Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 20:26
Static task
static1
Behavioral task
behavioral1
Sample
af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe
-
Size
1.1MB
-
MD5
3181058df3579f552726171cc67a0203
-
SHA1
5d7c2feec95b6d60cef9ba87c95d493b540f2b82
-
SHA256
af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8
-
SHA512
4240365ba7289928c4772fd7ceaef5241fdb3aaf38bf8c7dc886c293b7ea6605c90195f1d760e32822e97f0c4d4ee7b8c13f2ddbfa8859fb3ca4fffd08cb5f70
-
SSDEEP
24576:+yTiKQajQgvSGnP/U252eYcY/QPzqyuAJSwVpR5OXpUr:NOKQUoGDlfY/QPzPlr
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0259766.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0259766.exe healer behavioral2/memory/4160-35-0x0000000000F90000-0x0000000000F9A000-memory.dmp healer -
Processes:
q0259766.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q0259766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q0259766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q0259766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q0259766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q0259766.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q0259766.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet2072444.exeexplothe.exeu1906789.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t2072444.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u1906789.exe -
Executes dropped EXE 16 IoCs
Processes:
z2260712.exez1863121.exez3781577.exez1475711.exeq0259766.exer2222851.exes0083494.exet2072444.exeexplothe.exeu1906789.exelegota.exew7477855.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 4992 z2260712.exe 4844 z1863121.exe 4208 z3781577.exe 3024 z1475711.exe 4160 q0259766.exe 5044 r2222851.exe 3796 s0083494.exe 3660 t2072444.exe 2700 explothe.exe 3336 u1906789.exe 3896 legota.exe 2952 w7477855.exe 1952 explothe.exe 3768 legota.exe 4208 explothe.exe 4576 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2828 rundll32.exe 656 rundll32.exe -
Processes:
q0259766.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q0259766.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z1475711.exeaf442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exez2260712.exez1863121.exez3781577.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z1475711.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z2260712.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z1863121.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z3781577.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r2222851.exes0083494.exedescription pid process target process PID 5044 set thread context of 3900 5044 r2222851.exe AppLaunch.exe PID 3796 set thread context of 404 3796 s0083494.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3960 5044 WerFault.exe r2222851.exe 3676 3900 WerFault.exe AppLaunch.exe 504 3796 WerFault.exe s0083494.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4572 schtasks.exe 4592 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q0259766.exepid process 4160 q0259766.exe 4160 q0259766.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q0259766.exedescription pid process Token: SeDebugPrivilege 4160 q0259766.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exez2260712.exez1863121.exez3781577.exez1475711.exer2222851.exes0083494.exet2072444.exeexplothe.exeu1906789.execmd.exedescription pid process target process PID 3736 wrote to memory of 4992 3736 af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe z2260712.exe PID 3736 wrote to memory of 4992 3736 af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe z2260712.exe PID 3736 wrote to memory of 4992 3736 af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe z2260712.exe PID 4992 wrote to memory of 4844 4992 z2260712.exe z1863121.exe PID 4992 wrote to memory of 4844 4992 z2260712.exe z1863121.exe PID 4992 wrote to memory of 4844 4992 z2260712.exe z1863121.exe PID 4844 wrote to memory of 4208 4844 z1863121.exe z3781577.exe PID 4844 wrote to memory of 4208 4844 z1863121.exe z3781577.exe PID 4844 wrote to memory of 4208 4844 z1863121.exe z3781577.exe PID 4208 wrote to memory of 3024 4208 z3781577.exe z1475711.exe PID 4208 wrote to memory of 3024 4208 z3781577.exe z1475711.exe PID 4208 wrote to memory of 3024 4208 z3781577.exe z1475711.exe PID 3024 wrote to memory of 4160 3024 z1475711.exe q0259766.exe PID 3024 wrote to memory of 4160 3024 z1475711.exe q0259766.exe PID 3024 wrote to memory of 5044 3024 z1475711.exe r2222851.exe PID 3024 wrote to memory of 5044 3024 z1475711.exe r2222851.exe PID 3024 wrote to memory of 5044 3024 z1475711.exe r2222851.exe PID 5044 wrote to memory of 3168 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3168 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3168 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 5044 wrote to memory of 3900 5044 r2222851.exe AppLaunch.exe PID 4208 wrote to memory of 3796 4208 z3781577.exe s0083494.exe PID 4208 wrote to memory of 3796 4208 z3781577.exe s0083494.exe PID 4208 wrote to memory of 3796 4208 z3781577.exe s0083494.exe PID 3796 wrote to memory of 404 3796 s0083494.exe AppLaunch.exe PID 3796 wrote to memory of 404 3796 s0083494.exe AppLaunch.exe PID 3796 wrote to memory of 404 3796 s0083494.exe AppLaunch.exe PID 3796 wrote to memory of 404 3796 s0083494.exe AppLaunch.exe PID 3796 wrote to memory of 404 3796 s0083494.exe AppLaunch.exe PID 3796 wrote to memory of 404 3796 s0083494.exe AppLaunch.exe PID 3796 wrote to memory of 404 3796 s0083494.exe AppLaunch.exe PID 3796 wrote to memory of 404 3796 s0083494.exe AppLaunch.exe PID 4844 wrote to memory of 3660 4844 z1863121.exe t2072444.exe PID 4844 wrote to memory of 3660 4844 z1863121.exe t2072444.exe PID 4844 wrote to memory of 3660 4844 z1863121.exe t2072444.exe PID 3660 wrote to memory of 2700 3660 t2072444.exe explothe.exe PID 3660 wrote to memory of 2700 3660 t2072444.exe explothe.exe PID 3660 wrote to memory of 2700 3660 t2072444.exe explothe.exe PID 4992 wrote to memory of 3336 4992 z2260712.exe u1906789.exe PID 4992 wrote to memory of 3336 4992 z2260712.exe u1906789.exe PID 4992 wrote to memory of 3336 4992 z2260712.exe u1906789.exe PID 2700 wrote to memory of 4572 2700 explothe.exe schtasks.exe PID 2700 wrote to memory of 4572 2700 explothe.exe schtasks.exe PID 2700 wrote to memory of 4572 2700 explothe.exe schtasks.exe PID 2700 wrote to memory of 1772 2700 explothe.exe cmd.exe PID 2700 wrote to memory of 1772 2700 explothe.exe cmd.exe PID 2700 wrote to memory of 1772 2700 explothe.exe cmd.exe PID 3336 wrote to memory of 3896 3336 u1906789.exe legota.exe PID 3336 wrote to memory of 3896 3336 u1906789.exe legota.exe PID 3336 wrote to memory of 3896 3336 u1906789.exe legota.exe PID 3736 wrote to memory of 2952 3736 af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe w7477855.exe PID 3736 wrote to memory of 2952 3736 af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe w7477855.exe PID 3736 wrote to memory of 2952 3736 af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe w7477855.exe PID 1772 wrote to memory of 2556 1772 cmd.exe cmd.exe PID 1772 wrote to memory of 2556 1772 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe"C:\Users\Admin\AppData\Local\Temp\af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2260712.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2260712.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1863121.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1863121.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3781577.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3781577.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1475711.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1475711.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0259766.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0259766.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2222851.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2222851.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6047⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0083494.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0083494.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 5806⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2072444.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2072444.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1906789.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1906789.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7477855.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7477855.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5044 -ip 50441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3900 -ip 39001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3796 -ip 37961⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7477855.exeFilesize
23KB
MD55ed7d0c4eb336de7831f5db947e25ad6
SHA12ba3e3b48903f9582c6aeff1111ab2e17bcfb42f
SHA2563014a67b430b6e0a2bddea6cafab0f157f4c437d08d9c8df2fb4b0fcf288e70c
SHA512e43bcd1d35fcd8f5ea5fb1de17223dbb5d1c23f05ef58fb6939b6aab496a2a47074e34f57e5bb9c94e4f45809b84d2733df6977bc17ac48ff5bc795d3645f4fa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7477855.exeFilesize
23KB
MD55ed7d0c4eb336de7831f5db947e25ad6
SHA12ba3e3b48903f9582c6aeff1111ab2e17bcfb42f
SHA2563014a67b430b6e0a2bddea6cafab0f157f4c437d08d9c8df2fb4b0fcf288e70c
SHA512e43bcd1d35fcd8f5ea5fb1de17223dbb5d1c23f05ef58fb6939b6aab496a2a47074e34f57e5bb9c94e4f45809b84d2733df6977bc17ac48ff5bc795d3645f4fa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2260712.exeFilesize
973KB
MD54a7d4bb79c5d6db2b88f96731fde00bd
SHA1bccd977fde352cd832c47e57ed7291be381aa492
SHA256bf30ed0daca611307ae571d79af1342d844587df57b761cb24e89e338a884bb7
SHA5123d1be8b90526f21150c648581a4d7ebfaa7da6a3f3b964155bad5d2e136d85a4cab7e63b7b49ad0b5f6a786638f9b02ae0f124bfcdc70b8b89016f09e31b5b69
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2260712.exeFilesize
973KB
MD54a7d4bb79c5d6db2b88f96731fde00bd
SHA1bccd977fde352cd832c47e57ed7291be381aa492
SHA256bf30ed0daca611307ae571d79af1342d844587df57b761cb24e89e338a884bb7
SHA5123d1be8b90526f21150c648581a4d7ebfaa7da6a3f3b964155bad5d2e136d85a4cab7e63b7b49ad0b5f6a786638f9b02ae0f124bfcdc70b8b89016f09e31b5b69
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1906789.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1906789.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1863121.exeFilesize
791KB
MD516a4d09d7dd87c8fc279c6c63afb3227
SHA104f3f2e5a176230e9bb669d95ff9029161eda2fb
SHA2568c9de866676d368b1499b9ba45962640c43b5c0d484112ec499260203fbff051
SHA5126bf345f22282b8248f7dd74d3f4003842c24b568cb23c46d08d6b9c9fa3d75123e8e2e57b09f38929718f73875d9a926ce3e966b33d274d4cfc1f54ea97d6871
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1863121.exeFilesize
791KB
MD516a4d09d7dd87c8fc279c6c63afb3227
SHA104f3f2e5a176230e9bb669d95ff9029161eda2fb
SHA2568c9de866676d368b1499b9ba45962640c43b5c0d484112ec499260203fbff051
SHA5126bf345f22282b8248f7dd74d3f4003842c24b568cb23c46d08d6b9c9fa3d75123e8e2e57b09f38929718f73875d9a926ce3e966b33d274d4cfc1f54ea97d6871
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2072444.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2072444.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3781577.exeFilesize
608KB
MD5f3a9c4e28f28d0622e9e74b78a13d74d
SHA1f55a62d9ad193635800424cf18d87209859a12ae
SHA256ae43daf7a3d50cffdb03957b9dc2d9c31526fb3b413072851f27441c1c3588f9
SHA512d4b3a291aa042cf8e52a4a8b75464b544752f11152cdbc1e3f310689b89417c255622718d38ed7a9ff2cc12118de051ace72d937cb19148150bc549d7020d892
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3781577.exeFilesize
608KB
MD5f3a9c4e28f28d0622e9e74b78a13d74d
SHA1f55a62d9ad193635800424cf18d87209859a12ae
SHA256ae43daf7a3d50cffdb03957b9dc2d9c31526fb3b413072851f27441c1c3588f9
SHA512d4b3a291aa042cf8e52a4a8b75464b544752f11152cdbc1e3f310689b89417c255622718d38ed7a9ff2cc12118de051ace72d937cb19148150bc549d7020d892
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0083494.exeFilesize
390KB
MD51f988fa79722ebf77d9309b9f18cb662
SHA14cd578c2b1f921ebf462afbce540b9130ae9441f
SHA25698e0b87988deaab3e737a991c7f2e3a903c668d4089610adec03994757414e22
SHA51257821e6cd7605e9cc8df4236504a8e84cd9a241bc37d899d6fd71235c060a95d734ae60067993d211570a39b58e0e4e2818f0ea8bd6b8a3cc35842046c23d841
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0083494.exeFilesize
390KB
MD51f988fa79722ebf77d9309b9f18cb662
SHA14cd578c2b1f921ebf462afbce540b9130ae9441f
SHA25698e0b87988deaab3e737a991c7f2e3a903c668d4089610adec03994757414e22
SHA51257821e6cd7605e9cc8df4236504a8e84cd9a241bc37d899d6fd71235c060a95d734ae60067993d211570a39b58e0e4e2818f0ea8bd6b8a3cc35842046c23d841
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1475711.exeFilesize
335KB
MD518629b91722c25956a47d17f55fbcd69
SHA16e5271e70ea418ac0ab8c0bfe4888733c5186df9
SHA256820c8ef5fd336e9c56bc2a3ecfa9771af354ad5ed5374289f08644aeea30c02c
SHA51219cd6c5bbfbd3b8313726ab55fa29202a2a9c8fca440e877c382b1228f3637c51ec8427399144d5565f0c249dc1992180ce5851ff41ff4072b9fa50a4d4815e7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1475711.exeFilesize
335KB
MD518629b91722c25956a47d17f55fbcd69
SHA16e5271e70ea418ac0ab8c0bfe4888733c5186df9
SHA256820c8ef5fd336e9c56bc2a3ecfa9771af354ad5ed5374289f08644aeea30c02c
SHA51219cd6c5bbfbd3b8313726ab55fa29202a2a9c8fca440e877c382b1228f3637c51ec8427399144d5565f0c249dc1992180ce5851ff41ff4072b9fa50a4d4815e7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0259766.exeFilesize
11KB
MD5db470468cf9b02a2169ca98cd71bf7aa
SHA1d6c72558b4c763a17ea871c7bc97a834c6e32f8e
SHA256a99e111ca4ef461a2f939fd1b6a2baf80204192120711aad27b1917d8417aad1
SHA5126863e50d058c7f1ee405e647cf98d89e90230fb79ce161ffa5f0536c5d1462e6445221a4d90f55d2f790e082fb9a1a974f0a272762f734762f0d8554e2ad9554
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0259766.exeFilesize
11KB
MD5db470468cf9b02a2169ca98cd71bf7aa
SHA1d6c72558b4c763a17ea871c7bc97a834c6e32f8e
SHA256a99e111ca4ef461a2f939fd1b6a2baf80204192120711aad27b1917d8417aad1
SHA5126863e50d058c7f1ee405e647cf98d89e90230fb79ce161ffa5f0536c5d1462e6445221a4d90f55d2f790e082fb9a1a974f0a272762f734762f0d8554e2ad9554
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2222851.exeFilesize
356KB
MD55e5fb533ab377fd5e80c434b72ff26cc
SHA1c327232b9a374583f368348efc0d261283fa9fb5
SHA256213fdcb311d8982816ef0ade58858904d23b3f884b0f26431f443251cca62324
SHA5124ed5c603bda8f4be4a5138a523bdbe0d3d8c91d271b5d44f8c88194359a72ba2bdc1b18d8903bb99ed926829dabea551a518a9ce04fff63c9273fabf548cfb5f
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2222851.exeFilesize
356KB
MD55e5fb533ab377fd5e80c434b72ff26cc
SHA1c327232b9a374583f368348efc0d261283fa9fb5
SHA256213fdcb311d8982816ef0ade58858904d23b3f884b0f26431f443251cca62324
SHA5124ed5c603bda8f4be4a5138a523bdbe0d3d8c91d271b5d44f8c88194359a72ba2bdc1b18d8903bb99ed926829dabea551a518a9ce04fff63c9273fabf548cfb5f
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/404-72-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/404-73-0x00000000050E0000-0x00000000050F2000-memory.dmpFilesize
72KB
-
memory/404-53-0x0000000005090000-0x0000000005096000-memory.dmpFilesize
24KB
-
memory/404-85-0x00000000052B0000-0x00000000052FC000-memory.dmpFilesize
304KB
-
memory/404-86-0x0000000073B70000-0x0000000074320000-memory.dmpFilesize
7.7MB
-
memory/404-87-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/404-81-0x0000000005270000-0x00000000052AC000-memory.dmpFilesize
240KB
-
memory/404-68-0x0000000005850000-0x0000000005E68000-memory.dmpFilesize
6.1MB
-
memory/404-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/404-51-0x0000000073B70000-0x0000000074320000-memory.dmpFilesize
7.7MB
-
memory/404-71-0x0000000005340000-0x000000000544A000-memory.dmpFilesize
1.0MB
-
memory/3900-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3900-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3900-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3900-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4160-38-0x00007FF8BD420000-0x00007FF8BDEE1000-memory.dmpFilesize
10.8MB
-
memory/4160-36-0x00007FF8BD420000-0x00007FF8BDEE1000-memory.dmpFilesize
10.8MB
-
memory/4160-35-0x0000000000F90000-0x0000000000F9A000-memory.dmpFilesize
40KB