Analysis
-
max time kernel
138s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 19:21
Static task
static1
Behavioral task
behavioral1
Sample
0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe
-
Size
994KB
-
MD5
78f63571bbb9a593485bb31bb2a9b824
-
SHA1
fb51c8f1f22f3b1d8952e9741aa0312d6cf156ea
-
SHA256
0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964
-
SHA512
803f875da9958b73c10089d4969f25b7d7448e3596a6192e374d2b51feaf85bef565af84b35f761f3f4c0cb4ce55f64cd045ae3cadb14caa0bca25bbbf55a3da
-
SSDEEP
24576:by74zbkeDvVu+lV97p33EiCvfHb1hcZp:OkbkeDvw+j97pnElU
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6617952.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6617952.exe healer behavioral2/memory/2132-35-0x0000000000600000-0x000000000060A000-memory.dmp healer -
Processes:
q6617952.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q6617952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q6617952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q6617952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q6617952.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q6617952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q6617952.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t2231419.exeexplothe.exeu4958323.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation t2231419.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation u4958323.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z0797637.exez3854335.exez7837364.exez4092736.exeq6617952.exer9937087.exes2659233.exet2231419.exeexplothe.exeu4958323.exelegota.exew4431839.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 3852 z0797637.exe 1648 z3854335.exe 1748 z7837364.exe 1544 z4092736.exe 2132 q6617952.exe 3500 r9937087.exe 4056 s2659233.exe 3560 t2231419.exe 2280 explothe.exe 3724 u4958323.exe 2828 legota.exe 2388 w4431839.exe 4612 explothe.exe 3560 legota.exe 3628 explothe.exe 4940 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1388 rundll32.exe 4220 rundll32.exe -
Processes:
q6617952.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q6617952.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exez0797637.exez3854335.exez7837364.exez4092736.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z0797637.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3854335.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z7837364.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z4092736.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r9937087.exes2659233.exedescription pid process target process PID 3500 set thread context of 1640 3500 r9937087.exe AppLaunch.exe PID 4056 set thread context of 3480 4056 s2659233.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 116 3500 WerFault.exe r9937087.exe 4208 1640 WerFault.exe AppLaunch.exe 1652 4056 WerFault.exe s2659233.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 412 schtasks.exe 3636 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q6617952.exepid process 2132 q6617952.exe 2132 q6617952.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q6617952.exedescription pid process Token: SeDebugPrivilege 2132 q6617952.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exez0797637.exez3854335.exez7837364.exez4092736.exer9937087.exes2659233.exet2231419.exeexplothe.exeu4958323.execmd.exedescription pid process target process PID 5032 wrote to memory of 3852 5032 0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe z0797637.exe PID 5032 wrote to memory of 3852 5032 0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe z0797637.exe PID 5032 wrote to memory of 3852 5032 0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe z0797637.exe PID 3852 wrote to memory of 1648 3852 z0797637.exe z3854335.exe PID 3852 wrote to memory of 1648 3852 z0797637.exe z3854335.exe PID 3852 wrote to memory of 1648 3852 z0797637.exe z3854335.exe PID 1648 wrote to memory of 1748 1648 z3854335.exe z7837364.exe PID 1648 wrote to memory of 1748 1648 z3854335.exe z7837364.exe PID 1648 wrote to memory of 1748 1648 z3854335.exe z7837364.exe PID 1748 wrote to memory of 1544 1748 z7837364.exe z4092736.exe PID 1748 wrote to memory of 1544 1748 z7837364.exe z4092736.exe PID 1748 wrote to memory of 1544 1748 z7837364.exe z4092736.exe PID 1544 wrote to memory of 2132 1544 z4092736.exe q6617952.exe PID 1544 wrote to memory of 2132 1544 z4092736.exe q6617952.exe PID 1544 wrote to memory of 3500 1544 z4092736.exe r9937087.exe PID 1544 wrote to memory of 3500 1544 z4092736.exe r9937087.exe PID 1544 wrote to memory of 3500 1544 z4092736.exe r9937087.exe PID 3500 wrote to memory of 2644 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 2644 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 2644 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 3500 wrote to memory of 1640 3500 r9937087.exe AppLaunch.exe PID 1748 wrote to memory of 4056 1748 z7837364.exe s2659233.exe PID 1748 wrote to memory of 4056 1748 z7837364.exe s2659233.exe PID 1748 wrote to memory of 4056 1748 z7837364.exe s2659233.exe PID 4056 wrote to memory of 3480 4056 s2659233.exe AppLaunch.exe PID 4056 wrote to memory of 3480 4056 s2659233.exe AppLaunch.exe PID 4056 wrote to memory of 3480 4056 s2659233.exe AppLaunch.exe PID 4056 wrote to memory of 3480 4056 s2659233.exe AppLaunch.exe PID 4056 wrote to memory of 3480 4056 s2659233.exe AppLaunch.exe PID 4056 wrote to memory of 3480 4056 s2659233.exe AppLaunch.exe PID 4056 wrote to memory of 3480 4056 s2659233.exe AppLaunch.exe PID 4056 wrote to memory of 3480 4056 s2659233.exe AppLaunch.exe PID 1648 wrote to memory of 3560 1648 z3854335.exe t2231419.exe PID 1648 wrote to memory of 3560 1648 z3854335.exe t2231419.exe PID 1648 wrote to memory of 3560 1648 z3854335.exe t2231419.exe PID 3560 wrote to memory of 2280 3560 t2231419.exe explothe.exe PID 3560 wrote to memory of 2280 3560 t2231419.exe explothe.exe PID 3560 wrote to memory of 2280 3560 t2231419.exe explothe.exe PID 3852 wrote to memory of 3724 3852 z0797637.exe u4958323.exe PID 3852 wrote to memory of 3724 3852 z0797637.exe u4958323.exe PID 3852 wrote to memory of 3724 3852 z0797637.exe u4958323.exe PID 2280 wrote to memory of 412 2280 explothe.exe schtasks.exe PID 2280 wrote to memory of 412 2280 explothe.exe schtasks.exe PID 2280 wrote to memory of 412 2280 explothe.exe schtasks.exe PID 2280 wrote to memory of 4668 2280 explothe.exe cmd.exe PID 2280 wrote to memory of 4668 2280 explothe.exe cmd.exe PID 2280 wrote to memory of 4668 2280 explothe.exe cmd.exe PID 3724 wrote to memory of 2828 3724 u4958323.exe legota.exe PID 3724 wrote to memory of 2828 3724 u4958323.exe legota.exe PID 3724 wrote to memory of 2828 3724 u4958323.exe legota.exe PID 4668 wrote to memory of 3796 4668 cmd.exe cmd.exe PID 4668 wrote to memory of 3796 4668 cmd.exe cmd.exe PID 4668 wrote to memory of 3796 4668 cmd.exe cmd.exe PID 5032 wrote to memory of 2388 5032 0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe w4431839.exe PID 5032 wrote to memory of 2388 5032 0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe w4431839.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe"C:\Users\Admin\AppData\Local\Temp\0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0797637.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0797637.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3854335.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3854335.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7837364.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7837364.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4092736.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4092736.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6617952.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6617952.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9937087.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9937087.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:2644
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 5408⤵
- Program crash
PID:4208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 5967⤵
- Program crash
PID:116 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2659233.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2659233.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:3480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 1526⤵
- Program crash
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2231419.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2231419.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:412 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3796
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:1752
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:2188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:992
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:2820
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:560
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4958323.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4958323.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:3636 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:4928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2768
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:1352
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:4000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2448
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:352
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:3296
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4431839.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4431839.exe2⤵
- Executes dropped EXE
PID:2388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3500 -ip 35001⤵PID:4520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1640 -ip 16401⤵PID:4616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4056 -ip 40561⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:4612
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:3560
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:3628
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4940
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4431839.exeFilesize
23KB
MD59da3d3daf11976e106f3009c9de0959d
SHA184c3392e043793a3c5c522bea684b41ec90dd2e9
SHA256399a8df8bb93107d248d7b5d2fa11b3e8f5077276182a4f2d0c866ec333f704c
SHA5127058c766e7c0f6caf1c74e743a7ca0fade50579356adbac8cc41ce8e0581d3d03c03ad427fb8ca1e5707686f970f8b9823be100bc938fbd55ba03be988772074
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4431839.exeFilesize
23KB
MD59da3d3daf11976e106f3009c9de0959d
SHA184c3392e043793a3c5c522bea684b41ec90dd2e9
SHA256399a8df8bb93107d248d7b5d2fa11b3e8f5077276182a4f2d0c866ec333f704c
SHA5127058c766e7c0f6caf1c74e743a7ca0fade50579356adbac8cc41ce8e0581d3d03c03ad427fb8ca1e5707686f970f8b9823be100bc938fbd55ba03be988772074
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0797637.exeFilesize
892KB
MD5b5ec6b040960a68da4d22b7d72521a19
SHA1b3903b62fb002708c30158efaadc074b31c7298a
SHA2568b9245c0a6f0ef94d89cc7706b024d388ab8fc421e9e6fc0710b17d1f3115754
SHA512d3edae257a91b1a3c56cbb7b8e1d69133a1852be5bbedd004d1662434e0fddde821dcc98c0deab5b7644d6cc396447f256a79bd76cf39214767fdf214eb8ef73
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0797637.exeFilesize
892KB
MD5b5ec6b040960a68da4d22b7d72521a19
SHA1b3903b62fb002708c30158efaadc074b31c7298a
SHA2568b9245c0a6f0ef94d89cc7706b024d388ab8fc421e9e6fc0710b17d1f3115754
SHA512d3edae257a91b1a3c56cbb7b8e1d69133a1852be5bbedd004d1662434e0fddde821dcc98c0deab5b7644d6cc396447f256a79bd76cf39214767fdf214eb8ef73
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4958323.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4958323.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3854335.exeFilesize
709KB
MD50e386bf084e19b8505489a9d920af86f
SHA1ccbe41e4faa471d7cacbff7cbe066eca020db285
SHA25663b10b5389ee5d8a24653b3aae9991e62b9b62e43ff34d7a21299bd866943a8a
SHA51285ea0c02985052367dcf6e7be5ac069c440a5b286fda4b4f7145226d71d89d313904244fa85470711a327068d1f4fc5e5f628a00fbb3e1f746285ce877624b0b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3854335.exeFilesize
709KB
MD50e386bf084e19b8505489a9d920af86f
SHA1ccbe41e4faa471d7cacbff7cbe066eca020db285
SHA25663b10b5389ee5d8a24653b3aae9991e62b9b62e43ff34d7a21299bd866943a8a
SHA51285ea0c02985052367dcf6e7be5ac069c440a5b286fda4b4f7145226d71d89d313904244fa85470711a327068d1f4fc5e5f628a00fbb3e1f746285ce877624b0b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2231419.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2231419.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7837364.exeFilesize
527KB
MD59949178dbfe943632f0732292c324c87
SHA136c0f673629c229906ce3f40c692b67ec5230fbb
SHA2565b747bd9669f5d4f25ef261b01c18a3a5def90145e6cf35ca0e4298959dc3bc3
SHA512d67a57ee208822f9eda86f0e074f4f1b3fa5720632e2c99ed5b3312c71940844850f099f904ac924408606273858a09cf776fd699fc6b75a98a5b5d29fba4db3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7837364.exeFilesize
527KB
MD59949178dbfe943632f0732292c324c87
SHA136c0f673629c229906ce3f40c692b67ec5230fbb
SHA2565b747bd9669f5d4f25ef261b01c18a3a5def90145e6cf35ca0e4298959dc3bc3
SHA512d67a57ee208822f9eda86f0e074f4f1b3fa5720632e2c99ed5b3312c71940844850f099f904ac924408606273858a09cf776fd699fc6b75a98a5b5d29fba4db3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2659233.exeFilesize
310KB
MD562340e08e647931fdfa052b920baea4d
SHA169a3c6de6b3b94080ecd45bf46f4491a7027d135
SHA25670bc1382073b54c39b52474669cfa182dbc3c803279047876681138b5c36befc
SHA512933e80b28538d69f830c5862abce96f0f9617ffba916c18eb9d933ff33e5627f3e39914a35ae30d99fc2aa913274c4a2c3704dc3f352a85b6075de93e745a422
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2659233.exeFilesize
310KB
MD562340e08e647931fdfa052b920baea4d
SHA169a3c6de6b3b94080ecd45bf46f4491a7027d135
SHA25670bc1382073b54c39b52474669cfa182dbc3c803279047876681138b5c36befc
SHA512933e80b28538d69f830c5862abce96f0f9617ffba916c18eb9d933ff33e5627f3e39914a35ae30d99fc2aa913274c4a2c3704dc3f352a85b6075de93e745a422
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4092736.exeFilesize
296KB
MD5af1b76d182be224ef803c15f5602252b
SHA154475a891a4bce7743bb4b6f8f68acc45bf736c0
SHA256ea28d7438f8407cd31f60c23eb5edf7b35135b4643fce4002adf07e20c88ddad
SHA5126560f7f6d7e3542c9b5affd7e43860ba8c4f15b5f96b9c79e813ddca86a366d88c1e4b7557fb3b2350bcc98d8e3b64d0615f1322e2864eb152cf6891a1940b7d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4092736.exeFilesize
296KB
MD5af1b76d182be224ef803c15f5602252b
SHA154475a891a4bce7743bb4b6f8f68acc45bf736c0
SHA256ea28d7438f8407cd31f60c23eb5edf7b35135b4643fce4002adf07e20c88ddad
SHA5126560f7f6d7e3542c9b5affd7e43860ba8c4f15b5f96b9c79e813ddca86a366d88c1e4b7557fb3b2350bcc98d8e3b64d0615f1322e2864eb152cf6891a1940b7d
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6617952.exeFilesize
11KB
MD54f9df13f55db7e272b5a251a629a38df
SHA10855391a0a4de1e1e2e7bdffafb7000388a46269
SHA256a0abc6bc9d8eeb76dc4fd89edaf55ee9af25773a61a2e83328ff4e1b94fcbe92
SHA5121684313553ebb844ea67ddcffb945361697dd8f47511a5d91a1badb9e9ee530272877f0a8eff3702ab0e4263e72e39133ecc9c3a2027c742151c02e0789716ac
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6617952.exeFilesize
11KB
MD54f9df13f55db7e272b5a251a629a38df
SHA10855391a0a4de1e1e2e7bdffafb7000388a46269
SHA256a0abc6bc9d8eeb76dc4fd89edaf55ee9af25773a61a2e83328ff4e1b94fcbe92
SHA5121684313553ebb844ea67ddcffb945361697dd8f47511a5d91a1badb9e9ee530272877f0a8eff3702ab0e4263e72e39133ecc9c3a2027c742151c02e0789716ac
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9937087.exeFilesize
276KB
MD5f057dbc1142027327e7e410c0aa4cf4f
SHA17819a95109f69d7797437978143d7fd186018f84
SHA2566b2adcc0cf68f816548563f69c48f2613c78907fd007f80008085bfcafd02647
SHA5128d90d90e7f1c8aab2482d04084d8a0c19828f2364ebc94eaf3740e6150e7f0fe1e5d3a3409bbf544f6a0845a9f1821b999712708553604f4f493e3ae4da8215a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9937087.exeFilesize
276KB
MD5f057dbc1142027327e7e410c0aa4cf4f
SHA17819a95109f69d7797437978143d7fd186018f84
SHA2566b2adcc0cf68f816548563f69c48f2613c78907fd007f80008085bfcafd02647
SHA5128d90d90e7f1c8aab2482d04084d8a0c19828f2364ebc94eaf3740e6150e7f0fe1e5d3a3409bbf544f6a0845a9f1821b999712708553604f4f493e3ae4da8215a
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1640-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1640-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1640-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1640-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2132-36-0x00007FFDCE800000-0x00007FFDCF2C1000-memory.dmpFilesize
10.8MB
-
memory/2132-38-0x00007FFDCE800000-0x00007FFDCF2C1000-memory.dmpFilesize
10.8MB
-
memory/2132-35-0x0000000000600000-0x000000000060A000-memory.dmpFilesize
40KB
-
memory/3480-62-0x0000000005F10000-0x0000000006528000-memory.dmpFilesize
6.1MB
-
memory/3480-87-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB
-
memory/3480-86-0x0000000073B70000-0x0000000074320000-memory.dmpFilesize
7.7MB
-
memory/3480-84-0x0000000005B10000-0x0000000005B5C000-memory.dmpFilesize
304KB
-
memory/3480-74-0x0000000005980000-0x00000000059BC000-memory.dmpFilesize
240KB
-
memory/3480-67-0x0000000005920000-0x0000000005932000-memory.dmpFilesize
72KB
-
memory/3480-68-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB
-
memory/3480-65-0x0000000005A00000-0x0000000005B0A000-memory.dmpFilesize
1.0MB
-
memory/3480-52-0x0000000003210000-0x0000000003216000-memory.dmpFilesize
24KB
-
memory/3480-51-0x0000000073B70000-0x0000000074320000-memory.dmpFilesize
7.7MB
-
memory/3480-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB