Analysis
-
max time kernel
154s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 20:48
Static task
static1
Behavioral task
behavioral1
Sample
e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe
-
Size
1.0MB
-
MD5
a7fca5e75d2675826518bccb69750b5d
-
SHA1
b9b9740c4df08e2a2132541d461950e1503bcc8b
-
SHA256
e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc
-
SHA512
b985c637823c0be07beed5f7137109447b8ca3b604978df650d0c23aaf1d28666f63c9f8367ac9ebefaa1989692a85137346759247bcfb883a7fa7c6dfc10d38
-
SSDEEP
24576:Tyk8gI1yw3QduoVyXKhExnfWYbtdYqzapSE7xBodsg0:mk8gCp3Q00yXKhkfWiapjuK
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4281007.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4281007.exe healer behavioral2/memory/4588-35-0x0000000000110000-0x000000000011A000-memory.dmp healer -
Processes:
q4281007.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q4281007.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q4281007.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q4281007.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q4281007.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q4281007.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q4281007.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t9854835.exeexplothe.exeu6688820.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation t9854835.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation u6688820.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z8629660.exez3372627.exez2173755.exez5076007.exeq4281007.exer4441896.exes8726677.exet9854835.exeexplothe.exeu6688820.exelegota.exew8754418.exelegota.exeexplothe.exelegota.exeexplothe.exepid process 5084 z8629660.exe 4444 z3372627.exe 3844 z2173755.exe 4672 z5076007.exe 4588 q4281007.exe 3688 r4441896.exe 2996 s8726677.exe 2804 t9854835.exe 556 explothe.exe 3420 u6688820.exe 3204 legota.exe 4540 w8754418.exe 972 legota.exe 1128 explothe.exe 2184 legota.exe 5068 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4556 rundll32.exe 1380 rundll32.exe -
Processes:
q4281007.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q4281007.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z2173755.exez5076007.exee285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exez8629660.exez3372627.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z2173755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z5076007.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z8629660.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3372627.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r4441896.exes8726677.exedescription pid process target process PID 3688 set thread context of 4072 3688 r4441896.exe AppLaunch.exe PID 2996 set thread context of 2292 2996 s8726677.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3600 4072 WerFault.exe AppLaunch.exe 4104 3688 WerFault.exe r4441896.exe 1760 2996 WerFault.exe s8726677.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2332 schtasks.exe 4776 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q4281007.exepid process 4588 q4281007.exe 4588 q4281007.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q4281007.exedescription pid process Token: SeDebugPrivilege 4588 q4281007.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exez8629660.exez3372627.exez2173755.exez5076007.exer4441896.exes8726677.exet9854835.exeexplothe.exeu6688820.exelegota.execmd.exedescription pid process target process PID 3972 wrote to memory of 5084 3972 e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe z8629660.exe PID 3972 wrote to memory of 5084 3972 e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe z8629660.exe PID 3972 wrote to memory of 5084 3972 e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe z8629660.exe PID 5084 wrote to memory of 4444 5084 z8629660.exe z3372627.exe PID 5084 wrote to memory of 4444 5084 z8629660.exe z3372627.exe PID 5084 wrote to memory of 4444 5084 z8629660.exe z3372627.exe PID 4444 wrote to memory of 3844 4444 z3372627.exe z2173755.exe PID 4444 wrote to memory of 3844 4444 z3372627.exe z2173755.exe PID 4444 wrote to memory of 3844 4444 z3372627.exe z2173755.exe PID 3844 wrote to memory of 4672 3844 z2173755.exe z5076007.exe PID 3844 wrote to memory of 4672 3844 z2173755.exe z5076007.exe PID 3844 wrote to memory of 4672 3844 z2173755.exe z5076007.exe PID 4672 wrote to memory of 4588 4672 z5076007.exe q4281007.exe PID 4672 wrote to memory of 4588 4672 z5076007.exe q4281007.exe PID 4672 wrote to memory of 3688 4672 z5076007.exe r4441896.exe PID 4672 wrote to memory of 3688 4672 z5076007.exe r4441896.exe PID 4672 wrote to memory of 3688 4672 z5076007.exe r4441896.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3688 wrote to memory of 4072 3688 r4441896.exe AppLaunch.exe PID 3844 wrote to memory of 2996 3844 z2173755.exe s8726677.exe PID 3844 wrote to memory of 2996 3844 z2173755.exe s8726677.exe PID 3844 wrote to memory of 2996 3844 z2173755.exe s8726677.exe PID 2996 wrote to memory of 2292 2996 s8726677.exe AppLaunch.exe PID 2996 wrote to memory of 2292 2996 s8726677.exe AppLaunch.exe PID 2996 wrote to memory of 2292 2996 s8726677.exe AppLaunch.exe PID 2996 wrote to memory of 2292 2996 s8726677.exe AppLaunch.exe PID 2996 wrote to memory of 2292 2996 s8726677.exe AppLaunch.exe PID 2996 wrote to memory of 2292 2996 s8726677.exe AppLaunch.exe PID 2996 wrote to memory of 2292 2996 s8726677.exe AppLaunch.exe PID 2996 wrote to memory of 2292 2996 s8726677.exe AppLaunch.exe PID 4444 wrote to memory of 2804 4444 z3372627.exe t9854835.exe PID 4444 wrote to memory of 2804 4444 z3372627.exe t9854835.exe PID 4444 wrote to memory of 2804 4444 z3372627.exe t9854835.exe PID 2804 wrote to memory of 556 2804 t9854835.exe explothe.exe PID 2804 wrote to memory of 556 2804 t9854835.exe explothe.exe PID 2804 wrote to memory of 556 2804 t9854835.exe explothe.exe PID 5084 wrote to memory of 3420 5084 z8629660.exe u6688820.exe PID 5084 wrote to memory of 3420 5084 z8629660.exe u6688820.exe PID 5084 wrote to memory of 3420 5084 z8629660.exe u6688820.exe PID 556 wrote to memory of 2332 556 explothe.exe schtasks.exe PID 556 wrote to memory of 2332 556 explothe.exe schtasks.exe PID 556 wrote to memory of 2332 556 explothe.exe schtasks.exe PID 556 wrote to memory of 3084 556 explothe.exe cmd.exe PID 556 wrote to memory of 3084 556 explothe.exe cmd.exe PID 556 wrote to memory of 3084 556 explothe.exe cmd.exe PID 3420 wrote to memory of 3204 3420 u6688820.exe legota.exe PID 3420 wrote to memory of 3204 3420 u6688820.exe legota.exe PID 3420 wrote to memory of 3204 3420 u6688820.exe legota.exe PID 3972 wrote to memory of 4540 3972 e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe w8754418.exe PID 3972 wrote to memory of 4540 3972 e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe w8754418.exe PID 3972 wrote to memory of 4540 3972 e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe w8754418.exe PID 3204 wrote to memory of 4776 3204 legota.exe schtasks.exe PID 3204 wrote to memory of 4776 3204 legota.exe schtasks.exe PID 3204 wrote to memory of 4776 3204 legota.exe schtasks.exe PID 3084 wrote to memory of 1124 3084 cmd.exe cmd.exe PID 3084 wrote to memory of 1124 3084 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe"C:\Users\Admin\AppData\Local\Temp\e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8629660.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8629660.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3372627.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3372627.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2173755.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2173755.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5076007.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5076007.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4281007.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4281007.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4441896.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4441896.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 5408⤵
- Program crash
PID:3600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1527⤵
- Program crash
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8726677.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8726677.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 1406⤵
- Program crash
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9854835.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9854835.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:2332 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1124
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:5028
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:4332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1604
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:684
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:220
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6688820.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6688820.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:4776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:3708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:208
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:3792
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:5096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3896
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:4296
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:4532
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8754418.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8754418.exe2⤵
- Executes dropped EXE
PID:4540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3688 -ip 36881⤵PID:1632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4072 -ip 40721⤵PID:4996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2996 -ip 29961⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:972
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:1128
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:2184
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:5068
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8754418.exeFilesize
23KB
MD51423be19b2a745fc4eaaa7cf471fd70f
SHA1796758f1f6272912c7656d37ff9f7e66db45f99b
SHA256ff79bb1213abe129a064e2dbcda9df9598d2fa37fa421aa156a71f89962240bc
SHA5126efcf7f3557cc4f4e76cfeb854a36817c8db4e16cd344b608d6182f7cdf6f372ef89f529fd164b791cb0aa783160e3fe86036c1f1d452ff3e16bb95a812a797f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8754418.exeFilesize
23KB
MD51423be19b2a745fc4eaaa7cf471fd70f
SHA1796758f1f6272912c7656d37ff9f7e66db45f99b
SHA256ff79bb1213abe129a064e2dbcda9df9598d2fa37fa421aa156a71f89962240bc
SHA5126efcf7f3557cc4f4e76cfeb854a36817c8db4e16cd344b608d6182f7cdf6f372ef89f529fd164b791cb0aa783160e3fe86036c1f1d452ff3e16bb95a812a797f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8629660.exeFilesize
971KB
MD5e5214d92db7bc4d7f733f86d0660da36
SHA1201ea81c39d769424748e418780cd404c6e4fc4d
SHA256b912b510b764e40a01a5e50f78eff648b17725f5b89b688fc851097051fc23d5
SHA512bdb057e3d9f86a741afae872d39ed18dfc8fbef99e5b3bee127289a86986f4fb746589eca8474ef31ba320cd8b2f1d9d8eb8df8f18e0fda473a1d6986667d466
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8629660.exeFilesize
971KB
MD5e5214d92db7bc4d7f733f86d0660da36
SHA1201ea81c39d769424748e418780cd404c6e4fc4d
SHA256b912b510b764e40a01a5e50f78eff648b17725f5b89b688fc851097051fc23d5
SHA512bdb057e3d9f86a741afae872d39ed18dfc8fbef99e5b3bee127289a86986f4fb746589eca8474ef31ba320cd8b2f1d9d8eb8df8f18e0fda473a1d6986667d466
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6688820.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6688820.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3372627.exeFilesize
789KB
MD56bb8dd5cccdbdc836801d5c37512255c
SHA1b750be5b4d3e7b94847826d66f0e1405dbedcd66
SHA256ed82dc5a71427d8c94fbcd99c32515be6a1543d038d9de057993676f4bde7c37
SHA51276a78afc67ecf7613b85ad803d156b30e4f2e3e7588fbaa640fb9d8824225299fd0fa445975cdcaf1c32f517f06e5afe30d3b86d925a5c368b79614fb8a4a427
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3372627.exeFilesize
789KB
MD56bb8dd5cccdbdc836801d5c37512255c
SHA1b750be5b4d3e7b94847826d66f0e1405dbedcd66
SHA256ed82dc5a71427d8c94fbcd99c32515be6a1543d038d9de057993676f4bde7c37
SHA51276a78afc67ecf7613b85ad803d156b30e4f2e3e7588fbaa640fb9d8824225299fd0fa445975cdcaf1c32f517f06e5afe30d3b86d925a5c368b79614fb8a4a427
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9854835.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9854835.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2173755.exeFilesize
606KB
MD52157d5872aa87a1f5dde1ecbe8a8433c
SHA15d636700e9431e76523a955fd88b8f95d819e0a4
SHA256aed2c86821cd7b7dfda854aecc436c2b8297e780858ccf08f5cc8ebec2da5d40
SHA512a0c05108f39ac32656d9d5b840891030c14e9d8b178c9391eb785c7adb1a8a16ea32abbaca5d0ef5283bd33221e1f8e1ee2e60a15397d8bb730712dbe10720a4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2173755.exeFilesize
606KB
MD52157d5872aa87a1f5dde1ecbe8a8433c
SHA15d636700e9431e76523a955fd88b8f95d819e0a4
SHA256aed2c86821cd7b7dfda854aecc436c2b8297e780858ccf08f5cc8ebec2da5d40
SHA512a0c05108f39ac32656d9d5b840891030c14e9d8b178c9391eb785c7adb1a8a16ea32abbaca5d0ef5283bd33221e1f8e1ee2e60a15397d8bb730712dbe10720a4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8726677.exeFilesize
390KB
MD527246f4fbc179ef7450cd1f756fb2aa1
SHA13b583d3213d56c765464e39bcb9cae55339c8972
SHA2566c1cbfd282d3aa9fc6f71697185de81924b65832604925cd2756abbc7063048c
SHA512c46ca72c66e21ff41942195feac59e2f0497ecae80544b9da2d67aa7179ab52519f0cc62f6926c82773be7f1780b0408fe7904f20834c57f406a430a67739830
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8726677.exeFilesize
390KB
MD527246f4fbc179ef7450cd1f756fb2aa1
SHA13b583d3213d56c765464e39bcb9cae55339c8972
SHA2566c1cbfd282d3aa9fc6f71697185de81924b65832604925cd2756abbc7063048c
SHA512c46ca72c66e21ff41942195feac59e2f0497ecae80544b9da2d67aa7179ab52519f0cc62f6926c82773be7f1780b0408fe7904f20834c57f406a430a67739830
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5076007.exeFilesize
335KB
MD5dd265308b29714829c38dc6caa6afca3
SHA1fd2668a9c2ef918f294002e06e66260b3aa98eda
SHA25650a08a9e53f9e09d92705ac225711061c9326701c829c97a6567d143127c9e55
SHA512440595c81829368050872779cfa8636c1c92bf1efb55e8f999565e956ae302d4e2bd4cf1d6814a922a180c0df22a9a67589ac13432f71876b735242290aef1df
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5076007.exeFilesize
335KB
MD5dd265308b29714829c38dc6caa6afca3
SHA1fd2668a9c2ef918f294002e06e66260b3aa98eda
SHA25650a08a9e53f9e09d92705ac225711061c9326701c829c97a6567d143127c9e55
SHA512440595c81829368050872779cfa8636c1c92bf1efb55e8f999565e956ae302d4e2bd4cf1d6814a922a180c0df22a9a67589ac13432f71876b735242290aef1df
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4281007.exeFilesize
11KB
MD511a8335b9a735da66bfdc28e0b864cb3
SHA1689d6617916bd4581abde04bc79932efa3613d86
SHA256d7d8bddc6c6e500d5a6562d7ea5d79849939251bcb26f1adc47475c62dbbf86a
SHA5127983a27d1204aebb8800a7002a42a4137d4944977b40608710a564889fb5fd6b0acffe91ac7096e5beb75dc910d129d6a5377e3ec52231980c2e55acbcaa4e15
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4281007.exeFilesize
11KB
MD511a8335b9a735da66bfdc28e0b864cb3
SHA1689d6617916bd4581abde04bc79932efa3613d86
SHA256d7d8bddc6c6e500d5a6562d7ea5d79849939251bcb26f1adc47475c62dbbf86a
SHA5127983a27d1204aebb8800a7002a42a4137d4944977b40608710a564889fb5fd6b0acffe91ac7096e5beb75dc910d129d6a5377e3ec52231980c2e55acbcaa4e15
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4441896.exeFilesize
356KB
MD51c55205c36780db04414e701fd361270
SHA1123bb09764b192904bb93f3450fd44e56ea59331
SHA25648b35c0e57c384fe280ec5e078a49402bb20744b4cd18db4f4fca98964222776
SHA51214ec0c4e28e2a147a54dfc2480dc0675aa0902a9c91167ef683fd5323eb9c4700ad4af5d058ef7c8844afdcae64d8b50c507492aceb6be2f8cd581400751c4ae
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4441896.exeFilesize
356KB
MD51c55205c36780db04414e701fd361270
SHA1123bb09764b192904bb93f3450fd44e56ea59331
SHA25648b35c0e57c384fe280ec5e078a49402bb20744b4cd18db4f4fca98964222776
SHA51214ec0c4e28e2a147a54dfc2480dc0675aa0902a9c91167ef683fd5323eb9c4700ad4af5d058ef7c8844afdcae64d8b50c507492aceb6be2f8cd581400751c4ae
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2292-76-0x00000000053F0000-0x0000000005400000-memory.dmpFilesize
64KB
-
memory/2292-71-0x0000000005B20000-0x0000000006138000-memory.dmpFilesize
6.1MB
-
memory/2292-84-0x0000000005500000-0x000000000553C000-memory.dmpFilesize
240KB
-
memory/2292-52-0x0000000073A80000-0x0000000074230000-memory.dmpFilesize
7.7MB
-
memory/2292-86-0x0000000005540000-0x000000000558C000-memory.dmpFilesize
304KB
-
memory/2292-87-0x0000000073A80000-0x0000000074230000-memory.dmpFilesize
7.7MB
-
memory/2292-88-0x00000000053F0000-0x0000000005400000-memory.dmpFilesize
64KB
-
memory/2292-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2292-74-0x0000000005360000-0x0000000005372000-memory.dmpFilesize
72KB
-
memory/2292-72-0x0000000005610000-0x000000000571A000-memory.dmpFilesize
1.0MB
-
memory/2292-53-0x0000000002DE0000-0x0000000002DE6000-memory.dmpFilesize
24KB
-
memory/4072-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4072-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4072-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4072-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4588-37-0x00007FFF56F00000-0x00007FFF579C1000-memory.dmpFilesize
10.8MB
-
memory/4588-39-0x00007FFF56F00000-0x00007FFF579C1000-memory.dmpFilesize
10.8MB
-
memory/4588-36-0x00007FFF56F00000-0x00007FFF579C1000-memory.dmpFilesize
10.8MB
-
memory/4588-35-0x0000000000110000-0x000000000011A000-memory.dmpFilesize
40KB