memory of 2804 2028 zap3628.exe tz0468.exe PID 2028 wrote to memory of 3940 2028 zap3628.exe v2433VQ.exe PID 2028 wrote to memory of 3940 2028 zap3628.exe v2433VQ.exe PID 2028 wrote to memory of 3940 2028 zap3628.exe v2433VQ.exe PID 684 wrote to memory of 824 684 zap0105.exe w82QZ85.exe PID 684 wrote to memory of 824 684 zap0105.exe w82QZ85.exe PID 684 wrote to memory of 824 684 zap0105.exe w82QZ85.exe PID 1276 wrote to memory of 4388 1276 zap2010.exe xteqX77.exe PID 1276 wrote to memory of 4388 1276 zap2010.exe xteqX77.exe PID 1276 wrote to memory of 4388 1276 zap2010.exe xteqX77.exe PID 1792 wrote to memory of 1324 1792 f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe y82mv05.exe PID 1792 wrote to memory of 1324 1792 f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe y82mv05.exe PID 1792 wrote to memory of 1324 1792 f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe y82mv05.exe PID 1324 wrote to memory of 2916 1324 y82mv05.exe legenda.exe PID 1324 wrote to memory of 2916 1324 y82mv05.exe legenda.exe PID 1324 wrote to memory of 2916 1324 y82mv05.exe legenda.exe PID 2916 wrote to memory of 1664 2916 legenda.exe schtasks.exe PID 2916 wrote to memory of 1664 2916 legenda.exe schtasks.exe PID 2916 wrote to memory of 1664 2916 legenda.exe schtasks.exe PID 2916 wrote to memory of 664 2916 legenda.exe cmd.exe PID 2916 wrote to memory of 664 2916 legenda.exe cmd.exe PID 2916 wrote to memory of 664 2916 legenda.exe cmd.exe PID 664 wrote to memory of 2740 664 cmd.exe cmd.exe PID 664 wrote to memory of 2740 664 cmd.exe cmd.exe PID 664 wrote to memory of 2740 664 cmd.exe cmd.exe PID 664 wrote to memory of 4944 664 cmd.exe cacls.exe PID 664 wrote to memory of 4944 664 cmd.exe cacls.exe PID 664 wrote to memory of 4944 664 cmd.exe cacls.exe PID 664 wrote to memory of 4792 664 cmd.exe cacls.exe PID 664 wrote to memory of 4792 664 cmd.exe cacls.exe PID 664 wrote to memory of 4792 664 cmd.exe cacls.exe PID 664 wrote to memory of 4892 664 cmd.exe cmd.exe PID 664 wrote to memory of 4892 664 cmd.exe cmd.exe PID 664 wrote to memory of 4892 664 cmd.exe cmd.exe PID 664 wrote to memory of 4900 664 cmd.exe cacls.exe PID 664 wrote to memory of 4900 664 cmd.exe cacls.exe PID 664 wrote to memory of 4900 664 cmd.exe cacls.exe PID 664 wrote to memory of 4612 664 cmd.exe cacls.exe PID 664 wrote to memory of 4612 664 cmd.exe cacls.exe PID 664 wrote to memory of 4612 664 cmd.exe cacls.exe PID 2916 wrote to memory of 4984 2916 legenda.exe Sprawl.exe PID 2916 wrote to memory of 4984 2916 legenda.exe Sprawl.exe PID 2916 wrote to memory of 4984 2916 legenda.exe Sprawl.exe PID 4984 wrote to memory of 5076 4984 Sprawl.exe Sprawl.exe PID 4984 wrote to memory of 5076 4984 Sprawl.exe Sprawl.exe PID 4984 wrote to memory of 5076 4984 Sprawl.exe Sprawl.exe PID 4984 wrote to memory of 5076 4984 Sprawl.exe Sprawl.exe PID 4984 wrote to memory of 5076 4984 Sprawl.exe Sprawl.exe PID 4984 wrote to memory of 5076 4984 Sprawl.exe Sprawl.exe PID 4984 wrote to memory of 5076 4984 Sprawl.exe Sprawl.exe PID 4984 wrote to memory of 5076 4984 Sprawl.exe Sprawl.exe PID 2916 wrote to memory of 1324 2916 legenda.exe rundll32.exe PID 2916 wrote to memory of 1324 2916 legenda.exe rundll32.exe PID 2916 wrote to memory of 1324 2916 legenda.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe"C:\Users\Admin\AppData\Local\Temp\f332d4875800b8cd8eb0e48f973df4eb8735ffb87b8d1756da8a0145e5969ba2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2010.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2010.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0105.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0105.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3628.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3628.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0468.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0468.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2433VQ.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2433VQ.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 10166⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w82QZ85.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w82QZ85.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 13285⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xteqX77.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xteqX77.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y82mv05.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y82mv05.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe"C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeC:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3940 -ip 39401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 824 -ip 8241⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sprawl.exe.logFilesize
1KB
MD5a3c82409506a33dec1856104ca55cbfd
SHA12e2ba4e4227590f8821002831c5410f7f45fe812
SHA256780a0d4410f5f9798cb573bcd774561d1439987a39b1368d3c890226928cd203
SHA5129621cfd3dab86d964a2bea6b3788fc19a895307962dcc41428741b8a86291f114df722e9017f755f63d53d09b5111e68f05aa505d9c9deae6c4378a87cdfa69f
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeFilesize
895KB
MD57f9cc3889e95b39a93593207cc823dd2
SHA1553b922ae2d755e012792ab495c879f63ab3b923
SHA256d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
SHA5125a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeFilesize
895KB
MD57f9cc3889e95b39a93593207cc823dd2
SHA1553b922ae2d755e012792ab495c879f63ab3b923
SHA256d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
SHA5125a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeFilesize
895KB
MD57f9cc3889e95b39a93593207cc823dd2
SHA1553b922ae2d755e012792ab495c879f63ab3b923
SHA256d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
SHA5125a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeFilesize
895KB
MD57f9cc3889e95b39a93593207cc823dd2
SHA1553b922ae2d755e012792ab495c879f63ab3b923
SHA256d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
SHA5125a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y82mv05.exeFilesize
235KB
MD5e7b051683cfb2a613c49469aac05b583
SHA1b798a977f119d76dbc84980eceb2faa53a2d8b33
SHA2566188c0a9c78aeeb4624b382565e552b72c174816069f6bb785b2e3da99e0d588
SHA512532479812348f00c8af19986a4adbe5392e74756eba9b9dc2c092b672400affe67841beed64c38e1407c07b5c2904897e5f53711e72eb8a3fd0d7c3b3352694a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y82mv05.exeFilesize
235KB
MD5e7b051683cfb2a613c49469aac05b583
SHA1b798a977f119d76dbc84980eceb2faa53a2d8b33
SHA2566188c0a9c78aeeb4624b382565e552b72c174816069f6bb785b2e3da99e0d588
SHA512532479812348f00c8af19986a4adbe5392e74756eba9b9dc2c092b672400affe67841beed64c38e1407c07b5c2904897e5f53711e72eb8a3fd0d7c3b3352694a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2010.exeFilesize
854KB
MD5feb01b4ea19a63338edeed478ea55db1
SHA163085837bbf21e98d78462e93948b82f9fcc06a2
SHA2566a02581ee885f9a6934b94cd3dd2e3b886d0f7cbbcfa97fdfc8ea09a37b1e859
SHA512e5fb11a793eba4a69a78495d6c6027f57f3d74dbb4ac54bde58a0b1dd90d08cbaeecf2f022a0408a617116b3315ee9c2c89656779ed92a83efa254748771cb2a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2010.exeFilesize
854KB
MD5feb01b4ea19a63338edeed478ea55db1
SHA163085837bbf21e98d78462e93948b82f9fcc06a2
SHA2566a02581ee885f9a6934b94cd3dd2e3b886d0f7cbbcfa97fdfc8ea09a37b1e859
SHA512e5fb11a793eba4a69a78495d6c6027f57f3d74dbb4ac54bde58a0b1dd90d08cbaeecf2f022a0408a617116b3315ee9c2c89656779ed92a83efa254748771cb2a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xteqX77.exeFilesize
175KB
MD5df452164e4047e9d59dedb167cdfd080
SHA17655c43377e77d991fdf4363a944f17fcbf7f9d3
SHA2564427330ceaac5cae40c5263a8aff115696af18e5eea88a53aaed1ba1578109a0
SHA512b7772285d6ba5cf9a4f8b3839301e9c825bd72fd8d085ffe5ef8c2a914886e95a15e77c5c9c4a0abe4f40d5cef98a42289535b78cfe1b2fd4e482fe5df357124
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xteqX77.exeFilesize
175KB
MD5df452164e4047e9d59dedb167cdfd080
SHA17655c43377e77d991fdf4363a944f17fcbf7f9d3
SHA2564427330ceaac5cae40c5263a8aff115696af18e5eea88a53aaed1ba1578109a0
SHA512b7772285d6ba5cf9a4f8b3839301e9c825bd72fd8d085ffe5ef8c2a914886e95a15e77c5c9c4a0abe4f40d5cef98a42289535b78cfe1b2fd4e482fe5df357124
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0105.exeFilesize
712KB
MD5e1838b374683003f388519c017172562
SHA1d95f831df995cba4428ba72925e5508b93e2b6bd
SHA256e7b2438e729ee2231a587fa34f9d0b21aee7c3b4f3481eab7c039331bd4682fb
SHA512d2d35d699bb35c74f058ee2a8c1c9da6999697428b5bbbf556dd5eacaeb6454c9942aa560e056aeb99e7739ace420f74e058b39117e8330b653e0c1d778dc334
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0105.exeFilesize
712KB
MD5e1838b374683003f388519c017172562
SHA1d95f831df995cba4428ba72925e5508b93e2b6bd
SHA256e7b2438e729ee2231a587fa34f9d0b21aee7c3b4f3481eab7c039331bd4682fb
SHA512d2d35d699bb35c74f058ee2a8c1c9da6999697428b5bbbf556dd5eacaeb6454c9942aa560e056aeb99e7739ace420f74e058b39117e8330b653e0c1d778dc334
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w82QZ85.exeFilesize
383KB
MD5af07d49da66ae0126f59be8f53a53860
SHA196e8737ab68a90348de7d5bfb50a95a2587add04
SHA256747d7b3770089b7fc710513042065ec50f8bdcfaaef825edb8b7c5528181ef87
SHA5121b61d2b2ac26b714cfd428110ae83bf8cdca8ca6797417c7c45617cb334d0b0b37071d8905249eb86722151aaa8fd8c50cc4968c17b7e8f9b1a764a767a22f87
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w82QZ85.exeFilesize
383KB
MD5af07d49da66ae0126f59be8f53a53860
SHA196e8737ab68a90348de7d5bfb50a95a2587add04
SHA256747d7b3770089b7fc710513042065ec50f8bdcfaaef825edb8b7c5528181ef87
SHA5121b61d2b2ac26b714cfd428110ae83bf8cdca8ca6797417c7c45617cb334d0b0b37071d8905249eb86722151aaa8fd8c50cc4968c17b7e8f9b1a764a767a22f87
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3628.exeFilesize
353KB
MD51922428a8fc23262bdcf9689c91c77f0
SHA12a7b083dff99133394881f07eafc70202c9e4c0e
SHA25696b6d3840a6e3a581d2071d8682bf45a133021c2eaf7de21e502eb5b3d0952f7
SHA512d5636d451ed3dabd0c26810ec9988dd7d76683c1bf0da9bffdfa373001e246e5749adfa8adab34a47e09ba9f6bd42f17a50384cb14e350ce20331fd551ed2c55
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3628.exeFilesize
353KB
MD51922428a8fc23262bdcf9689c91c77f0
SHA12a7b083dff99133394881f07eafc70202c9e4c0e
SHA25696b6d3840a6e3a581d2071d8682bf45a133021c2eaf7de21e502eb5b3d0952f7
SHA512d5636d451ed3dabd0c26810ec9988dd7d76683c1bf0da9bffdfa373001e246e5749adfa8adab34a47e09ba9f6bd42f17a50384cb14e350ce20331fd551ed2c55
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0468.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0468.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2433VQ.exeFilesize
325KB
MD505f03bdc157b65a0a253151d9a99eaed
SHA159d90e587663d19604bb468c3eaae89a21f87387
SHA256f6e1efc2e290d76b8d9a8e0fb41acf36dad39cd128bdf139530f791298dd7c5f
SHA51281a67012cd7f925a723211ba0d6f7ed90f68dce5190a76d2cff643e9a80998e4c620eeaa3fd9e9ca50457ab9e5852101c3f35fefe13fea31d4ef326cba144f57
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2433VQ.exeFilesize
325KB
MD505f03bdc157b65a0a253151d9a99eaed
SHA159d90e587663d19604bb468c3eaae89a21f87387
SHA256f6e1efc2e290d76b8d9a8e0fb41acf36dad39cd128bdf139530f791298dd7c5f
SHA51281a67012cd7f925a723211ba0d6f7ed90f68dce5190a76d2cff643e9a80998e4c620eeaa3fd9e9ca50457ab9e5852101c3f35fefe13fea31d4ef326cba144f57
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD5e7b051683cfb2a613c49469aac05b583
SHA1b798a977f119d76dbc84980eceb2faa53a2d8b33
SHA2566188c0a9c78aeeb4624b382565e552b72c174816069f6bb785b2e3da99e0d588
SHA512532479812348f00c8af19986a4adbe5392e74756eba9b9dc2c092b672400affe67841beed64c38e1407c07b5c2904897e5f53711e72eb8a3fd0d7c3b3352694a
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD5e7b051683cfb2a613c49469aac05b583
SHA1b798a977f119d76dbc84980eceb2faa53a2d8b33
SHA2566188c0a9c78aeeb4624b382565e552b72c174816069f6bb785b2e3da99e0d588
SHA512532479812348f00c8af19986a4adbe5392e74756eba9b9dc2c092b672400affe67841beed64c38e1407c07b5c2904897e5f53711e72eb8a3fd0d7c3b3352694a
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD5e7b051683cfb2a613c49469aac05b583
SHA1b798a977f119d76dbc84980eceb2faa53a2d8b33
SHA2566188c0a9c78aeeb4624b382565e552b72c174816069f6bb785b2e3da99e0d588
SHA512532479812348f00c8af19986a4adbe5392e74756eba9b9dc2c092b672400affe67841beed64c38e1407c07b5c2904897e5f53711e72eb8a3fd0d7c3b3352694a
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD5e7b051683cfb2a613c49469aac05b583
SHA1b798a977f119d76dbc84980eceb2faa53a2d8b33
SHA2566188c0a9c78aeeb4624b382565e552b72c174816069f6bb785b2e3da99e0d588
SHA512532479812348f00c8af19986a4adbe5392e74756eba9b9dc2c092b672400affe67841beed64c38e1407c07b5c2904897e5f53711e72eb8a3fd0d7c3b3352694a
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/824-1133-0x000000000A020000-0x000000000A1E2000-memory.dmpFilesize
1.8MB
-
memory/824-1124-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/824-1135-0x000000000A200000-0x000000000A72C000-memory.dmpFilesize
5.2MB
-
memory/824-1134-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/824-1132-0x0000000009FC0000-0x000000000A010000-memory.dmpFilesize
320KB
-
memory/824-1131-0x0000000009F30000-0x0000000009FA6000-memory.dmpFilesize
472KB
-
memory/824-1130-0x0000000008A90000-0x0000000008B22000-memory.dmpFilesize
584KB
-
memory/824-1129-0x00000000083C0000-0x0000000008426000-memory.dmpFilesize
408KB
-
memory/824-1128-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/824-210-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-211-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-213-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-215-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-217-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-219-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-221-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-223-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-225-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-227-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-229-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-230-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/824-233-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-235-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/824-234-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/824-232-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/824-237-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-239-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-241-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-243-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-245-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-247-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/824-1120-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/824-1121-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/824-1122-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/824-1123-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/824-1127-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/824-1126-0x0000000007180000-0x0000000007190000-memory.dmpFilesize
64KB
-
memory/2804-161-0x0000000000BA0000-0x0000000000BAA000-memory.dmpFilesize
40KB
-
memory/3940-181-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-168-0x0000000007330000-0x00000000078D4000-memory.dmpFilesize
5.6MB
-
memory/3940-205-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/3940-203-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/3940-202-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/3940-193-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-179-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-200-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/3940-191-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-189-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-183-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-167-0x0000000002C50000-0x0000000002C7D000-memory.dmpFilesize
180KB
-
memory/3940-187-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-185-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-195-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-197-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-201-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/3940-177-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-175-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-173-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-199-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-169-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/3940-172-0x0000000004A80000-0x0000000004A92000-memory.dmpFilesize
72KB
-
memory/3940-170-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/3940-171-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4388-1143-0x0000000005A80000-0x0000000005A90000-memory.dmpFilesize
64KB
-
memory/4388-1142-0x0000000000EB0000-0x0000000000EE2000-memory.dmpFilesize
200KB
-
memory/4984-1177-0x0000000005780000-0x0000000005790000-memory.dmpFilesize
64KB
-
memory/4984-1176-0x0000000000E70000-0x0000000000F56000-memory.dmpFilesize
920KB
-
memory/5076-1183-0x0000000005920000-0x0000000005930000-memory.dmpFilesize
64KB
-
memory/5076-1184-0x0000000005920000-0x0000000005930000-memory.dmpFilesize
64KB
-
memory/5076-1182-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB