Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 19:52
Static task
static1
Behavioral task
behavioral1
Sample
4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe
-
Size
1.0MB
-
MD5
2570641ce0a480459b56a4dd46697358
-
SHA1
e83a8ff70f0879636aa364a53cae0d27ec482005
-
SHA256
4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b
-
SHA512
28e16069f5baff0b89f5074c088ef839f20fef02cbb9e94f81b37588b32f448e0225083335700cc63024ea6ce3fb269c41c899bf450de629c6db7805564a998d
-
SSDEEP
24576:gy5TGXlCznMRxKII4Blc74rROLGGDDHzA8EbOY:nNnr4Blc7oRAfDY8Eb
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2216565.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2216565.exe healer behavioral2/memory/4864-35-0x0000000000110000-0x000000000011A000-memory.dmp healer -
Processes:
q2216565.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q2216565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q2216565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q2216565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q2216565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q2216565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q2216565.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t8627469.exeexplothe.exeu8733832.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation t8627469.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation u8733832.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z4358130.exez6981061.exez8569234.exez0912836.exeq2216565.exer0169756.exes0945597.exet8627469.exeexplothe.exeu8733832.exelegota.exew0107493.exelegota.exeexplothe.exelegota.exeexplothe.exepid process 1168 z4358130.exe 3468 z6981061.exe 4524 z8569234.exe 2628 z0912836.exe 4864 q2216565.exe 4952 r0169756.exe 3776 s0945597.exe 4692 t8627469.exe 1920 explothe.exe 3440 u8733832.exe 1264 legota.exe 4696 w0107493.exe 4664 legota.exe 2932 explothe.exe 2176 legota.exe 1060 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1008 rundll32.exe 4980 rundll32.exe -
Processes:
q2216565.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q2216565.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exez4358130.exez6981061.exez8569234.exez0912836.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4358130.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z6981061.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z8569234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z0912836.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r0169756.exes0945597.exedescription pid process target process PID 4952 set thread context of 3704 4952 r0169756.exe AppLaunch.exe PID 3776 set thread context of 1884 3776 s0945597.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4332 3704 WerFault.exe AppLaunch.exe 2324 4952 WerFault.exe r0169756.exe 1696 3776 WerFault.exe s0945597.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1308 schtasks.exe 636 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q2216565.exepid process 4864 q2216565.exe 4864 q2216565.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q2216565.exedescription pid process Token: SeDebugPrivilege 4864 q2216565.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exez4358130.exez6981061.exez8569234.exez0912836.exer0169756.exes0945597.exet8627469.exeexplothe.exeu8733832.execmd.exelegota.exedescription pid process target process PID 1916 wrote to memory of 1168 1916 4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe z4358130.exe PID 1916 wrote to memory of 1168 1916 4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe z4358130.exe PID 1916 wrote to memory of 1168 1916 4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe z4358130.exe PID 1168 wrote to memory of 3468 1168 z4358130.exe z6981061.exe PID 1168 wrote to memory of 3468 1168 z4358130.exe z6981061.exe PID 1168 wrote to memory of 3468 1168 z4358130.exe z6981061.exe PID 3468 wrote to memory of 4524 3468 z6981061.exe z8569234.exe PID 3468 wrote to memory of 4524 3468 z6981061.exe z8569234.exe PID 3468 wrote to memory of 4524 3468 z6981061.exe z8569234.exe PID 4524 wrote to memory of 2628 4524 z8569234.exe z0912836.exe PID 4524 wrote to memory of 2628 4524 z8569234.exe z0912836.exe PID 4524 wrote to memory of 2628 4524 z8569234.exe z0912836.exe PID 2628 wrote to memory of 4864 2628 z0912836.exe q2216565.exe PID 2628 wrote to memory of 4864 2628 z0912836.exe q2216565.exe PID 2628 wrote to memory of 4952 2628 z0912836.exe r0169756.exe PID 2628 wrote to memory of 4952 2628 z0912836.exe r0169756.exe PID 2628 wrote to memory of 4952 2628 z0912836.exe r0169756.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4952 wrote to memory of 3704 4952 r0169756.exe AppLaunch.exe PID 4524 wrote to memory of 3776 4524 z8569234.exe s0945597.exe PID 4524 wrote to memory of 3776 4524 z8569234.exe s0945597.exe PID 4524 wrote to memory of 3776 4524 z8569234.exe s0945597.exe PID 3776 wrote to memory of 1884 3776 s0945597.exe AppLaunch.exe PID 3776 wrote to memory of 1884 3776 s0945597.exe AppLaunch.exe PID 3776 wrote to memory of 1884 3776 s0945597.exe AppLaunch.exe PID 3776 wrote to memory of 1884 3776 s0945597.exe AppLaunch.exe PID 3776 wrote to memory of 1884 3776 s0945597.exe AppLaunch.exe PID 3776 wrote to memory of 1884 3776 s0945597.exe AppLaunch.exe PID 3776 wrote to memory of 1884 3776 s0945597.exe AppLaunch.exe PID 3776 wrote to memory of 1884 3776 s0945597.exe AppLaunch.exe PID 3468 wrote to memory of 4692 3468 z6981061.exe t8627469.exe PID 3468 wrote to memory of 4692 3468 z6981061.exe t8627469.exe PID 3468 wrote to memory of 4692 3468 z6981061.exe t8627469.exe PID 4692 wrote to memory of 1920 4692 t8627469.exe explothe.exe PID 4692 wrote to memory of 1920 4692 t8627469.exe explothe.exe PID 4692 wrote to memory of 1920 4692 t8627469.exe explothe.exe PID 1168 wrote to memory of 3440 1168 z4358130.exe u8733832.exe PID 1168 wrote to memory of 3440 1168 z4358130.exe u8733832.exe PID 1168 wrote to memory of 3440 1168 z4358130.exe u8733832.exe PID 1920 wrote to memory of 1308 1920 explothe.exe schtasks.exe PID 1920 wrote to memory of 1308 1920 explothe.exe schtasks.exe PID 1920 wrote to memory of 1308 1920 explothe.exe schtasks.exe PID 3440 wrote to memory of 1264 3440 u8733832.exe legota.exe PID 3440 wrote to memory of 1264 3440 u8733832.exe legota.exe PID 3440 wrote to memory of 1264 3440 u8733832.exe legota.exe PID 1920 wrote to memory of 3224 1920 explothe.exe cmd.exe PID 1920 wrote to memory of 3224 1920 explothe.exe cmd.exe PID 1920 wrote to memory of 3224 1920 explothe.exe cmd.exe PID 1916 wrote to memory of 4696 1916 4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe w0107493.exe PID 1916 wrote to memory of 4696 1916 4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe w0107493.exe PID 1916 wrote to memory of 4696 1916 4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe w0107493.exe PID 3224 wrote to memory of 4536 3224 cmd.exe cmd.exe PID 3224 wrote to memory of 4536 3224 cmd.exe cmd.exe PID 3224 wrote to memory of 4536 3224 cmd.exe cmd.exe PID 1264 wrote to memory of 636 1264 legota.exe schtasks.exe PID 1264 wrote to memory of 636 1264 legota.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe"C:\Users\Admin\AppData\Local\Temp\4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4358130.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4358130.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6981061.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6981061.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8569234.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8569234.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0912836.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0912836.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2216565.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2216565.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0169756.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0169756.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 5408⤵
- Program crash
PID:4332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 5807⤵
- Program crash
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0945597.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0945597.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:1884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 1486⤵
- Program crash
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8627469.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8627469.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:1308 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4536
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:2760
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4676
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:400
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:2268
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8733832.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8733832.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:636 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:1892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4480
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:3496
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:2372
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:2232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1896
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:2928
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0107493.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0107493.exe2⤵
- Executes dropped EXE
PID:4696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4952 -ip 49521⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3704 -ip 37041⤵PID:1616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3776 -ip 37761⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4664
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:2932
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:2176
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:1060
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0107493.exeFilesize
23KB
MD5f5f5bed65b2fe477ffe6e9f82f92dc29
SHA11bff0351da214db1c37f234fe1d2a54b11b4791d
SHA256f5983dc957698d22889ffb23e49ebf70fc53542ffa62b1c869eeab87a768fd66
SHA512741a6953bfad8f1a8c4602063fb28c5952b8cec6fee4aa733069a1c59ec6160a66dae0cd0f199dfd61b1f4412be79f0f3a11a24c39ff3cf95056a5c5311d1497
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0107493.exeFilesize
23KB
MD5f5f5bed65b2fe477ffe6e9f82f92dc29
SHA11bff0351da214db1c37f234fe1d2a54b11b4791d
SHA256f5983dc957698d22889ffb23e49ebf70fc53542ffa62b1c869eeab87a768fd66
SHA512741a6953bfad8f1a8c4602063fb28c5952b8cec6fee4aa733069a1c59ec6160a66dae0cd0f199dfd61b1f4412be79f0f3a11a24c39ff3cf95056a5c5311d1497
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4358130.exeFilesize
971KB
MD5f4bde4bfc795f20478c5acf9bc552d19
SHA14ee9da0f957d15fb7f29aee606072d76b5fc4a11
SHA256006f34cbdbfc1c7f2307bc7eba241e94b082c409b62e8b35266b71854a041c4a
SHA512b65f1037e35e6a037228d0e49146a1d5f04bb86b5c88e92e228eb112890a3603ae3690a219462f1c29ac027bd634be7a2620e7a9ef187b97974ff05dddf843e8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4358130.exeFilesize
971KB
MD5f4bde4bfc795f20478c5acf9bc552d19
SHA14ee9da0f957d15fb7f29aee606072d76b5fc4a11
SHA256006f34cbdbfc1c7f2307bc7eba241e94b082c409b62e8b35266b71854a041c4a
SHA512b65f1037e35e6a037228d0e49146a1d5f04bb86b5c88e92e228eb112890a3603ae3690a219462f1c29ac027bd634be7a2620e7a9ef187b97974ff05dddf843e8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8733832.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8733832.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6981061.exeFilesize
788KB
MD578c8df373b7d881994b2ca00c9a6629f
SHA1a7ab7efacc388ac8826e2c412a721dbaedf1ffa7
SHA25647ecfc7473c88b64bea0f835fc28fd31764ef463324087c247a380672599837f
SHA51295b6a5bc54abd7c0bff5b550c85d9e1a036970ebaf0d196d7c0f03de815badd88217b53d297ac896d62fcd99e2b2d2c808f9f010ec8936dcebed6b50fc9447e1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6981061.exeFilesize
788KB
MD578c8df373b7d881994b2ca00c9a6629f
SHA1a7ab7efacc388ac8826e2c412a721dbaedf1ffa7
SHA25647ecfc7473c88b64bea0f835fc28fd31764ef463324087c247a380672599837f
SHA51295b6a5bc54abd7c0bff5b550c85d9e1a036970ebaf0d196d7c0f03de815badd88217b53d297ac896d62fcd99e2b2d2c808f9f010ec8936dcebed6b50fc9447e1
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8627469.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8627469.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8569234.exeFilesize
606KB
MD5dbd0ca1c52ccee106017732f93be2a5f
SHA15d92fd083c694cdad46d09ea8d3fc6195e8a0db5
SHA2563e50a61dc7c69a3f7208eccf0590501052dc5bd6daaa62cd554b341a8abb709b
SHA5126815bc5a22828b637c03e42024772355aba581edb772a31ca71a8fefe8d361071089d5d36bbe704d8c72442027db099c5f2a78e7b59699af991a1a49920092a2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8569234.exeFilesize
606KB
MD5dbd0ca1c52ccee106017732f93be2a5f
SHA15d92fd083c694cdad46d09ea8d3fc6195e8a0db5
SHA2563e50a61dc7c69a3f7208eccf0590501052dc5bd6daaa62cd554b341a8abb709b
SHA5126815bc5a22828b637c03e42024772355aba581edb772a31ca71a8fefe8d361071089d5d36bbe704d8c72442027db099c5f2a78e7b59699af991a1a49920092a2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0945597.exeFilesize
390KB
MD59e1e7df4738db0dbc249800164ba34b1
SHA1043a8bc9aa9052c7468cd829332f09a87eabec02
SHA25635d13db7d7f1e976f8b464c06127ab00ae7547d76ac525568c3529c462fdce55
SHA512964c28a251f51ef7506c1289cc92275496dc7883253b0b06889292c60efa1cca50e2c698b02ef6e57bf554c90713a76f58cdadea95867f4203bcf161c6d23837
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0945597.exeFilesize
390KB
MD59e1e7df4738db0dbc249800164ba34b1
SHA1043a8bc9aa9052c7468cd829332f09a87eabec02
SHA25635d13db7d7f1e976f8b464c06127ab00ae7547d76ac525568c3529c462fdce55
SHA512964c28a251f51ef7506c1289cc92275496dc7883253b0b06889292c60efa1cca50e2c698b02ef6e57bf554c90713a76f58cdadea95867f4203bcf161c6d23837
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0912836.exeFilesize
335KB
MD5e4cd3e9229b4eb608383a6ed841c3f18
SHA1b3f81ff90ceb7ad6a2ecd3165523da5b9d60ffd1
SHA256fe5598ca99a4c1e03179d1d71603dfd9561fc2ecf19c69131f088a476bc46ee9
SHA512a5a63feb718349661a1e398090fa323368f47182b8edcc292d6720368aeed024a5ee4a1bfb1273b7fb5eb20e189202a9ecb78128c28e35cf8df8a985a3bc2616
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0912836.exeFilesize
335KB
MD5e4cd3e9229b4eb608383a6ed841c3f18
SHA1b3f81ff90ceb7ad6a2ecd3165523da5b9d60ffd1
SHA256fe5598ca99a4c1e03179d1d71603dfd9561fc2ecf19c69131f088a476bc46ee9
SHA512a5a63feb718349661a1e398090fa323368f47182b8edcc292d6720368aeed024a5ee4a1bfb1273b7fb5eb20e189202a9ecb78128c28e35cf8df8a985a3bc2616
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2216565.exeFilesize
11KB
MD53ec76a3d19df8632a63ccc13f3336d11
SHA14e9eec55105c03a1547e244b57ffdc3faf58f9a3
SHA256a65c567b9e45a78f24d68e01d34605e5d35c0ce6ccc80b62b44d038fb0b55fe2
SHA512c5d6f2fdadbb2db3c864304f7b7d1d4dec3f7c2cd4c7b2d9aa665376ca88972ce98558104aece1eb72c3797befe67911e9f08c1e344bd584b871385507498b71
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2216565.exeFilesize
11KB
MD53ec76a3d19df8632a63ccc13f3336d11
SHA14e9eec55105c03a1547e244b57ffdc3faf58f9a3
SHA256a65c567b9e45a78f24d68e01d34605e5d35c0ce6ccc80b62b44d038fb0b55fe2
SHA512c5d6f2fdadbb2db3c864304f7b7d1d4dec3f7c2cd4c7b2d9aa665376ca88972ce98558104aece1eb72c3797befe67911e9f08c1e344bd584b871385507498b71
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0169756.exeFilesize
356KB
MD54b34bc973188a00276734c28e118d395
SHA19cb61a5f2d592fbdaf5decb6abc93b315ac3aab6
SHA2560cf3d6c685db2a91da9d50ff149dda565a5250a2e6f43add8cf59c8bd0759fc6
SHA512c55b70e0f8f5f2801e1f67e2c969550f7e5f31b59fa7baa9eeb9702de89a1784eae2b84b00c8b287fbafcd5bc2acdcfd805e4a71f44b357b373204d7dbf1195c
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0169756.exeFilesize
356KB
MD54b34bc973188a00276734c28e118d395
SHA19cb61a5f2d592fbdaf5decb6abc93b315ac3aab6
SHA2560cf3d6c685db2a91da9d50ff149dda565a5250a2e6f43add8cf59c8bd0759fc6
SHA512c55b70e0f8f5f2801e1f67e2c969550f7e5f31b59fa7baa9eeb9702de89a1784eae2b84b00c8b287fbafcd5bc2acdcfd805e4a71f44b357b373204d7dbf1195c
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1884-87-0x0000000073F70000-0x0000000074720000-memory.dmpFilesize
7.7MB
-
memory/1884-81-0x000000000A970000-0x000000000AF88000-memory.dmpFilesize
6.1MB
-
memory/1884-83-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/1884-85-0x000000000A450000-0x000000000A48C000-memory.dmpFilesize
240KB
-
memory/1884-86-0x000000000A5D0000-0x000000000A61C000-memory.dmpFilesize
304KB
-
memory/1884-58-0x00000000029E0000-0x00000000029E6000-memory.dmpFilesize
24KB
-
memory/1884-88-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/1884-52-0x0000000073F70000-0x0000000074720000-memory.dmpFilesize
7.7MB
-
memory/1884-82-0x000000000A4C0000-0x000000000A5CA000-memory.dmpFilesize
1.0MB
-
memory/1884-84-0x000000000A3F0000-0x000000000A402000-memory.dmpFilesize
72KB
-
memory/1884-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3704-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3704-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3704-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3704-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4864-39-0x00007FFC30080000-0x00007FFC30B41000-memory.dmpFilesize
10.8MB
-
memory/4864-37-0x00007FFC30080000-0x00007FFC30B41000-memory.dmpFilesize
10.8MB
-
memory/4864-36-0x00007FFC30080000-0x00007FFC30B41000-memory.dmpFilesize
10.8MB
-
memory/4864-35-0x0000000000110000-0x000000000011A000-memory.dmpFilesize
40KB