Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 20:23
Static task
static1
Behavioral task
behavioral1
Sample
9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exe
-
Size
994KB
-
MD5
a70d541152f32fc0d3eb5651fc3bf5c6
-
SHA1
cb5b96f515414c79187e845e5963c3003c781cb4
-
SHA256
9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd
-
SHA512
9524d0167f63d59175f30568da0b8e0598030431622d9522dc86bd9f8c20777d741d3bcd30363cc3d94bf1ef1e57d06a409990877c450ab617b03e1fda172ce1
-
SSDEEP
24576:AyqaFVjvX3oyRMh/imGew4MAEdGJN1GM:Hqs93oyRMFimFIYg
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe healer behavioral2/memory/1160-35-0x0000000000510000-0x000000000051A000-memory.dmp healer -
Processes:
q3293235.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q3293235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q3293235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q3293235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q3293235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q3293235.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q3293235.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
u9669175.exelegota.exet2474679.exeexplothe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u9669175.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t2474679.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explothe.exe -
Executes dropped EXE 16 IoCs
Processes:
z9234197.exez8286662.exez6530251.exez8978094.exeq3293235.exer2693585.exes2305125.exet2474679.exeexplothe.exeu9669175.exelegota.exew5379155.exelegota.exeexplothe.exelegota.exeexplothe.exepid process 5024 z9234197.exe 4540 z8286662.exe 4076 z6530251.exe 2012 z8978094.exe 1160 q3293235.exe 1680 r2693585.exe 1732 s2305125.exe 3940 t2474679.exe 5096 explothe.exe 4088 u9669175.exe 4148 legota.exe 4244 w5379155.exe 4176 legota.exe 5080 explothe.exe 4548 legota.exe 2148 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 976 rundll32.exe 336 rundll32.exe -
Processes:
q3293235.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q3293235.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z8286662.exez6530251.exez8978094.exe9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exez9234197.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z8286662.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z6530251.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z8978094.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9234197.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r2693585.exes2305125.exedescription pid process target process PID 1680 set thread context of 2724 1680 r2693585.exe AppLaunch.exe PID 1732 set thread context of 4316 1732 s2305125.exe AppLaunch.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4268 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2360 2724 WerFault.exe AppLaunch.exe 4176 1680 WerFault.exe r2693585.exe 744 1732 WerFault.exe s2305125.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 764 schtasks.exe 2180 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q3293235.exepid process 1160 q3293235.exe 1160 q3293235.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q3293235.exedescription pid process Token: SeDebugPrivilege 1160 q3293235.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exez9234197.exez8286662.exez6530251.exez8978094.exer2693585.exes2305125.exet2474679.exeexplothe.exeu9669175.exedescription pid process target process PID 3496 wrote to memory of 5024 3496 9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exe z9234197.exe PID 3496 wrote to memory of 5024 3496 9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exe z9234197.exe PID 3496 wrote to memory of 5024 3496 9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exe z9234197.exe PID 5024 wrote to memory of 4540 5024 z9234197.exe z8286662.exe PID 5024 wrote to memory of 4540 5024 z9234197.exe z8286662.exe PID 5024 wrote to memory of 4540 5024 z9234197.exe z8286662.exe PID 4540 wrote to memory of 4076 4540 z8286662.exe z6530251.exe PID 4540 wrote to memory of 4076 4540 z8286662.exe z6530251.exe PID 4540 wrote to memory of 4076 4540 z8286662.exe z6530251.exe PID 4076 wrote to memory of 2012 4076 z6530251.exe z8978094.exe PID 4076 wrote to memory of 2012 4076 z6530251.exe z8978094.exe PID 4076 wrote to memory of 2012 4076 z6530251.exe z8978094.exe PID 2012 wrote to memory of 1160 2012 z8978094.exe q3293235.exe PID 2012 wrote to memory of 1160 2012 z8978094.exe q3293235.exe PID 2012 wrote to memory of 1680 2012 z8978094.exe r2693585.exe PID 2012 wrote to memory of 1680 2012 z8978094.exe r2693585.exe PID 2012 wrote to memory of 1680 2012 z8978094.exe r2693585.exe PID 1680 wrote to memory of 3260 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 3260 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 3260 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 4304 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 4304 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 4304 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 1680 wrote to memory of 2724 1680 r2693585.exe AppLaunch.exe PID 4076 wrote to memory of 1732 4076 z6530251.exe s2305125.exe PID 4076 wrote to memory of 1732 4076 z6530251.exe s2305125.exe PID 4076 wrote to memory of 1732 4076 z6530251.exe s2305125.exe PID 1732 wrote to memory of 3044 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 3044 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 3044 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 4316 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 4316 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 4316 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 4316 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 4316 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 4316 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 4316 1732 s2305125.exe AppLaunch.exe PID 1732 wrote to memory of 4316 1732 s2305125.exe AppLaunch.exe PID 4540 wrote to memory of 3940 4540 z8286662.exe t2474679.exe PID 4540 wrote to memory of 3940 4540 z8286662.exe t2474679.exe PID 4540 wrote to memory of 3940 4540 z8286662.exe t2474679.exe PID 3940 wrote to memory of 5096 3940 t2474679.exe explothe.exe PID 3940 wrote to memory of 5096 3940 t2474679.exe explothe.exe PID 3940 wrote to memory of 5096 3940 t2474679.exe explothe.exe PID 5024 wrote to memory of 4088 5024 z9234197.exe u9669175.exe PID 5024 wrote to memory of 4088 5024 z9234197.exe u9669175.exe PID 5024 wrote to memory of 4088 5024 z9234197.exe u9669175.exe PID 5096 wrote to memory of 764 5096 explothe.exe schtasks.exe PID 5096 wrote to memory of 764 5096 explothe.exe schtasks.exe PID 5096 wrote to memory of 764 5096 explothe.exe schtasks.exe PID 5096 wrote to memory of 4536 5096 explothe.exe cmd.exe PID 5096 wrote to memory of 4536 5096 explothe.exe cmd.exe PID 5096 wrote to memory of 4536 5096 explothe.exe cmd.exe PID 4088 wrote to memory of 4148 4088 u9669175.exe legota.exe PID 4088 wrote to memory of 4148 4088 u9669175.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exe"C:\Users\Admin\AppData\Local\Temp\9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1527⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2305125.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2305125.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 5926⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2474679.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2474679.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9669175.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9669175.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5379155.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5379155.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1680 -ip 16801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2724 -ip 27241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1732 -ip 17321⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5379155.exeFilesize
23KB
MD55410adf9b12a6cb78b0a81ef1873f717
SHA1e5605b15b994f05bd2d55bb9e3a5278e72680dad
SHA2564ca099b763660d07f19f2ee00a7130bf7eb52a70ed8feefd80202221f8593496
SHA512e3abeb79a83a7a96145c4f4d7a63cce532676aae6485bbd8beba9b34285473842a76782385aa1598091591249b29c2be5cde269ad90b2255f68e353dfc801e93
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5379155.exeFilesize
23KB
MD55410adf9b12a6cb78b0a81ef1873f717
SHA1e5605b15b994f05bd2d55bb9e3a5278e72680dad
SHA2564ca099b763660d07f19f2ee00a7130bf7eb52a70ed8feefd80202221f8593496
SHA512e3abeb79a83a7a96145c4f4d7a63cce532676aae6485bbd8beba9b34285473842a76782385aa1598091591249b29c2be5cde269ad90b2255f68e353dfc801e93
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exeFilesize
893KB
MD54e73ccef7d9aa675b7ccb7869711800c
SHA12d4597b27d085de1c58d9118dfd12ad694a734d7
SHA25603f1e9609e21fcdde9c73e60caba236caa3ef7c7030f9da334f812b59052fa67
SHA51250ee84ada4b892f4f13a85e1e508562d7d5079ac121a0a1843e9ac28f571120b63b23360a8a20e3ff42e366899a523ade941acdd8b2429074d0c17e0799506da
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exeFilesize
893KB
MD54e73ccef7d9aa675b7ccb7869711800c
SHA12d4597b27d085de1c58d9118dfd12ad694a734d7
SHA25603f1e9609e21fcdde9c73e60caba236caa3ef7c7030f9da334f812b59052fa67
SHA51250ee84ada4b892f4f13a85e1e508562d7d5079ac121a0a1843e9ac28f571120b63b23360a8a20e3ff42e366899a523ade941acdd8b2429074d0c17e0799506da
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9669175.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9669175.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exeFilesize
710KB
MD5079d0c841d105714c945ad750d025b62
SHA1a08becfb2244bf643e4501c0512e0ded4817a849
SHA25643325d68ea5947079ce2b363f9038239916ddbd557ace6c43fa0ebcb77c7be95
SHA512fbff803c28af02b4964a61b027417bdbd43210430c871584029a9db99f6f0b1bf8daeaca7afcc383791a91169f87feead2b20f77147eccd803840acd1bd3411c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exeFilesize
710KB
MD5079d0c841d105714c945ad750d025b62
SHA1a08becfb2244bf643e4501c0512e0ded4817a849
SHA25643325d68ea5947079ce2b363f9038239916ddbd557ace6c43fa0ebcb77c7be95
SHA512fbff803c28af02b4964a61b027417bdbd43210430c871584029a9db99f6f0b1bf8daeaca7afcc383791a91169f87feead2b20f77147eccd803840acd1bd3411c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2474679.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2474679.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exeFilesize
527KB
MD58a3c205772e7e6002fbe94e887175faa
SHA1f2c9ff609d53582876767c37f0430067e7d6f755
SHA2562b03f15c9bdd3022bb2dc2b8a1975368f9d5125cf358774457f0aff3850ac570
SHA5129f64ea2a049eddeeabc7aa4028caff90ee2d9da9b8421aa71a0dae1cd887a1127ac2792c815919345a8e8bc7c2b03c626ac786a17e99a7bdd375407632c0570c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exeFilesize
527KB
MD58a3c205772e7e6002fbe94e887175faa
SHA1f2c9ff609d53582876767c37f0430067e7d6f755
SHA2562b03f15c9bdd3022bb2dc2b8a1975368f9d5125cf358774457f0aff3850ac570
SHA5129f64ea2a049eddeeabc7aa4028caff90ee2d9da9b8421aa71a0dae1cd887a1127ac2792c815919345a8e8bc7c2b03c626ac786a17e99a7bdd375407632c0570c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2305125.exeFilesize
310KB
MD56292c3193e4fd80fe9161ed4295795cc
SHA1777df017c1e5b989474c68a0e831d0f111e93ac5
SHA2567166c6d9a2ae65f8a2ea54b2296d8af911e11300428b93ab2dc895c285c451bd
SHA512c453bce18c9b67cfc0c235a03f6dd5306160c6a7d2943ef814975bd19debc3a71f7e9429c1b038096d913baf11767234c2ade56a44f7b944c565751bb7759f5d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2305125.exeFilesize
310KB
MD56292c3193e4fd80fe9161ed4295795cc
SHA1777df017c1e5b989474c68a0e831d0f111e93ac5
SHA2567166c6d9a2ae65f8a2ea54b2296d8af911e11300428b93ab2dc895c285c451bd
SHA512c453bce18c9b67cfc0c235a03f6dd5306160c6a7d2943ef814975bd19debc3a71f7e9429c1b038096d913baf11767234c2ade56a44f7b944c565751bb7759f5d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exeFilesize
296KB
MD5445caeb7d99a6ea8d5ba7886fdef7567
SHA14133e9612b0a87c3b426a66542492df0b281f8a0
SHA2565220b91ce9e1abb658c498d4eca7428a2a1751e533d82179805f02ac43ddfa64
SHA512a815d37fb3952a6d8164a9cb916d14c91d650d99f284796422428f5ec729cb9ece03ca155e2641177d35d611b9df0a4746df2fa2a004c9a2fe788deec30f35df
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exeFilesize
296KB
MD5445caeb7d99a6ea8d5ba7886fdef7567
SHA14133e9612b0a87c3b426a66542492df0b281f8a0
SHA2565220b91ce9e1abb658c498d4eca7428a2a1751e533d82179805f02ac43ddfa64
SHA512a815d37fb3952a6d8164a9cb916d14c91d650d99f284796422428f5ec729cb9ece03ca155e2641177d35d611b9df0a4746df2fa2a004c9a2fe788deec30f35df
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exeFilesize
11KB
MD5e0233372fb5a978e424016b9233a3f95
SHA15dbc3e695cbbb7c8d982fac7c330d199cb461141
SHA256111c507d7b970b8a17f2b1c7828b9dd35f14e73461ac9afa986c9f9dabeffba6
SHA5124e82c114e995bb3582ed1b478465eea994e478d64f5859bf45ab02452705b56865580f2feddba76ae550787b0d60920c8c984578977e7615060ab9cf1b955e9d
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exeFilesize
11KB
MD5e0233372fb5a978e424016b9233a3f95
SHA15dbc3e695cbbb7c8d982fac7c330d199cb461141
SHA256111c507d7b970b8a17f2b1c7828b9dd35f14e73461ac9afa986c9f9dabeffba6
SHA5124e82c114e995bb3582ed1b478465eea994e478d64f5859bf45ab02452705b56865580f2feddba76ae550787b0d60920c8c984578977e7615060ab9cf1b955e9d
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exeFilesize
276KB
MD5d62d05dd92da254457210a8977f6cb30
SHA1e43d5ead9edcab3f8c2fed56375add23df59bddc
SHA25670c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f
SHA5120b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exeFilesize
276KB
MD5d62d05dd92da254457210a8977f6cb30
SHA1e43d5ead9edcab3f8c2fed56375add23df59bddc
SHA25670c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f
SHA5120b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1160-38-0x00007FFA522F0000-0x00007FFA52DB1000-memory.dmpFilesize
10.8MB
-
memory/1160-35-0x0000000000510000-0x000000000051A000-memory.dmpFilesize
40KB
-
memory/1160-36-0x00007FFA522F0000-0x00007FFA52DB1000-memory.dmpFilesize
10.8MB
-
memory/2724-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2724-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2724-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2724-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4316-65-0x0000000005910000-0x0000000005F28000-memory.dmpFilesize
6.1MB
-
memory/4316-82-0x0000000005370000-0x00000000053BC000-memory.dmpFilesize
304KB
-
memory/4316-87-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/4316-86-0x0000000073C30000-0x00000000743E0000-memory.dmpFilesize
7.7MB
-
memory/4316-74-0x0000000005330000-0x000000000536C000-memory.dmpFilesize
240KB
-
memory/4316-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4316-51-0x0000000073C30000-0x00000000743E0000-memory.dmpFilesize
7.7MB
-
memory/4316-70-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/4316-69-0x0000000005290000-0x00000000052A2000-memory.dmpFilesize
72KB
-
memory/4316-52-0x0000000002B10000-0x0000000002B16000-memory.dmpFilesize
24KB
-
memory/4316-66-0x0000000005400000-0x000000000550A000-memory.dmpFilesize
1.0MB