Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 20:23
Static task
static1
Behavioral task
behavioral1
Sample
a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe
-
Size
1.0MB
-
MD5
f57a6f5003a0e82e4e2b18fccb0e433c
-
SHA1
5fee5bb53b18835101252be8ba0893b8e43397c5
-
SHA256
a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b
-
SHA512
5d475eb06206407e9e438c91ba90261792e4e3e3826404fbd00170009b8b2453169439b183fd98e1458df550e44a5e9e81c00cc254bda70112f281ccc5a2973e
-
SSDEEP
24576:VyHLWXOKeT95iODrxJWPkGz9ec71kuQPD5fjwH:wIOpKODrSsGz9ecZKFfM
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6151806.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6151806.exe healer behavioral2/memory/4192-35-0x00000000001A0000-0x00000000001AA000-memory.dmp healer -
Processes:
q6151806.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q6151806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q6151806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q6151806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q6151806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q6151806.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q6151806.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t8670564.exeexplothe.exeu3692721.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t8670564.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u3692721.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z9612660.exez4712422.exez1431038.exez6632553.exeq6151806.exer5653097.exes2160161.exet8670564.exeexplothe.exeu3692721.exelegota.exew1103471.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 1488 z9612660.exe 1264 z4712422.exe 2136 z1431038.exe 220 z6632553.exe 4192 q6151806.exe 972 r5653097.exe 1592 s2160161.exe 2768 t8670564.exe 3144 explothe.exe 2000 u3692721.exe 1156 legota.exe 464 w1103471.exe 4904 explothe.exe 4128 legota.exe 5096 explothe.exe 1484 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1264 rundll32.exe 4908 rundll32.exe -
Processes:
q6151806.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q6151806.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z4712422.exez1431038.exez6632553.exea401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exez9612660.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4712422.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z1431038.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z6632553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9612660.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r5653097.exes2160161.exedescription pid process target process PID 972 set thread context of 3996 972 r5653097.exe AppLaunch.exe PID 1592 set thread context of 4572 1592 s2160161.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4788 972 WerFault.exe r5653097.exe 4388 3996 WerFault.exe AppLaunch.exe 1440 1592 WerFault.exe s2160161.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5004 schtasks.exe 4004 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q6151806.exepid process 4192 q6151806.exe 4192 q6151806.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q6151806.exedescription pid process Token: SeDebugPrivilege 4192 q6151806.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exez9612660.exez4712422.exez1431038.exez6632553.exer5653097.exes2160161.exet8670564.exeexplothe.exeu3692721.execmd.exedescription pid process target process PID 5116 wrote to memory of 1488 5116 a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe z9612660.exe PID 5116 wrote to memory of 1488 5116 a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe z9612660.exe PID 5116 wrote to memory of 1488 5116 a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe z9612660.exe PID 1488 wrote to memory of 1264 1488 z9612660.exe z4712422.exe PID 1488 wrote to memory of 1264 1488 z9612660.exe z4712422.exe PID 1488 wrote to memory of 1264 1488 z9612660.exe z4712422.exe PID 1264 wrote to memory of 2136 1264 z4712422.exe z1431038.exe PID 1264 wrote to memory of 2136 1264 z4712422.exe z1431038.exe PID 1264 wrote to memory of 2136 1264 z4712422.exe z1431038.exe PID 2136 wrote to memory of 220 2136 z1431038.exe z6632553.exe PID 2136 wrote to memory of 220 2136 z1431038.exe z6632553.exe PID 2136 wrote to memory of 220 2136 z1431038.exe z6632553.exe PID 220 wrote to memory of 4192 220 z6632553.exe q6151806.exe PID 220 wrote to memory of 4192 220 z6632553.exe q6151806.exe PID 220 wrote to memory of 972 220 z6632553.exe r5653097.exe PID 220 wrote to memory of 972 220 z6632553.exe r5653097.exe PID 220 wrote to memory of 972 220 z6632553.exe r5653097.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 972 wrote to memory of 3996 972 r5653097.exe AppLaunch.exe PID 2136 wrote to memory of 1592 2136 z1431038.exe s2160161.exe PID 2136 wrote to memory of 1592 2136 z1431038.exe s2160161.exe PID 2136 wrote to memory of 1592 2136 z1431038.exe s2160161.exe PID 1592 wrote to memory of 4572 1592 s2160161.exe AppLaunch.exe PID 1592 wrote to memory of 4572 1592 s2160161.exe AppLaunch.exe PID 1592 wrote to memory of 4572 1592 s2160161.exe AppLaunch.exe PID 1592 wrote to memory of 4572 1592 s2160161.exe AppLaunch.exe PID 1592 wrote to memory of 4572 1592 s2160161.exe AppLaunch.exe PID 1592 wrote to memory of 4572 1592 s2160161.exe AppLaunch.exe PID 1592 wrote to memory of 4572 1592 s2160161.exe AppLaunch.exe PID 1592 wrote to memory of 4572 1592 s2160161.exe AppLaunch.exe PID 1264 wrote to memory of 2768 1264 z4712422.exe t8670564.exe PID 1264 wrote to memory of 2768 1264 z4712422.exe t8670564.exe PID 1264 wrote to memory of 2768 1264 z4712422.exe t8670564.exe PID 2768 wrote to memory of 3144 2768 t8670564.exe explothe.exe PID 2768 wrote to memory of 3144 2768 t8670564.exe explothe.exe PID 2768 wrote to memory of 3144 2768 t8670564.exe explothe.exe PID 1488 wrote to memory of 2000 1488 z9612660.exe u3692721.exe PID 1488 wrote to memory of 2000 1488 z9612660.exe u3692721.exe PID 1488 wrote to memory of 2000 1488 z9612660.exe u3692721.exe PID 3144 wrote to memory of 4004 3144 explothe.exe schtasks.exe PID 3144 wrote to memory of 4004 3144 explothe.exe schtasks.exe PID 3144 wrote to memory of 4004 3144 explothe.exe schtasks.exe PID 3144 wrote to memory of 1668 3144 explothe.exe cmd.exe PID 3144 wrote to memory of 1668 3144 explothe.exe cmd.exe PID 3144 wrote to memory of 1668 3144 explothe.exe cmd.exe PID 2000 wrote to memory of 1156 2000 u3692721.exe legota.exe PID 2000 wrote to memory of 1156 2000 u3692721.exe legota.exe PID 2000 wrote to memory of 1156 2000 u3692721.exe legota.exe PID 5116 wrote to memory of 464 5116 a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe w1103471.exe PID 5116 wrote to memory of 464 5116 a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe w1103471.exe PID 5116 wrote to memory of 464 5116 a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe w1103471.exe PID 1668 wrote to memory of 2984 1668 cmd.exe cmd.exe PID 1668 wrote to memory of 2984 1668 cmd.exe cmd.exe PID 1668 wrote to memory of 2984 1668 cmd.exe cmd.exe PID 1668 wrote to memory of 4416 1668 cmd.exe cacls.exe PID 1668 wrote to memory of 4416 1668 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe"C:\Users\Admin\AppData\Local\Temp\a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9612660.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9612660.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4712422.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4712422.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1431038.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1431038.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6632553.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6632553.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6151806.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6151806.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5653097.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5653097.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 5408⤵
- Program crash
PID:4388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 1487⤵
- Program crash
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2160161.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2160161.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:4572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1486⤵
- Program crash
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8670564.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8670564.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:4004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2984
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:4416
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:2488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4564
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:1424
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:4864
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3692721.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3692721.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:1156 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:5004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:1960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1408
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:928
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1228
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:4892
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:3068
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1103471.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1103471.exe2⤵
- Executes dropped EXE
PID:464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 972 -ip 9721⤵PID:4552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3996 -ip 39961⤵PID:4816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1592 -ip 15921⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:4904
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4128
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:5096
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:1484
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1103471.exeFilesize
23KB
MD53450f82dd4efaad63b6133af5b8cceae
SHA1dcebbc166589da2f846897c2bdac40447d0ba4aa
SHA256ae81a60a94c2524e38a854fcd393d23eadaef3c740ee7de966abcb94c0acba28
SHA5128939ac777f0368c2cf31124b666545d43cd9c450a7654cb8bb48ea951d73befba2f402694c2403453d2077fc674eb28e2f8e7e80caed1c9140f6578e4f955976
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1103471.exeFilesize
23KB
MD53450f82dd4efaad63b6133af5b8cceae
SHA1dcebbc166589da2f846897c2bdac40447d0ba4aa
SHA256ae81a60a94c2524e38a854fcd393d23eadaef3c740ee7de966abcb94c0acba28
SHA5128939ac777f0368c2cf31124b666545d43cd9c450a7654cb8bb48ea951d73befba2f402694c2403453d2077fc674eb28e2f8e7e80caed1c9140f6578e4f955976
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9612660.exeFilesize
969KB
MD52b0392a782e6057f28b8f1511f1e461c
SHA1a06f2088eef34965b5992ac70724d0cd91d0a79b
SHA25697d9c6487120bcbfcf396b9cb85bf5ca1b0f06fa39991e8446d18bfd270afac5
SHA512ebc729d24bbe6779c189a74313105cd6960229591f7f45d9aee9dd0a8a1fd1b7783a4a0ca0e34c35c03b0118de98f35f5f0ed803d7509b420df4fc75259d263c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9612660.exeFilesize
969KB
MD52b0392a782e6057f28b8f1511f1e461c
SHA1a06f2088eef34965b5992ac70724d0cd91d0a79b
SHA25697d9c6487120bcbfcf396b9cb85bf5ca1b0f06fa39991e8446d18bfd270afac5
SHA512ebc729d24bbe6779c189a74313105cd6960229591f7f45d9aee9dd0a8a1fd1b7783a4a0ca0e34c35c03b0118de98f35f5f0ed803d7509b420df4fc75259d263c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3692721.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3692721.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4712422.exeFilesize
789KB
MD5229d2bb0f77dcf02618875d5b6bfd33b
SHA103e7c7d410cb0126d480267842c3bf7067799d45
SHA25627fa253bbf65b82b33258a9cde4b0fbc2cb74976cff6af94b303b7b4ea720616
SHA5122311a01d87fe37d452a43a18eb38d9e0e660736eb31adc601b27cbaeed095e938b0330224fee44867692c6f0076eecf70da77a7fb6f1beb46e1b0544da0daa9a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4712422.exeFilesize
789KB
MD5229d2bb0f77dcf02618875d5b6bfd33b
SHA103e7c7d410cb0126d480267842c3bf7067799d45
SHA25627fa253bbf65b82b33258a9cde4b0fbc2cb74976cff6af94b303b7b4ea720616
SHA5122311a01d87fe37d452a43a18eb38d9e0e660736eb31adc601b27cbaeed095e938b0330224fee44867692c6f0076eecf70da77a7fb6f1beb46e1b0544da0daa9a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8670564.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8670564.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1431038.exeFilesize
606KB
MD526ec82dee1c1b90f9b4e9d07bfe970e6
SHA13a0b0c44b648fcd053c88fb324c7f74b5e2e0acd
SHA2563f28b880b2fdfbac8d8ba2295222087c48885f3553e8945496e2be2eb594ef63
SHA51289bf4a64e81201f1f4e308280cb8ad0cf8b629eeceb30738632cecd128a9f2ea342b9b4284d21a9ee5cbf903097945d58675554260902e79f36357a656504edd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1431038.exeFilesize
606KB
MD526ec82dee1c1b90f9b4e9d07bfe970e6
SHA13a0b0c44b648fcd053c88fb324c7f74b5e2e0acd
SHA2563f28b880b2fdfbac8d8ba2295222087c48885f3553e8945496e2be2eb594ef63
SHA51289bf4a64e81201f1f4e308280cb8ad0cf8b629eeceb30738632cecd128a9f2ea342b9b4284d21a9ee5cbf903097945d58675554260902e79f36357a656504edd
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2160161.exeFilesize
390KB
MD56ce8519f65ac440f3c280d0618f69148
SHA1edcd77b8a9855b5397e6fe45ebeb5c5ffce2ffa7
SHA2564dceedea8ae9a476f34bdcabffbad4d6e1e84a898e922b7abcbb582cf0582928
SHA51250fe75bbb483d3d7594d8ab67d96be620152fd500f8259389e487f4581f0ec2518e817f8142ee87b5d001aa40111759cff67f482c36ca11facfe687aa38bf180
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2160161.exeFilesize
390KB
MD56ce8519f65ac440f3c280d0618f69148
SHA1edcd77b8a9855b5397e6fe45ebeb5c5ffce2ffa7
SHA2564dceedea8ae9a476f34bdcabffbad4d6e1e84a898e922b7abcbb582cf0582928
SHA51250fe75bbb483d3d7594d8ab67d96be620152fd500f8259389e487f4581f0ec2518e817f8142ee87b5d001aa40111759cff67f482c36ca11facfe687aa38bf180
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6632553.exeFilesize
335KB
MD55d509e57d9eae68308a96a2e05ff0eba
SHA17fe3372b2eb5508202ed974afc05b91d7a68b9a9
SHA256e9ff80a5519c1457045824a6029e6b213ba1736624dc4d84d4b4f23973ce07cd
SHA5128eee3bb2bf1de4b5f0a7dccf911e2fddc589294e5667fa33da56f3dfa47658e11be0c7ba7e1df5183b9403fa7cb2b99122be3f74236ce7855d34a0a6494f4491
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6632553.exeFilesize
335KB
MD55d509e57d9eae68308a96a2e05ff0eba
SHA17fe3372b2eb5508202ed974afc05b91d7a68b9a9
SHA256e9ff80a5519c1457045824a6029e6b213ba1736624dc4d84d4b4f23973ce07cd
SHA5128eee3bb2bf1de4b5f0a7dccf911e2fddc589294e5667fa33da56f3dfa47658e11be0c7ba7e1df5183b9403fa7cb2b99122be3f74236ce7855d34a0a6494f4491
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6151806.exeFilesize
11KB
MD5329ce153c10642b207f9c422a99d150b
SHA1d36a52feca19dbff397b2c5dbd3ca2f5a3a55ea6
SHA25678959e959ccb966d4100917352bbc10d34d7fe70c00f285cb80e8ce8f518ec5f
SHA5128158009b0302934fbbe0b2e4ce2cb63235dc8b020bdb27f7b15914acdd1b8ca6f06fac5c4878ab3e12328952e1ef876e67b3e5fd16e5497ad2f8678b4d89254d
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6151806.exeFilesize
11KB
MD5329ce153c10642b207f9c422a99d150b
SHA1d36a52feca19dbff397b2c5dbd3ca2f5a3a55ea6
SHA25678959e959ccb966d4100917352bbc10d34d7fe70c00f285cb80e8ce8f518ec5f
SHA5128158009b0302934fbbe0b2e4ce2cb63235dc8b020bdb27f7b15914acdd1b8ca6f06fac5c4878ab3e12328952e1ef876e67b3e5fd16e5497ad2f8678b4d89254d
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5653097.exeFilesize
356KB
MD5eb123a4b1cbb13f4cb180c1fa86ced16
SHA159f62336623e810ec26c0078657974445c496a0d
SHA256082dc45482a20df39d6d78ef0a316152d6b57f205b8cc239479c5076625f0fed
SHA512aef9f0e9652eb33d455bb9a70da4acd7dc7da31bde55bf8e5aef77eb4deb0307687049b90f32bbbf0f791b3701b042934b431aedf1ee6aad76eef89ad494b748
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5653097.exeFilesize
356KB
MD5eb123a4b1cbb13f4cb180c1fa86ced16
SHA159f62336623e810ec26c0078657974445c496a0d
SHA256082dc45482a20df39d6d78ef0a316152d6b57f205b8cc239479c5076625f0fed
SHA512aef9f0e9652eb33d455bb9a70da4acd7dc7da31bde55bf8e5aef77eb4deb0307687049b90f32bbbf0f791b3701b042934b431aedf1ee6aad76eef89ad494b748
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/3996-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3996-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3996-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3996-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4192-35-0x00000000001A0000-0x00000000001AA000-memory.dmpFilesize
40KB
-
memory/4192-36-0x00007FFF02670000-0x00007FFF03131000-memory.dmpFilesize
10.8MB
-
memory/4192-38-0x00007FFF02670000-0x00007FFF03131000-memory.dmpFilesize
10.8MB
-
memory/4572-59-0x0000000004F60000-0x000000000506A000-memory.dmpFilesize
1.0MB
-
memory/4572-87-0x0000000004E40000-0x0000000004E50000-memory.dmpFilesize
64KB
-
memory/4572-86-0x0000000073870000-0x0000000074020000-memory.dmpFilesize
7.7MB
-
memory/4572-75-0x0000000004EE0000-0x0000000004F2C000-memory.dmpFilesize
304KB
-
memory/4572-66-0x0000000004E90000-0x0000000004ECC000-memory.dmpFilesize
240KB
-
memory/4572-61-0x0000000004E20000-0x0000000004E32000-memory.dmpFilesize
72KB
-
memory/4572-62-0x0000000004E40000-0x0000000004E50000-memory.dmpFilesize
64KB
-
memory/4572-58-0x0000000005470000-0x0000000005A88000-memory.dmpFilesize
6.1MB
-
memory/4572-52-0x00000000026A0000-0x00000000026A6000-memory.dmpFilesize
24KB
-
memory/4572-51-0x0000000073870000-0x0000000074020000-memory.dmpFilesize
7.7MB
-
memory/4572-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB