Analysis
-
max time kernel
154s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 19:43
Static task
static1
Behavioral task
behavioral1
Sample
2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe
-
Size
990KB
-
MD5
429ad4903a0eb5549c81d73f1a6069f6
-
SHA1
46b6d31c7105411079989ee25081756ae971e936
-
SHA256
2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08
-
SHA512
e2b73c3b47dfd96aa49e710fb41b94830900d39125c45b91135f27eb3fc613600e4500dbf03ce7647cc10550fe378ee23ad9ce3b30cccdafaefffe5c9b81adf5
-
SSDEEP
24576:JyF5ejFHm7pOl3vlBOWsrqYcjXaQBqEnw8u2G65e:8aBHi4hfDs+YcjXaQhwHt6
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9415989.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9415989.exe healer behavioral2/memory/3744-35-0x0000000000720000-0x000000000072A000-memory.dmp healer -
Processes:
q9415989.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q9415989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q9415989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q9415989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q9415989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q9415989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q9415989.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t3112530.exeexplothe.exeu2580679.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation t3112530.exe Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation u2580679.exe Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z3456820.exez2934588.exez5111296.exez7649377.exeq9415989.exer0926252.exes1085854.exet3112530.exeexplothe.exeu2580679.exelegota.exew1374787.exelegota.exeexplothe.exelegota.exeexplothe.exepid process 4812 z3456820.exe 1348 z2934588.exe 4992 z5111296.exe 4872 z7649377.exe 3744 q9415989.exe 2384 r0926252.exe 2264 s1085854.exe 2424 t3112530.exe 1580 explothe.exe 4764 u2580679.exe 1608 legota.exe 3328 w1374787.exe 4532 legota.exe 4872 explothe.exe 4380 legota.exe 3292 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2032 rundll32.exe 4884 rundll32.exe -
Processes:
q9415989.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q9415989.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exez3456820.exez2934588.exez5111296.exez7649377.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3456820.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z2934588.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z5111296.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z7649377.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r0926252.exes1085854.exedescription pid process target process PID 2384 set thread context of 4252 2384 r0926252.exe AppLaunch.exe PID 2264 set thread context of 1700 2264 s1085854.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4864 2384 WerFault.exe r0926252.exe 3876 4252 WerFault.exe AppLaunch.exe 4288 2264 WerFault.exe s1085854.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5104 schtasks.exe 4108 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q9415989.exepid process 3744 q9415989.exe 3744 q9415989.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q9415989.exedescription pid process Token: SeDebugPrivilege 3744 q9415989.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exez3456820.exez2934588.exez5111296.exez7649377.exer0926252.exes1085854.exet3112530.exeexplothe.exeu2580679.execmd.exelegota.exedescription pid process target process PID 4932 wrote to memory of 4812 4932 2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe z3456820.exe PID 4932 wrote to memory of 4812 4932 2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe z3456820.exe PID 4932 wrote to memory of 4812 4932 2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe z3456820.exe PID 4812 wrote to memory of 1348 4812 z3456820.exe z2934588.exe PID 4812 wrote to memory of 1348 4812 z3456820.exe z2934588.exe PID 4812 wrote to memory of 1348 4812 z3456820.exe z2934588.exe PID 1348 wrote to memory of 4992 1348 z2934588.exe z5111296.exe PID 1348 wrote to memory of 4992 1348 z2934588.exe z5111296.exe PID 1348 wrote to memory of 4992 1348 z2934588.exe z5111296.exe PID 4992 wrote to memory of 4872 4992 z5111296.exe z7649377.exe PID 4992 wrote to memory of 4872 4992 z5111296.exe z7649377.exe PID 4992 wrote to memory of 4872 4992 z5111296.exe z7649377.exe PID 4872 wrote to memory of 3744 4872 z7649377.exe q9415989.exe PID 4872 wrote to memory of 3744 4872 z7649377.exe q9415989.exe PID 4872 wrote to memory of 2384 4872 z7649377.exe r0926252.exe PID 4872 wrote to memory of 2384 4872 z7649377.exe r0926252.exe PID 4872 wrote to memory of 2384 4872 z7649377.exe r0926252.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 2384 wrote to memory of 4252 2384 r0926252.exe AppLaunch.exe PID 4992 wrote to memory of 2264 4992 z5111296.exe s1085854.exe PID 4992 wrote to memory of 2264 4992 z5111296.exe s1085854.exe PID 4992 wrote to memory of 2264 4992 z5111296.exe s1085854.exe PID 2264 wrote to memory of 1700 2264 s1085854.exe AppLaunch.exe PID 2264 wrote to memory of 1700 2264 s1085854.exe AppLaunch.exe PID 2264 wrote to memory of 1700 2264 s1085854.exe AppLaunch.exe PID 2264 wrote to memory of 1700 2264 s1085854.exe AppLaunch.exe PID 2264 wrote to memory of 1700 2264 s1085854.exe AppLaunch.exe PID 2264 wrote to memory of 1700 2264 s1085854.exe AppLaunch.exe PID 2264 wrote to memory of 1700 2264 s1085854.exe AppLaunch.exe PID 2264 wrote to memory of 1700 2264 s1085854.exe AppLaunch.exe PID 1348 wrote to memory of 2424 1348 z2934588.exe t3112530.exe PID 1348 wrote to memory of 2424 1348 z2934588.exe t3112530.exe PID 1348 wrote to memory of 2424 1348 z2934588.exe t3112530.exe PID 2424 wrote to memory of 1580 2424 t3112530.exe explothe.exe PID 2424 wrote to memory of 1580 2424 t3112530.exe explothe.exe PID 2424 wrote to memory of 1580 2424 t3112530.exe explothe.exe PID 4812 wrote to memory of 4764 4812 z3456820.exe u2580679.exe PID 4812 wrote to memory of 4764 4812 z3456820.exe u2580679.exe PID 4812 wrote to memory of 4764 4812 z3456820.exe u2580679.exe PID 1580 wrote to memory of 5104 1580 explothe.exe schtasks.exe PID 1580 wrote to memory of 5104 1580 explothe.exe schtasks.exe PID 1580 wrote to memory of 5104 1580 explothe.exe schtasks.exe PID 1580 wrote to memory of 64 1580 explothe.exe cmd.exe PID 1580 wrote to memory of 64 1580 explothe.exe cmd.exe PID 1580 wrote to memory of 64 1580 explothe.exe cmd.exe PID 4764 wrote to memory of 1608 4764 u2580679.exe legota.exe PID 4764 wrote to memory of 1608 4764 u2580679.exe legota.exe PID 4764 wrote to memory of 1608 4764 u2580679.exe legota.exe PID 4932 wrote to memory of 3328 4932 2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe w1374787.exe PID 4932 wrote to memory of 3328 4932 2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe w1374787.exe PID 4932 wrote to memory of 3328 4932 2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe w1374787.exe PID 64 wrote to memory of 3372 64 cmd.exe cmd.exe PID 64 wrote to memory of 3372 64 cmd.exe cmd.exe PID 64 wrote to memory of 3372 64 cmd.exe cmd.exe PID 1608 wrote to memory of 4108 1608 legota.exe schtasks.exe PID 1608 wrote to memory of 4108 1608 legota.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe"C:\Users\Admin\AppData\Local\Temp\2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3456820.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3456820.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2934588.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2934588.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5111296.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5111296.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7649377.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7649377.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9415989.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9415989.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0926252.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0926252.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 5408⤵
- Program crash
PID:3876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1527⤵
- Program crash
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1085854.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1085854.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:1700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 5846⤵
- Program crash
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3112530.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3112530.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:5104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3372
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:440
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4372
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:4332
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:3168
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2580679.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2580679.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:4108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:452
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:4716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4344
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:3388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3212
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:1292
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:2612
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1374787.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1374787.exe2⤵
- Executes dropped EXE
PID:3328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2384 -ip 23841⤵PID:5112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4252 -ip 42521⤵PID:4956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2264 -ip 22641⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4532
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:4872
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4380
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:3292
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1374787.exeFilesize
23KB
MD502025f41355c3022358ca4cc9c1dee3a
SHA1c68f92a836a5067ee6a35efa294d9412693ea8c2
SHA256de9087cc368f7f1e021aeaddd14d8154685ff2f173dee6aafc34508c523a5183
SHA5127719205080dda50160f3c3d6baeeaee5592cdd479fd1fad7b8ef522d77ace6b16c7c14b7735b8afb9791b7639ddf85abcbe1f335a00552d83bff7c36bb4a92c0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1374787.exeFilesize
23KB
MD502025f41355c3022358ca4cc9c1dee3a
SHA1c68f92a836a5067ee6a35efa294d9412693ea8c2
SHA256de9087cc368f7f1e021aeaddd14d8154685ff2f173dee6aafc34508c523a5183
SHA5127719205080dda50160f3c3d6baeeaee5592cdd479fd1fad7b8ef522d77ace6b16c7c14b7735b8afb9791b7639ddf85abcbe1f335a00552d83bff7c36bb4a92c0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3456820.exeFilesize
889KB
MD57b2198d48d70022ff7b3a10efcac8acf
SHA15e50b89067ff2445b1c6563a1b50b2a5eaeca6c0
SHA2565beca64a8aea1aa8a09ae886ef4bc2bfebf2e25ca080c227e306ade2720bb938
SHA51221fcb0161470cc4037896db3d11c461b1385ab8a3401aec2bf9de20ef1b096ad8ecf23052f99678afeb6d7021525048b042bb52e979644dd03f27aa57a0a0464
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3456820.exeFilesize
889KB
MD57b2198d48d70022ff7b3a10efcac8acf
SHA15e50b89067ff2445b1c6563a1b50b2a5eaeca6c0
SHA2565beca64a8aea1aa8a09ae886ef4bc2bfebf2e25ca080c227e306ade2720bb938
SHA51221fcb0161470cc4037896db3d11c461b1385ab8a3401aec2bf9de20ef1b096ad8ecf23052f99678afeb6d7021525048b042bb52e979644dd03f27aa57a0a0464
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2580679.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2580679.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2934588.exeFilesize
709KB
MD5c087471094c89ec93e056259fa747d08
SHA1c8ae0c7894d8daad5e7d583514e2104ce0ccef6e
SHA256a86c7e5b3ae2c00419688b5d930c5131ddd8482e7f90a1f1163a92f43a4bbd29
SHA512b2159a056420b72657b811698789d66a3ba880fa0c9102b58910d29419603754a9d7e0a191ef6034ef49e857ba1418293da9c276f4673bbe1d307486d46bbc02
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2934588.exeFilesize
709KB
MD5c087471094c89ec93e056259fa747d08
SHA1c8ae0c7894d8daad5e7d583514e2104ce0ccef6e
SHA256a86c7e5b3ae2c00419688b5d930c5131ddd8482e7f90a1f1163a92f43a4bbd29
SHA512b2159a056420b72657b811698789d66a3ba880fa0c9102b58910d29419603754a9d7e0a191ef6034ef49e857ba1418293da9c276f4673bbe1d307486d46bbc02
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3112530.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3112530.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5111296.exeFilesize
526KB
MD5508ab970afb4ac300f42f0c1a87063a7
SHA143e2655210c8e0131c8bb540cdab1816013f5ef3
SHA256c8a0611fc96b03ec92fbbac392fc2c7c81cb20a580fe81eca9390012d2fc93f5
SHA51255f5e0c2cff61c348d6728c3ff6f19ff17c04374306033ab1f7d028469d8964b338029c3df8bc960529132ce2d6aafe431e796de1a82c44d17b36637f1057417
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5111296.exeFilesize
526KB
MD5508ab970afb4ac300f42f0c1a87063a7
SHA143e2655210c8e0131c8bb540cdab1816013f5ef3
SHA256c8a0611fc96b03ec92fbbac392fc2c7c81cb20a580fe81eca9390012d2fc93f5
SHA51255f5e0c2cff61c348d6728c3ff6f19ff17c04374306033ab1f7d028469d8964b338029c3df8bc960529132ce2d6aafe431e796de1a82c44d17b36637f1057417
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1085854.exeFilesize
310KB
MD567e71d3ee7d80673cb3de0ebddd1a982
SHA10ed28ebf15878fe5f2a2a15dc5df698f1a8e00e0
SHA2562af6d4a2905e7589fb1ded9c2c4f14bf2b4cd40aa3c19e5c54c7077720095e75
SHA5126f9aa0d5dc7cb71d2cc53e5672eec407018005251f17bd3f0c83d0b5e58b2d8f2e32d9dd968fed24aab20d76e26f473eea9e7b262b671562f7b69ca713753b78
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1085854.exeFilesize
310KB
MD567e71d3ee7d80673cb3de0ebddd1a982
SHA10ed28ebf15878fe5f2a2a15dc5df698f1a8e00e0
SHA2562af6d4a2905e7589fb1ded9c2c4f14bf2b4cd40aa3c19e5c54c7077720095e75
SHA5126f9aa0d5dc7cb71d2cc53e5672eec407018005251f17bd3f0c83d0b5e58b2d8f2e32d9dd968fed24aab20d76e26f473eea9e7b262b671562f7b69ca713753b78
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7649377.exeFilesize
296KB
MD51daa9572f97fd034ae59945b714e206a
SHA162c680d407d2057265801988f40c34a2953dca89
SHA256fcb43bad07dbc70c273b78f591f41a1826cec51b9f2af6cb016504e26ad72cba
SHA5120d563f59026506f5f1cd411cc070e22a045f16b2223e1bb62cc535be5ab8b52a2feedcf46b2b701b286d2054adae5e26d93f406a10076523e1b1e82578ea9637
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7649377.exeFilesize
296KB
MD51daa9572f97fd034ae59945b714e206a
SHA162c680d407d2057265801988f40c34a2953dca89
SHA256fcb43bad07dbc70c273b78f591f41a1826cec51b9f2af6cb016504e26ad72cba
SHA5120d563f59026506f5f1cd411cc070e22a045f16b2223e1bb62cc535be5ab8b52a2feedcf46b2b701b286d2054adae5e26d93f406a10076523e1b1e82578ea9637
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9415989.exeFilesize
11KB
MD59e710f9caa4b24f28b8d0fa5b0544b6e
SHA19f7d03509e02a1dedfd72b4b2197ec77de68a06f
SHA25608f7b6929b78ae823572c05a0b1d2b349396f58cabc9573b469033f897d41e94
SHA5129d66cee104f9f83cee248fa730402e9bc5fb0e2b9195ce57e19d28d7595f31be61d2d67746fa7df46913b527ca613f154209efb669ca7a1a95a5a2347db624ac
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9415989.exeFilesize
11KB
MD59e710f9caa4b24f28b8d0fa5b0544b6e
SHA19f7d03509e02a1dedfd72b4b2197ec77de68a06f
SHA25608f7b6929b78ae823572c05a0b1d2b349396f58cabc9573b469033f897d41e94
SHA5129d66cee104f9f83cee248fa730402e9bc5fb0e2b9195ce57e19d28d7595f31be61d2d67746fa7df46913b527ca613f154209efb669ca7a1a95a5a2347db624ac
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0926252.exeFilesize
276KB
MD576a2f1d59ebafc54cb439fa26557ded5
SHA18ae1664146fbc007d502848f91c6abda54e194f3
SHA2560f5912f41ae0c71f3f0a9a6254cbd1ccbda73e46703d095fe433eda5928393ed
SHA5123b8fc29f1b50629f074cf78968f744e19bc64e83c8ad2a25972dd302ee2b73d0828e70ce508688a76d710b6d37c1013f4e7da6412a601a6c2c2e4d4a0aa18cc9
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0926252.exeFilesize
276KB
MD576a2f1d59ebafc54cb439fa26557ded5
SHA18ae1664146fbc007d502848f91c6abda54e194f3
SHA2560f5912f41ae0c71f3f0a9a6254cbd1ccbda73e46703d095fe433eda5928393ed
SHA5123b8fc29f1b50629f074cf78968f744e19bc64e83c8ad2a25972dd302ee2b73d0828e70ce508688a76d710b6d37c1013f4e7da6412a601a6c2c2e4d4a0aa18cc9
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1700-60-0x0000000005170000-0x000000000527A000-memory.dmpFilesize
1.0MB
-
memory/1700-65-0x00000000050A0000-0x00000000050B2000-memory.dmpFilesize
72KB
-
memory/1700-83-0x0000000005280000-0x00000000052CC000-memory.dmpFilesize
304KB
-
memory/1700-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1700-52-0x00000000742E0000-0x0000000074A90000-memory.dmpFilesize
7.7MB
-
memory/1700-87-0x00000000742E0000-0x0000000074A90000-memory.dmpFilesize
7.7MB
-
memory/1700-88-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1700-59-0x0000000005670000-0x0000000005C88000-memory.dmpFilesize
6.1MB
-
memory/1700-53-0x0000000000EA0000-0x0000000000EA6000-memory.dmpFilesize
24KB
-
memory/1700-75-0x0000000005100000-0x000000000513C000-memory.dmpFilesize
240KB
-
memory/1700-66-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/3744-39-0x00007FFC64470000-0x00007FFC64F31000-memory.dmpFilesize
10.8MB
-
memory/3744-37-0x00007FFC64470000-0x00007FFC64F31000-memory.dmpFilesize
10.8MB
-
memory/3744-35-0x0000000000720000-0x000000000072A000-memory.dmpFilesize
40KB
-
memory/3744-36-0x00007FFC64470000-0x00007FFC64F31000-memory.dmpFilesize
10.8MB
-
memory/4252-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4252-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4252-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4252-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB