Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:31
Static task
static1
Behavioral task
behavioral1
Sample
edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe
Resource
win7-20230831-en
General
-
Target
edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe
-
Size
994KB
-
MD5
42b5ebf5bcac2307d9e90b83fc1a019f
-
SHA1
eb7ac43a037e8ebea94daa9a1f2b59726476c1b9
-
SHA256
edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7
-
SHA512
6b98a1bcf57799f506602f3b09e5b4c48892c5a5d2aef72044c0d4db6f0cc7b179fc80ef8e61ecc8b7508fad80e17fd6e93ed0ced1de63a03d20dcdb66c29ffa
-
SSDEEP
24576:myk7m4MOjcNqzo2RFIW6+1nUd2QoUtCCd5Q3N984g5s:1QY/qzfRFt6L2QBtCKu3N
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3624-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3624-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3624-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3624-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4413333.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4413333.exe healer behavioral2/memory/388-35-0x0000000000A50000-0x0000000000A5A000-memory.dmp healer -
Processes:
q4413333.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q4413333.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q4413333.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q4413333.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q4413333.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q4413333.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q4413333.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet2144737.exeu1312426.exeexplothe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation t2144737.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation u1312426.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation explothe.exe -
Executes dropped EXE 16 IoCs
Processes:
z7808387.exez3686064.exez0717122.exez5073572.exeq4413333.exer5192365.exes3232320.exet2144737.exeexplothe.exeu1312426.exelegota.exew5571741.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 4584 z7808387.exe 5024 z3686064.exe 2472 z0717122.exe 2220 z5073572.exe 388 q4413333.exe 4476 r5192365.exe 5104 s3232320.exe 4772 t2144737.exe 3376 explothe.exe 4752 u1312426.exe 1564 legota.exe 3420 w5571741.exe 320 explothe.exe 1988 legota.exe 1632 explothe.exe 4708 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1724 rundll32.exe 4880 rundll32.exe -
Processes:
q4413333.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q4413333.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exez7808387.exez3686064.exez0717122.exez5073572.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z7808387.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3686064.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z0717122.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z5073572.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r5192365.exes3232320.exedescription pid process target process PID 4476 set thread context of 3624 4476 r5192365.exe AppLaunch.exe PID 5104 set thread context of 4980 5104 s3232320.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3308 4476 WerFault.exe r5192365.exe 1364 3624 WerFault.exe AppLaunch.exe 404 5104 WerFault.exe s3232320.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4648 schtasks.exe 5016 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q4413333.exepid process 388 q4413333.exe 388 q4413333.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q4413333.exedescription pid process Token: SeDebugPrivilege 388 q4413333.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exez7808387.exez3686064.exez0717122.exez5073572.exer5192365.exes3232320.exet2144737.exeu1312426.exeexplothe.exelegota.exedescription pid process target process PID 2456 wrote to memory of 4584 2456 edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe z7808387.exe PID 2456 wrote to memory of 4584 2456 edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe z7808387.exe PID 2456 wrote to memory of 4584 2456 edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe z7808387.exe PID 4584 wrote to memory of 5024 4584 z7808387.exe z3686064.exe PID 4584 wrote to memory of 5024 4584 z7808387.exe z3686064.exe PID 4584 wrote to memory of 5024 4584 z7808387.exe z3686064.exe PID 5024 wrote to memory of 2472 5024 z3686064.exe z0717122.exe PID 5024 wrote to memory of 2472 5024 z3686064.exe z0717122.exe PID 5024 wrote to memory of 2472 5024 z3686064.exe z0717122.exe PID 2472 wrote to memory of 2220 2472 z0717122.exe z5073572.exe PID 2472 wrote to memory of 2220 2472 z0717122.exe z5073572.exe PID 2472 wrote to memory of 2220 2472 z0717122.exe z5073572.exe PID 2220 wrote to memory of 388 2220 z5073572.exe q4413333.exe PID 2220 wrote to memory of 388 2220 z5073572.exe q4413333.exe PID 2220 wrote to memory of 4476 2220 z5073572.exe r5192365.exe PID 2220 wrote to memory of 4476 2220 z5073572.exe r5192365.exe PID 2220 wrote to memory of 4476 2220 z5073572.exe r5192365.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 4476 wrote to memory of 3624 4476 r5192365.exe AppLaunch.exe PID 2472 wrote to memory of 5104 2472 z0717122.exe s3232320.exe PID 2472 wrote to memory of 5104 2472 z0717122.exe s3232320.exe PID 2472 wrote to memory of 5104 2472 z0717122.exe s3232320.exe PID 5104 wrote to memory of 4288 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4288 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4288 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4980 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4980 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4980 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4980 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4980 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4980 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4980 5104 s3232320.exe AppLaunch.exe PID 5104 wrote to memory of 4980 5104 s3232320.exe AppLaunch.exe PID 5024 wrote to memory of 4772 5024 z3686064.exe t2144737.exe PID 5024 wrote to memory of 4772 5024 z3686064.exe t2144737.exe PID 5024 wrote to memory of 4772 5024 z3686064.exe t2144737.exe PID 4772 wrote to memory of 3376 4772 t2144737.exe explothe.exe PID 4772 wrote to memory of 3376 4772 t2144737.exe explothe.exe PID 4772 wrote to memory of 3376 4772 t2144737.exe explothe.exe PID 4584 wrote to memory of 4752 4584 z7808387.exe u1312426.exe PID 4584 wrote to memory of 4752 4584 z7808387.exe u1312426.exe PID 4584 wrote to memory of 4752 4584 z7808387.exe u1312426.exe PID 4752 wrote to memory of 1564 4752 u1312426.exe legota.exe PID 4752 wrote to memory of 1564 4752 u1312426.exe legota.exe PID 4752 wrote to memory of 1564 4752 u1312426.exe legota.exe PID 3376 wrote to memory of 5016 3376 explothe.exe schtasks.exe PID 3376 wrote to memory of 5016 3376 explothe.exe schtasks.exe PID 3376 wrote to memory of 5016 3376 explothe.exe schtasks.exe PID 3376 wrote to memory of 1596 3376 explothe.exe cmd.exe PID 3376 wrote to memory of 1596 3376 explothe.exe cmd.exe PID 3376 wrote to memory of 1596 3376 explothe.exe cmd.exe PID 2456 wrote to memory of 3420 2456 edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe w5571741.exe PID 2456 wrote to memory of 3420 2456 edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe w5571741.exe PID 2456 wrote to memory of 3420 2456 edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe w5571741.exe PID 1564 wrote to memory of 4648 1564 legota.exe schtasks.exe PID 1564 wrote to memory of 4648 1564 legota.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe"C:\Users\Admin\AppData\Local\Temp\edd62990dba55d4397b2187d2803d3d82a18148421174b78cc45ba9fd5e79aa7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7808387.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7808387.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3686064.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3686064.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0717122.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0717122.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5073572.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5073572.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4413333.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4413333.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5192365.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5192365.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 2048⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3232320.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3232320.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 6046⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2144737.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2144737.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1312426.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1312426.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5571741.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5571741.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4476 -ip 44761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3624 -ip 36241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5104 -ip 51041⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5571741.exeFilesize
23KB
MD5d46983393b7bc6a0b2e3dae2dc0ed908
SHA1114f856c59ac11da31f9ed1ad63417bd21ab4ec2
SHA25682eb1df167edca09053336b4c69c7f894de6e5513685894a9bde7cc0165ca250
SHA5122ba6b8b314824e2a26d44c4fca8e39b767f95799a1f2a58794161ecc0070857d3f2415c24ae56c85b112c675fc9a6deeacf7a6161af4fd0ecf816d666ce7e6b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5571741.exeFilesize
23KB
MD5d46983393b7bc6a0b2e3dae2dc0ed908
SHA1114f856c59ac11da31f9ed1ad63417bd21ab4ec2
SHA25682eb1df167edca09053336b4c69c7f894de6e5513685894a9bde7cc0165ca250
SHA5122ba6b8b314824e2a26d44c4fca8e39b767f95799a1f2a58794161ecc0070857d3f2415c24ae56c85b112c675fc9a6deeacf7a6161af4fd0ecf816d666ce7e6b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7808387.exeFilesize
892KB
MD53cd6f29ccea9226f9871471a30d386fc
SHA165eb87ca491c031ccae4ceaaa617dbc0cab3c400
SHA25613779b08977ca5f68466c4c83dc6fb5aca69c79bbce274123dc2fd56f9cad122
SHA512cffff1c0ee30f117476cbceb8a304eae0d15b1fdcb64370e5e4f2211dae5a35e7e8e328c2983a62b5b0d3f191a13d92004542e792e5e551eaef7a52295225853
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7808387.exeFilesize
892KB
MD53cd6f29ccea9226f9871471a30d386fc
SHA165eb87ca491c031ccae4ceaaa617dbc0cab3c400
SHA25613779b08977ca5f68466c4c83dc6fb5aca69c79bbce274123dc2fd56f9cad122
SHA512cffff1c0ee30f117476cbceb8a304eae0d15b1fdcb64370e5e4f2211dae5a35e7e8e328c2983a62b5b0d3f191a13d92004542e792e5e551eaef7a52295225853
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1312426.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1312426.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3686064.exeFilesize
709KB
MD57a2fbbb58a58bf48b9830f24369ca0a3
SHA123693c05112448cd80dea31137864da8f59b10e4
SHA25621723995b043499710cff7c200821107d19319dfd30c1a93635bc8c7f0ba2562
SHA512a3d145567ef5c5dbfdf903dccfd5fc16e85a3f192cd9d8ce24987eaeaeffdfc87435691506f249892a049db788560eec8fbdde5f1dd4976fdecb5c4e2c991761
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3686064.exeFilesize
709KB
MD57a2fbbb58a58bf48b9830f24369ca0a3
SHA123693c05112448cd80dea31137864da8f59b10e4
SHA25621723995b043499710cff7c200821107d19319dfd30c1a93635bc8c7f0ba2562
SHA512a3d145567ef5c5dbfdf903dccfd5fc16e85a3f192cd9d8ce24987eaeaeffdfc87435691506f249892a049db788560eec8fbdde5f1dd4976fdecb5c4e2c991761
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2144737.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2144737.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0717122.exeFilesize
527KB
MD5e8fdc580e8e3c614352cc31b5f940c9f
SHA1f9978c12b622453ef95a6e41079a3a7d24e51fc6
SHA2566884fe47a145dde3657e946358c4d3a6d8ea97fd394b5e99c71e4d1960a5b2e8
SHA512449c8ae9dcfdb9858826c80af8037c572468940d0465024eb552509e9442eb516a4c09a519863aa56efab6503a51dbbf5607b6e817d6c052c56c668625b88b2b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0717122.exeFilesize
527KB
MD5e8fdc580e8e3c614352cc31b5f940c9f
SHA1f9978c12b622453ef95a6e41079a3a7d24e51fc6
SHA2566884fe47a145dde3657e946358c4d3a6d8ea97fd394b5e99c71e4d1960a5b2e8
SHA512449c8ae9dcfdb9858826c80af8037c572468940d0465024eb552509e9442eb516a4c09a519863aa56efab6503a51dbbf5607b6e817d6c052c56c668625b88b2b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3232320.exeFilesize
310KB
MD5eedb66955b3edfb9be85984dae711fbf
SHA1463f457f374ac06bb7a35c9c38e3bf9e853123b5
SHA256f6e13e6d0b2cd2611bc8ed6f23fb9a461aa4b26f0b180a42beee137a57cbfd4f
SHA512a5c4a59cecd7f6fd63be2baa21c370d4169b2a43e95ef31b456f3909d60724136cf72a2699938245f317e2b327f26fe1d03f6445a9057d471a66ce43d87d83e0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3232320.exeFilesize
310KB
MD5eedb66955b3edfb9be85984dae711fbf
SHA1463f457f374ac06bb7a35c9c38e3bf9e853123b5
SHA256f6e13e6d0b2cd2611bc8ed6f23fb9a461aa4b26f0b180a42beee137a57cbfd4f
SHA512a5c4a59cecd7f6fd63be2baa21c370d4169b2a43e95ef31b456f3909d60724136cf72a2699938245f317e2b327f26fe1d03f6445a9057d471a66ce43d87d83e0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5073572.exeFilesize
295KB
MD5bb6de2e944fad3b31b6f0f40e88aa0a2
SHA1b71005b4454aa9f94166bf2d102429935660d156
SHA256eb541f540fd1b276af892a05bf4fbe745daf6e910188ee2c8277632996b7db63
SHA512c54d151551c97a146eff1ad0f25f3a782919880a7faf18037ac538e86f0d87f97f598f4b67f4a20ea9ceb7975fdf52ab278dd87dcf813645f9c8c3e08a72b201
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5073572.exeFilesize
295KB
MD5bb6de2e944fad3b31b6f0f40e88aa0a2
SHA1b71005b4454aa9f94166bf2d102429935660d156
SHA256eb541f540fd1b276af892a05bf4fbe745daf6e910188ee2c8277632996b7db63
SHA512c54d151551c97a146eff1ad0f25f3a782919880a7faf18037ac538e86f0d87f97f598f4b67f4a20ea9ceb7975fdf52ab278dd87dcf813645f9c8c3e08a72b201
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4413333.exeFilesize
11KB
MD56aa5e2fb425fb5ab3897afb250651a85
SHA1e20a242e8afddaebc355efa71ab0b0162bd88721
SHA25609cad1cef24fa0f78dbf75286070679ca58c3b6eb68869a8168b812f09a68cf7
SHA5122207fe388703f4f0a9c3dcd86bbd2b15cd05ed0cfc6f7523417002bcf8fd60b095600dbd72f4071d7efb721e2d12dff6439b33ee595937922f73f25fb289ea72
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4413333.exeFilesize
11KB
MD56aa5e2fb425fb5ab3897afb250651a85
SHA1e20a242e8afddaebc355efa71ab0b0162bd88721
SHA25609cad1cef24fa0f78dbf75286070679ca58c3b6eb68869a8168b812f09a68cf7
SHA5122207fe388703f4f0a9c3dcd86bbd2b15cd05ed0cfc6f7523417002bcf8fd60b095600dbd72f4071d7efb721e2d12dff6439b33ee595937922f73f25fb289ea72
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5192365.exeFilesize
276KB
MD5448c83c952cb53f179654da0bd561734
SHA1c2107e48be00a4485edd9df9056aa8a53533d562
SHA25640e86c3d543d270d08d75edd46e6cf1c78ed03ef3ece91bb08b441284b41bde9
SHA5127b230871d8e9683d40cad8490b8a4b554b6e85e25217d26e5f33d75f597954168d9c90b80dcafb824c9ce6569c28aada28eb429fe969ffa022b40b72d66ed99c
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5192365.exeFilesize
276KB
MD5448c83c952cb53f179654da0bd561734
SHA1c2107e48be00a4485edd9df9056aa8a53533d562
SHA25640e86c3d543d270d08d75edd46e6cf1c78ed03ef3ece91bb08b441284b41bde9
SHA5127b230871d8e9683d40cad8490b8a4b554b6e85e25217d26e5f33d75f597954168d9c90b80dcafb824c9ce6569c28aada28eb429fe969ffa022b40b72d66ed99c
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/388-39-0x00007FFAB9C30000-0x00007FFABA6F1000-memory.dmpFilesize
10.8MB
-
memory/388-36-0x00007FFAB9C30000-0x00007FFABA6F1000-memory.dmpFilesize
10.8MB
-
memory/388-35-0x0000000000A50000-0x0000000000A5A000-memory.dmpFilesize
40KB
-
memory/388-37-0x00007FFAB9C30000-0x00007FFABA6F1000-memory.dmpFilesize
10.8MB
-
memory/3624-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3624-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3624-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3624-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4980-90-0x0000000005540000-0x0000000005550000-memory.dmpFilesize
64KB
-
memory/4980-77-0x0000000005550000-0x0000000005562000-memory.dmpFilesize
72KB
-
memory/4980-72-0x0000000005660000-0x000000000576A000-memory.dmpFilesize
1.0MB
-
memory/4980-80-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/4980-71-0x0000000005B70000-0x0000000006188000-memory.dmpFilesize
6.1MB
-
memory/4980-52-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/4980-86-0x0000000005600000-0x000000000564C000-memory.dmpFilesize
304KB
-
memory/4980-82-0x00000000055B0000-0x00000000055EC000-memory.dmpFilesize
240KB
-
memory/4980-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4980-53-0x00000000054F0000-0x00000000054F6000-memory.dmpFilesize
24KB
-
memory/4980-83-0x0000000005540000-0x0000000005550000-memory.dmpFilesize
64KB