Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 19:43
Static task
static1
Behavioral task
behavioral1
Sample
2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe
-
Size
1.0MB
-
MD5
4d3d3e269b3fe6c81e7fd330ebcc3a9a
-
SHA1
63ff1af264a84a72e4699d22b05df60456ef8f00
-
SHA256
2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b
-
SHA512
abfd58e804826ff9f508eee7682d5af5c7c002323f0ce09d6ce028d1d56fc60249e7c4c4b9745e4ffc4e19e95d764c41c17c60c79f8eca1bfde9dd921589d28a
-
SSDEEP
24576:OyR9ZHgujQTMsuKIpBcm5zZvRuLkNWy0YdQD7He7D:dJouK+VzFRuRyED7He
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5701320.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5701320.exe healer behavioral2/memory/4224-35-0x00000000006D0000-0x00000000006DA000-memory.dmp healer -
Processes:
q5701320.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q5701320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q5701320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q5701320.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q5701320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q5701320.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q5701320.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explothe.exeu7040585.exelegota.exet5827812.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation u7040585.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation t5827812.exe -
Executes dropped EXE 16 IoCs
Processes:
z3790340.exez9845076.exez9112289.exez2427639.exeq5701320.exer3319610.exes8022542.exet5827812.exeexplothe.exeu7040585.exelegota.exew8876112.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 504 z3790340.exe 4300 z9845076.exe 3968 z9112289.exe 4416 z2427639.exe 4224 q5701320.exe 4712 r3319610.exe 4216 s8022542.exe 4632 t5827812.exe 116 explothe.exe 2192 u7040585.exe 4344 legota.exe 2432 w8876112.exe 3308 explothe.exe 3964 legota.exe 4476 explothe.exe 2960 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4608 rundll32.exe 2968 rundll32.exe -
Processes:
q5701320.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q5701320.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exez3790340.exez9845076.exez9112289.exez2427639.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3790340.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z9845076.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z9112289.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z2427639.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r3319610.exes8022542.exedescription pid process target process PID 4712 set thread context of 3560 4712 r3319610.exe AppLaunch.exe PID 4216 set thread context of 3996 4216 s8022542.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3568 4712 WerFault.exe r3319610.exe 3808 3560 WerFault.exe AppLaunch.exe 1796 4216 WerFault.exe s8022542.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5028 schtasks.exe 4544 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q5701320.exepid process 4224 q5701320.exe 4224 q5701320.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q5701320.exedescription pid process Token: SeDebugPrivilege 4224 q5701320.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exez3790340.exez9845076.exez9112289.exez2427639.exer3319610.exes8022542.exet5827812.exeexplothe.exeu7040585.exelegota.exedescription pid process target process PID 1380 wrote to memory of 504 1380 2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe z3790340.exe PID 1380 wrote to memory of 504 1380 2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe z3790340.exe PID 1380 wrote to memory of 504 1380 2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe z3790340.exe PID 504 wrote to memory of 4300 504 z3790340.exe z9845076.exe PID 504 wrote to memory of 4300 504 z3790340.exe z9845076.exe PID 504 wrote to memory of 4300 504 z3790340.exe z9845076.exe PID 4300 wrote to memory of 3968 4300 z9845076.exe z9112289.exe PID 4300 wrote to memory of 3968 4300 z9845076.exe z9112289.exe PID 4300 wrote to memory of 3968 4300 z9845076.exe z9112289.exe PID 3968 wrote to memory of 4416 3968 z9112289.exe z2427639.exe PID 3968 wrote to memory of 4416 3968 z9112289.exe z2427639.exe PID 3968 wrote to memory of 4416 3968 z9112289.exe z2427639.exe PID 4416 wrote to memory of 4224 4416 z2427639.exe q5701320.exe PID 4416 wrote to memory of 4224 4416 z2427639.exe q5701320.exe PID 4416 wrote to memory of 4712 4416 z2427639.exe r3319610.exe PID 4416 wrote to memory of 4712 4416 z2427639.exe r3319610.exe PID 4416 wrote to memory of 4712 4416 z2427639.exe r3319610.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 4712 wrote to memory of 3560 4712 r3319610.exe AppLaunch.exe PID 3968 wrote to memory of 4216 3968 z9112289.exe s8022542.exe PID 3968 wrote to memory of 4216 3968 z9112289.exe s8022542.exe PID 3968 wrote to memory of 4216 3968 z9112289.exe s8022542.exe PID 4216 wrote to memory of 3996 4216 s8022542.exe AppLaunch.exe PID 4216 wrote to memory of 3996 4216 s8022542.exe AppLaunch.exe PID 4216 wrote to memory of 3996 4216 s8022542.exe AppLaunch.exe PID 4216 wrote to memory of 3996 4216 s8022542.exe AppLaunch.exe PID 4216 wrote to memory of 3996 4216 s8022542.exe AppLaunch.exe PID 4216 wrote to memory of 3996 4216 s8022542.exe AppLaunch.exe PID 4216 wrote to memory of 3996 4216 s8022542.exe AppLaunch.exe PID 4216 wrote to memory of 3996 4216 s8022542.exe AppLaunch.exe PID 4300 wrote to memory of 4632 4300 z9845076.exe t5827812.exe PID 4300 wrote to memory of 4632 4300 z9845076.exe t5827812.exe PID 4300 wrote to memory of 4632 4300 z9845076.exe t5827812.exe PID 4632 wrote to memory of 116 4632 t5827812.exe explothe.exe PID 4632 wrote to memory of 116 4632 t5827812.exe explothe.exe PID 4632 wrote to memory of 116 4632 t5827812.exe explothe.exe PID 504 wrote to memory of 2192 504 z3790340.exe u7040585.exe PID 504 wrote to memory of 2192 504 z3790340.exe u7040585.exe PID 504 wrote to memory of 2192 504 z3790340.exe u7040585.exe PID 116 wrote to memory of 4544 116 explothe.exe schtasks.exe PID 116 wrote to memory of 4544 116 explothe.exe schtasks.exe PID 116 wrote to memory of 4544 116 explothe.exe schtasks.exe PID 2192 wrote to memory of 4344 2192 u7040585.exe legota.exe PID 2192 wrote to memory of 4344 2192 u7040585.exe legota.exe PID 2192 wrote to memory of 4344 2192 u7040585.exe legota.exe PID 116 wrote to memory of 3088 116 explothe.exe cmd.exe PID 116 wrote to memory of 3088 116 explothe.exe cmd.exe PID 116 wrote to memory of 3088 116 explothe.exe cmd.exe PID 1380 wrote to memory of 2432 1380 2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe w8876112.exe PID 1380 wrote to memory of 2432 1380 2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe w8876112.exe PID 1380 wrote to memory of 2432 1380 2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe w8876112.exe PID 4344 wrote to memory of 5028 4344 legota.exe schtasks.exe PID 4344 wrote to memory of 5028 4344 legota.exe schtasks.exe PID 4344 wrote to memory of 5028 4344 legota.exe schtasks.exe PID 4344 wrote to memory of 3584 4344 legota.exe cmd.exe PID 4344 wrote to memory of 3584 4344 legota.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe"C:\Users\Admin\AppData\Local\Temp\2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3790340.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3790340.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9845076.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9845076.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9112289.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9112289.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2427639.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2427639.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5701320.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5701320.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3319610.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3319610.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 5408⤵
- Program crash
PID:3808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1407⤵
- Program crash
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8022542.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8022542.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:3996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 1526⤵
- Program crash
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5827812.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5827812.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:4544 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:3088
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:4616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3400
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:3008
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:3932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4204
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:4972
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u7040585.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u7040585.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:5028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:3584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4840
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:2248
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3260
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:3860
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:3492
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8876112.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8876112.exe2⤵
- Executes dropped EXE
PID:2432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4712 -ip 47121⤵PID:1044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3560 -ip 35601⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4216 -ip 42161⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:3308
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:3964
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:4476
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:2960
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8876112.exeFilesize
23KB
MD57f9c0e416d59c7e4979a09019f4167cd
SHA17d5c79ff23c32e2150f4af0c58f77439ca861817
SHA256a006b5236e397e277179cf3b5c42751d229f2758e7bcf9e057fcf771a778ba30
SHA5129c55c7a24fbf04c11bde215d4323a9d5c756bd6d2a241141cc2f0fdc30bd642fe6bb09d20d9958b000b3bb0ec1a75c55e4b6e8e0eea8d859c8ceef7eff7e2c66
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8876112.exeFilesize
23KB
MD57f9c0e416d59c7e4979a09019f4167cd
SHA17d5c79ff23c32e2150f4af0c58f77439ca861817
SHA256a006b5236e397e277179cf3b5c42751d229f2758e7bcf9e057fcf771a778ba30
SHA5129c55c7a24fbf04c11bde215d4323a9d5c756bd6d2a241141cc2f0fdc30bd642fe6bb09d20d9958b000b3bb0ec1a75c55e4b6e8e0eea8d859c8ceef7eff7e2c66
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3790340.exeFilesize
971KB
MD5f223a28b1f313f619b81151202bddcbc
SHA17d9a4dcd7ce5ab8d7944e99e62b1df3956fcd5bc
SHA25638d95f69b7862526448a4e0773b678b18f312523598f21a941849891ccec8741
SHA5128b53042558b174a6fc5d2c270dbe2164553bf66cc73046324e7519cda202451e7c9c3611739977bb200a244438d2299bfc79d5cfb083eaab30e327757c216ccc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3790340.exeFilesize
971KB
MD5f223a28b1f313f619b81151202bddcbc
SHA17d9a4dcd7ce5ab8d7944e99e62b1df3956fcd5bc
SHA25638d95f69b7862526448a4e0773b678b18f312523598f21a941849891ccec8741
SHA5128b53042558b174a6fc5d2c270dbe2164553bf66cc73046324e7519cda202451e7c9c3611739977bb200a244438d2299bfc79d5cfb083eaab30e327757c216ccc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u7040585.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u7040585.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9845076.exeFilesize
789KB
MD5aaf9b677f97bbff4bcddaf0e9457f6f0
SHA19f1ed41baa5d799678875d460a8ef30ed89d2666
SHA2566c83c92dbdb94b053ead64ba5320f7ae7f3aa672bc5c02190f3d27de77325399
SHA512a9eb169372f4bea53d8849e086f7c00b87dc006d7c29f730b96a46b167644359d95cd1254c0cafcad7a6215b9d1488552462ded94f106cfc6d2ce83ecbc730eb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9845076.exeFilesize
789KB
MD5aaf9b677f97bbff4bcddaf0e9457f6f0
SHA19f1ed41baa5d799678875d460a8ef30ed89d2666
SHA2566c83c92dbdb94b053ead64ba5320f7ae7f3aa672bc5c02190f3d27de77325399
SHA512a9eb169372f4bea53d8849e086f7c00b87dc006d7c29f730b96a46b167644359d95cd1254c0cafcad7a6215b9d1488552462ded94f106cfc6d2ce83ecbc730eb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5827812.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5827812.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9112289.exeFilesize
606KB
MD5995e012d6c218fc952242450ab18298b
SHA194d284ed5e1f716c4777d657e640bad379df25a7
SHA25623c007347049e9a9e7fcc57be1494d0a459151289e74f862148a3f6fea1123a3
SHA5122dfeb50a913f7458ad94290542a83b029cd1228998dab92b81056868383dd7e42058652efe1534c922d9453f6287792d48cfebfed2f202808c44a4696796fe15
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9112289.exeFilesize
606KB
MD5995e012d6c218fc952242450ab18298b
SHA194d284ed5e1f716c4777d657e640bad379df25a7
SHA25623c007347049e9a9e7fcc57be1494d0a459151289e74f862148a3f6fea1123a3
SHA5122dfeb50a913f7458ad94290542a83b029cd1228998dab92b81056868383dd7e42058652efe1534c922d9453f6287792d48cfebfed2f202808c44a4696796fe15
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8022542.exeFilesize
390KB
MD5216cdb6fe3af93bcd0ff6ff2997271fe
SHA11c5acfe0200e4f96a7e9fe245f76b4faf94c0f2a
SHA256763e1ea9d13b0da872258a04c8bdcacd0ea0f0f0f913eae60690fd8e16646add
SHA5124efcdc9486b6f2efbc4951ea4a0b591de07b29d1fc86ac1b3bec706890da47b7a2285f0d990f386bd2da15cb58b788cd0155c61580f5b115f6c75b6b2d45a257
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8022542.exeFilesize
390KB
MD5216cdb6fe3af93bcd0ff6ff2997271fe
SHA11c5acfe0200e4f96a7e9fe245f76b4faf94c0f2a
SHA256763e1ea9d13b0da872258a04c8bdcacd0ea0f0f0f913eae60690fd8e16646add
SHA5124efcdc9486b6f2efbc4951ea4a0b591de07b29d1fc86ac1b3bec706890da47b7a2285f0d990f386bd2da15cb58b788cd0155c61580f5b115f6c75b6b2d45a257
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2427639.exeFilesize
335KB
MD52fee5dec8bfecff82772d78002828e9d
SHA12662180e231420c8fb7f22d5d5522d31e789d82f
SHA25679a5a2780d2f1325957aa1fa75ab6e1aecde9a50ea2b6534b48f48d9feccc840
SHA51279af1da3cdd05942a99a0608a4870749698d350d7d86b771a53ea8f11effd0543a431389ece737e46cec48395c08c3343c625507e33e5edc5217951fcac0c89c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2427639.exeFilesize
335KB
MD52fee5dec8bfecff82772d78002828e9d
SHA12662180e231420c8fb7f22d5d5522d31e789d82f
SHA25679a5a2780d2f1325957aa1fa75ab6e1aecde9a50ea2b6534b48f48d9feccc840
SHA51279af1da3cdd05942a99a0608a4870749698d350d7d86b771a53ea8f11effd0543a431389ece737e46cec48395c08c3343c625507e33e5edc5217951fcac0c89c
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5701320.exeFilesize
11KB
MD5615810407dc112e860fea1ea461d0374
SHA149c57e14e4ae44e69f3d9324b982df3de4aea2ba
SHA2567bc5a078b412273d275ff9280228e3dc1379b8a6880f2cf2aa8ba1e4da2ffb31
SHA5125f4c1db527cbeb4b846677202f0cb014909bb9919025777c949e9658771c2ea0f37a4d6251e393db8964f994580003ce8bcca5fe4adb4be8b67d23982b9f2790
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5701320.exeFilesize
11KB
MD5615810407dc112e860fea1ea461d0374
SHA149c57e14e4ae44e69f3d9324b982df3de4aea2ba
SHA2567bc5a078b412273d275ff9280228e3dc1379b8a6880f2cf2aa8ba1e4da2ffb31
SHA5125f4c1db527cbeb4b846677202f0cb014909bb9919025777c949e9658771c2ea0f37a4d6251e393db8964f994580003ce8bcca5fe4adb4be8b67d23982b9f2790
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3319610.exeFilesize
356KB
MD5edcc57cb979a3dbf1bb5e46bda33bc03
SHA1b4c71d67c1eaeceb0b35e020dddb9fb0e82e7ec5
SHA256b936753a75a474181d39d7588d66e5c15d03f18aed23ab878ec5ae35331c9b0d
SHA512dcbb5e0b98d002ab69c576233f8911860d8080973261dcd5e2e642f181dc5d97e7ef8db41a6cf8a73cef8a4dd5492e24f77f8dec6b2f1bd52f1e922134e5ad5b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3319610.exeFilesize
356KB
MD5edcc57cb979a3dbf1bb5e46bda33bc03
SHA1b4c71d67c1eaeceb0b35e020dddb9fb0e82e7ec5
SHA256b936753a75a474181d39d7588d66e5c15d03f18aed23ab878ec5ae35331c9b0d
SHA512dcbb5e0b98d002ab69c576233f8911860d8080973261dcd5e2e642f181dc5d97e7ef8db41a6cf8a73cef8a4dd5492e24f77f8dec6b2f1bd52f1e922134e5ad5b
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/3560-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3560-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3560-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3560-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3996-66-0x00000000054D0000-0x000000000550C000-memory.dmpFilesize
240KB
-
memory/3996-87-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/3996-86-0x0000000074730000-0x0000000074EE0000-memory.dmpFilesize
7.7MB
-
memory/3996-75-0x0000000005510000-0x000000000555C000-memory.dmpFilesize
304KB
-
memory/3996-60-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/3996-61-0x0000000005240000-0x0000000005252000-memory.dmpFilesize
72KB
-
memory/3996-59-0x00000000055A0000-0x00000000056AA000-memory.dmpFilesize
1.0MB
-
memory/3996-58-0x0000000005AB0000-0x00000000060C8000-memory.dmpFilesize
6.1MB
-
memory/3996-52-0x0000000002D20000-0x0000000002D26000-memory.dmpFilesize
24KB
-
memory/3996-51-0x0000000074730000-0x0000000074EE0000-memory.dmpFilesize
7.7MB
-
memory/3996-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4224-35-0x00000000006D0000-0x00000000006DA000-memory.dmpFilesize
40KB
-
memory/4224-36-0x00007FFD12340000-0x00007FFD12E01000-memory.dmpFilesize
10.8MB
-
memory/4224-38-0x00007FFD12340000-0x00007FFD12E01000-memory.dmpFilesize
10.8MB