Analysis
-
max time kernel
147s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 19:23
Static task
static1
Behavioral task
behavioral1
Sample
12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe
-
Size
1.0MB
-
MD5
2bb673d7b9c1f5dec5914b54316286c5
-
SHA1
f1c0205af04426008d3d445b1e80296f9bf27644
-
SHA256
12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699
-
SHA512
f18dde9dff239d0f28b9d01e07e16d689bf79b0331ce0e58811f83ed0a20becb464fb3869dda6d7ee0bc698034ebbbebd3ad0819cec296207196211744e3ab33
-
SSDEEP
24576:9yAARdwU4Ug4M40HtkJgCXaBfiXe9dshOqAqgoPE3xLAFD:YKUvv0H6kZiXTh4qgogA
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8750021.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8750021.exe healer behavioral2/memory/856-35-0x0000000000220000-0x000000000022A000-memory.dmp healer -
Processes:
q8750021.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q8750021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q8750021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q8750021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q8750021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q8750021.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q8750021.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t0759320.exeu6241751.exeexplothe.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation t0759320.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation u6241751.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z1002274.exez9916007.exez0951157.exez4321293.exeq8750021.exer4351079.exes1860196.exet0759320.exeexplothe.exeu6241751.exelegota.exew7611989.exelegota.exeexplothe.exelegota.exeexplothe.exepid process 4016 z1002274.exe 4128 z9916007.exe 1032 z0951157.exe 924 z4321293.exe 856 q8750021.exe 1760 r4351079.exe 4240 s1860196.exe 2040 t0759320.exe 4236 explothe.exe 872 u6241751.exe 4516 legota.exe 392 w7611989.exe 4908 legota.exe 2896 explothe.exe 556 legota.exe 4868 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1004 rundll32.exe 2292 rundll32.exe -
Processes:
q8750021.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q8750021.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z9916007.exez0951157.exez4321293.exe12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exez1002274.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z9916007.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z0951157.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z4321293.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1002274.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r4351079.exes1860196.exedescription pid process target process PID 1760 set thread context of 4396 1760 r4351079.exe AppLaunch.exe PID 4240 set thread context of 1944 4240 s1860196.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 932 4396 WerFault.exe AppLaunch.exe 3544 1760 WerFault.exe r4351079.exe 4936 4240 WerFault.exe s1860196.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5028 schtasks.exe 4736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q8750021.exepid process 856 q8750021.exe 856 q8750021.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q8750021.exedescription pid process Token: SeDebugPrivilege 856 q8750021.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exez1002274.exez9916007.exez0951157.exez4321293.exer4351079.exes1860196.exet0759320.exeu6241751.exeexplothe.exelegota.exedescription pid process target process PID 3348 wrote to memory of 4016 3348 12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe z1002274.exe PID 3348 wrote to memory of 4016 3348 12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe z1002274.exe PID 3348 wrote to memory of 4016 3348 12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe z1002274.exe PID 4016 wrote to memory of 4128 4016 z1002274.exe z9916007.exe PID 4016 wrote to memory of 4128 4016 z1002274.exe z9916007.exe PID 4016 wrote to memory of 4128 4016 z1002274.exe z9916007.exe PID 4128 wrote to memory of 1032 4128 z9916007.exe z0951157.exe PID 4128 wrote to memory of 1032 4128 z9916007.exe z0951157.exe PID 4128 wrote to memory of 1032 4128 z9916007.exe z0951157.exe PID 1032 wrote to memory of 924 1032 z0951157.exe z4321293.exe PID 1032 wrote to memory of 924 1032 z0951157.exe z4321293.exe PID 1032 wrote to memory of 924 1032 z0951157.exe z4321293.exe PID 924 wrote to memory of 856 924 z4321293.exe q8750021.exe PID 924 wrote to memory of 856 924 z4321293.exe q8750021.exe PID 924 wrote to memory of 1760 924 z4321293.exe r4351079.exe PID 924 wrote to memory of 1760 924 z4321293.exe r4351079.exe PID 924 wrote to memory of 1760 924 z4321293.exe r4351079.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1760 wrote to memory of 4396 1760 r4351079.exe AppLaunch.exe PID 1032 wrote to memory of 4240 1032 z0951157.exe s1860196.exe PID 1032 wrote to memory of 4240 1032 z0951157.exe s1860196.exe PID 1032 wrote to memory of 4240 1032 z0951157.exe s1860196.exe PID 4240 wrote to memory of 1944 4240 s1860196.exe AppLaunch.exe PID 4240 wrote to memory of 1944 4240 s1860196.exe AppLaunch.exe PID 4240 wrote to memory of 1944 4240 s1860196.exe AppLaunch.exe PID 4240 wrote to memory of 1944 4240 s1860196.exe AppLaunch.exe PID 4240 wrote to memory of 1944 4240 s1860196.exe AppLaunch.exe PID 4240 wrote to memory of 1944 4240 s1860196.exe AppLaunch.exe PID 4240 wrote to memory of 1944 4240 s1860196.exe AppLaunch.exe PID 4240 wrote to memory of 1944 4240 s1860196.exe AppLaunch.exe PID 4128 wrote to memory of 2040 4128 z9916007.exe t0759320.exe PID 4128 wrote to memory of 2040 4128 z9916007.exe t0759320.exe PID 4128 wrote to memory of 2040 4128 z9916007.exe t0759320.exe PID 2040 wrote to memory of 4236 2040 t0759320.exe explothe.exe PID 2040 wrote to memory of 4236 2040 t0759320.exe explothe.exe PID 2040 wrote to memory of 4236 2040 t0759320.exe explothe.exe PID 4016 wrote to memory of 872 4016 z1002274.exe u6241751.exe PID 4016 wrote to memory of 872 4016 z1002274.exe u6241751.exe PID 4016 wrote to memory of 872 4016 z1002274.exe u6241751.exe PID 872 wrote to memory of 4516 872 u6241751.exe legota.exe PID 872 wrote to memory of 4516 872 u6241751.exe legota.exe PID 872 wrote to memory of 4516 872 u6241751.exe legota.exe PID 3348 wrote to memory of 392 3348 12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe w7611989.exe PID 3348 wrote to memory of 392 3348 12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe w7611989.exe PID 3348 wrote to memory of 392 3348 12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe w7611989.exe PID 4236 wrote to memory of 5028 4236 explothe.exe schtasks.exe PID 4236 wrote to memory of 5028 4236 explothe.exe schtasks.exe PID 4236 wrote to memory of 5028 4236 explothe.exe schtasks.exe PID 4516 wrote to memory of 4736 4516 legota.exe schtasks.exe PID 4516 wrote to memory of 4736 4516 legota.exe schtasks.exe PID 4516 wrote to memory of 4736 4516 legota.exe schtasks.exe PID 4236 wrote to memory of 4508 4236 explothe.exe cmd.exe PID 4236 wrote to memory of 4508 4236 explothe.exe cmd.exe PID 4236 wrote to memory of 4508 4236 explothe.exe cmd.exe PID 4516 wrote to memory of 3596 4516 legota.exe cmd.exe PID 4516 wrote to memory of 3596 4516 legota.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe"C:\Users\Admin\AppData\Local\Temp\12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1002274.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1002274.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9916007.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9916007.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0951157.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0951157.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4321293.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4321293.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8750021.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8750021.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4351079.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4351079.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 5408⤵
- Program crash
PID:932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 5847⤵
- Program crash
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1860196.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1860196.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:1944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 1486⤵
- Program crash
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0759320.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0759320.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:5028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:4508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1392
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:436
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:2712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2864
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:2992
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:4488
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6241751.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6241751.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:4736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:3596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2664
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:1680
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:1020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2124
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:348
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:1328
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7611989.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7611989.exe2⤵
- Executes dropped EXE
PID:392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1760 -ip 17601⤵PID:2800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4396 -ip 43961⤵PID:3040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4240 -ip 42401⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4908
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:2896
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:556
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:4868
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7611989.exeFilesize
23KB
MD54e5f55f770c68c5f4fbb90b37d144764
SHA18a3af34598b18424e70dcefb4c6ffb98f58f3625
SHA25608fb534eb6e3ad6b513aa08e79a33cd5e1b27f592c9a401435112e9b7fa574a4
SHA5121d342e5cfb4ee59f8e1cc45a211d3ceb4e425dcd2fe6e91de195cf01546a1a9c5c52fd99dc768cd00849819e26a5097cb5f9bbd2f9b1f7b81940ce37deaab7e8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7611989.exeFilesize
23KB
MD54e5f55f770c68c5f4fbb90b37d144764
SHA18a3af34598b18424e70dcefb4c6ffb98f58f3625
SHA25608fb534eb6e3ad6b513aa08e79a33cd5e1b27f592c9a401435112e9b7fa574a4
SHA5121d342e5cfb4ee59f8e1cc45a211d3ceb4e425dcd2fe6e91de195cf01546a1a9c5c52fd99dc768cd00849819e26a5097cb5f9bbd2f9b1f7b81940ce37deaab7e8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1002274.exeFilesize
972KB
MD5b6a8fda53aa078632e0318b8d324a2cc
SHA18d496561379c2b90233494c3edd611df53eb5037
SHA256708d6115687d0c14c2c74091809859ab3991c6871f33fb8a3e0fbd7787ecc9d3
SHA51264407db502733f41ac1b3aee2d73238ed8ed038d175f44348cb4676d759d0159998a6b17c814f70232aa664280b07508287046dedbc84942624ab468dbf4df19
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1002274.exeFilesize
972KB
MD5b6a8fda53aa078632e0318b8d324a2cc
SHA18d496561379c2b90233494c3edd611df53eb5037
SHA256708d6115687d0c14c2c74091809859ab3991c6871f33fb8a3e0fbd7787ecc9d3
SHA51264407db502733f41ac1b3aee2d73238ed8ed038d175f44348cb4676d759d0159998a6b17c814f70232aa664280b07508287046dedbc84942624ab468dbf4df19
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6241751.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6241751.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9916007.exeFilesize
789KB
MD5fa7326e78fe8e67f81d9ac53fed59add
SHA1047815087669257d9144ef7a86f4a2abc3c74706
SHA256e734e540f4817d5e87c5ba790cce8cafc082839eb6b68fc5050846d940926656
SHA512cf35cc2ca0b1fad7bada39aabdf7f9ccec09565ce580244ce604a83514acea59785738d0a1f6eb76649bbfeed282c03182fc24c84aa20011869847ead2a64744
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9916007.exeFilesize
789KB
MD5fa7326e78fe8e67f81d9ac53fed59add
SHA1047815087669257d9144ef7a86f4a2abc3c74706
SHA256e734e540f4817d5e87c5ba790cce8cafc082839eb6b68fc5050846d940926656
SHA512cf35cc2ca0b1fad7bada39aabdf7f9ccec09565ce580244ce604a83514acea59785738d0a1f6eb76649bbfeed282c03182fc24c84aa20011869847ead2a64744
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0759320.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0759320.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0951157.exeFilesize
606KB
MD59b85e56a8e573c66cbd24fa62ccacdce
SHA1f32d20f5969962fcdc0767c4d950eb62ea2aa330
SHA2567748803df5a1c3e2c4ce6311255836476f46293ad37ad7c39bf80e750eb04615
SHA5127c5e949d574308622da8a0d97483bca7350edac754e786b4186f91d6dc149c1dd6060836a0778b77583e5fbd59508aa18a5c89289750afd21b023b1632d7f642
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0951157.exeFilesize
606KB
MD59b85e56a8e573c66cbd24fa62ccacdce
SHA1f32d20f5969962fcdc0767c4d950eb62ea2aa330
SHA2567748803df5a1c3e2c4ce6311255836476f46293ad37ad7c39bf80e750eb04615
SHA5127c5e949d574308622da8a0d97483bca7350edac754e786b4186f91d6dc149c1dd6060836a0778b77583e5fbd59508aa18a5c89289750afd21b023b1632d7f642
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1860196.exeFilesize
390KB
MD543cf02596d0aa7eb9bcdcf81b6e72fa2
SHA1395dcd3bcf7b35468e9d2873eb2859b072e18426
SHA256152efcb423a1e254ecd8b8f85c9869724d209f51f9041ed4895c773846f99ce1
SHA512695f26c862c050778d33e38301e29114f5aa41661a3503d6743b732df1cc9de23d60af62e6232dbc7bf398a7a6f196615f274b98f11659c0dfeb6a3f6ce140cb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1860196.exeFilesize
390KB
MD543cf02596d0aa7eb9bcdcf81b6e72fa2
SHA1395dcd3bcf7b35468e9d2873eb2859b072e18426
SHA256152efcb423a1e254ecd8b8f85c9869724d209f51f9041ed4895c773846f99ce1
SHA512695f26c862c050778d33e38301e29114f5aa41661a3503d6743b732df1cc9de23d60af62e6232dbc7bf398a7a6f196615f274b98f11659c0dfeb6a3f6ce140cb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4321293.exeFilesize
335KB
MD5f8d612e5f3825ea6b2765136d7017969
SHA1e274dea0b822cf8985cd4a74c9d0a2723b6fdf24
SHA2563129ddaa191e0a7163c7faeea0a997ed47ff2dfde9f6f9ae4d2e883e256023de
SHA51283618c37f2e97a5d95fc4e401d432495293552d6805f8547a8afc955ae20b3bcf7b382bc6ad10a033577fe568d5f3a8d953f5519f86fc28afa04024efed23f36
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4321293.exeFilesize
335KB
MD5f8d612e5f3825ea6b2765136d7017969
SHA1e274dea0b822cf8985cd4a74c9d0a2723b6fdf24
SHA2563129ddaa191e0a7163c7faeea0a997ed47ff2dfde9f6f9ae4d2e883e256023de
SHA51283618c37f2e97a5d95fc4e401d432495293552d6805f8547a8afc955ae20b3bcf7b382bc6ad10a033577fe568d5f3a8d953f5519f86fc28afa04024efed23f36
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8750021.exeFilesize
11KB
MD58992e932f9df8bba1a63f4d008de136c
SHA11d460d3c0441a091ea6802b82c29e145a60aa738
SHA256a2db1707f00b140b06004aea31290af9cd1a2afb9cf287c17b86d76bf638537e
SHA512596b5bf9bb20febc66171c01d35a63fb954ff13c824018438b96c0d040105e3c8adde335e0272d893d26838d623eabd86235569a46a226f3abd9ccb60947a098
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8750021.exeFilesize
11KB
MD58992e932f9df8bba1a63f4d008de136c
SHA11d460d3c0441a091ea6802b82c29e145a60aa738
SHA256a2db1707f00b140b06004aea31290af9cd1a2afb9cf287c17b86d76bf638537e
SHA512596b5bf9bb20febc66171c01d35a63fb954ff13c824018438b96c0d040105e3c8adde335e0272d893d26838d623eabd86235569a46a226f3abd9ccb60947a098
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4351079.exeFilesize
356KB
MD5fe8e34595ad3baae3874cd66a0d51ce6
SHA12faabcb0d6211a005f9dff5e1cf564a70df0167f
SHA256f1968269b96e8b10e2637b22fa2df754fb40e84b078947556650a874f1bca420
SHA51208c34f63f521ebd07ab3b6af7d840e30954da58e56ac45f9e6c07cc97dfec9e6b787c8c51fb75c23b6a61874b55e1ce296afa5d02cac5f45aa8d540b3799ef84
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4351079.exeFilesize
356KB
MD5fe8e34595ad3baae3874cd66a0d51ce6
SHA12faabcb0d6211a005f9dff5e1cf564a70df0167f
SHA256f1968269b96e8b10e2637b22fa2df754fb40e84b078947556650a874f1bca420
SHA51208c34f63f521ebd07ab3b6af7d840e30954da58e56ac45f9e6c07cc97dfec9e6b787c8c51fb75c23b6a61874b55e1ce296afa5d02cac5f45aa8d540b3799ef84
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/856-36-0x00007FFD829E0000-0x00007FFD834A1000-memory.dmpFilesize
10.8MB
-
memory/856-35-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/856-38-0x00007FFD829E0000-0x00007FFD834A1000-memory.dmpFilesize
10.8MB
-
memory/1944-86-0x00000000741C0000-0x0000000074970000-memory.dmpFilesize
7.7MB
-
memory/1944-70-0x0000000005F80000-0x0000000006598000-memory.dmpFilesize
6.1MB
-
memory/1944-87-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/1944-84-0x0000000005960000-0x000000000599C000-memory.dmpFilesize
240KB
-
memory/1944-82-0x00000000057E0000-0x00000000057F2000-memory.dmpFilesize
72KB
-
memory/1944-83-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/1944-81-0x0000000005A70000-0x0000000005B7A000-memory.dmpFilesize
1.0MB
-
memory/1944-85-0x00000000059A0000-0x00000000059EC000-memory.dmpFilesize
304KB
-
memory/1944-57-0x0000000005790000-0x0000000005796000-memory.dmpFilesize
24KB
-
memory/1944-54-0x00000000741C0000-0x0000000074970000-memory.dmpFilesize
7.7MB
-
memory/1944-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4396-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4396-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4396-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4396-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB