Analysis Overview
SHA256
6914377ccb1e95eb5708d111909e5e3616f465303e246f5590a6d9d4b891089f
Threat Level: Known bad
The file 6914377ccb1e95eb5708d111909e5e3616f465303e246f5590a6d9d4b891089f_JC.exe was found to be: Known bad.
Malicious Activity Summary
Modifies Windows Defender Real-time Protection settings
Detect Mystic stealer payload
Mystic
RedLine
Amadey
Healer
Detects Healer an antivirus disabler dropper
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Program crash
Unsigned PE
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 21:35
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 21:35
Reported
2023-10-10 23:06
Platform
win7-20230831-en
Max time kernel
122s
Max time network
137s
Command Line
Signatures
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe | N/A |
Loads dropped DLL
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\6914377ccb1e95eb5708d111909e5e3616f465303e246f5590a6d9d4b891089f_JC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1640 set thread context of 2516 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6914377ccb1e95eb5708d111909e5e3616f465303e246f5590a6d9d4b891089f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6914377ccb1e95eb5708d111909e5e3616f465303e246f5590a6d9d4b891089f_JC.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 276
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
| MD5 | 710e909b7b07c7caa451923b2c25507c |
| SHA1 | 03789411b9c5ec114cd181b06e032de08c3ccca9 |
| SHA256 | 80f6397fe46488b9dbc246c68faefb9808b42b73ab631606157a120dd422f9ce |
| SHA512 | eb3b7954038b5458a08289523d99acd65df056d5569a5a6ee41a924e84166f182b217dc4e1e569fea93bc9f03ca30bd25ab1481da23961a3cd92ea0d29ba2e88 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
| MD5 | 710e909b7b07c7caa451923b2c25507c |
| SHA1 | 03789411b9c5ec114cd181b06e032de08c3ccca9 |
| SHA256 | 80f6397fe46488b9dbc246c68faefb9808b42b73ab631606157a120dd422f9ce |
| SHA512 | eb3b7954038b5458a08289523d99acd65df056d5569a5a6ee41a924e84166f182b217dc4e1e569fea93bc9f03ca30bd25ab1481da23961a3cd92ea0d29ba2e88 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
| MD5 | 710e909b7b07c7caa451923b2c25507c |
| SHA1 | 03789411b9c5ec114cd181b06e032de08c3ccca9 |
| SHA256 | 80f6397fe46488b9dbc246c68faefb9808b42b73ab631606157a120dd422f9ce |
| SHA512 | eb3b7954038b5458a08289523d99acd65df056d5569a5a6ee41a924e84166f182b217dc4e1e569fea93bc9f03ca30bd25ab1481da23961a3cd92ea0d29ba2e88 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
| MD5 | 710e909b7b07c7caa451923b2c25507c |
| SHA1 | 03789411b9c5ec114cd181b06e032de08c3ccca9 |
| SHA256 | 80f6397fe46488b9dbc246c68faefb9808b42b73ab631606157a120dd422f9ce |
| SHA512 | eb3b7954038b5458a08289523d99acd65df056d5569a5a6ee41a924e84166f182b217dc4e1e569fea93bc9f03ca30bd25ab1481da23961a3cd92ea0d29ba2e88 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
| MD5 | 077da35c7316c4e5aaafd46315867b55 |
| SHA1 | 33341e9ae4637a563a59c3e7d90e6b731b69ab65 |
| SHA256 | 8bbd4b8eb57f342fdf0b4833b128341c15f7f9a6317b602d014fa566b57ae662 |
| SHA512 | d4b5ba7eec7b7d523ec4710bd57af0b5548c57de40dac2319920765d1da3114141a7301a9aa2728d5f5551358990149ac608f49b1c75288291542b625c224c3f |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
| MD5 | 077da35c7316c4e5aaafd46315867b55 |
| SHA1 | 33341e9ae4637a563a59c3e7d90e6b731b69ab65 |
| SHA256 | 8bbd4b8eb57f342fdf0b4833b128341c15f7f9a6317b602d014fa566b57ae662 |
| SHA512 | d4b5ba7eec7b7d523ec4710bd57af0b5548c57de40dac2319920765d1da3114141a7301a9aa2728d5f5551358990149ac608f49b1c75288291542b625c224c3f |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
| MD5 | 077da35c7316c4e5aaafd46315867b55 |
| SHA1 | 33341e9ae4637a563a59c3e7d90e6b731b69ab65 |
| SHA256 | 8bbd4b8eb57f342fdf0b4833b128341c15f7f9a6317b602d014fa566b57ae662 |
| SHA512 | d4b5ba7eec7b7d523ec4710bd57af0b5548c57de40dac2319920765d1da3114141a7301a9aa2728d5f5551358990149ac608f49b1c75288291542b625c224c3f |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
| MD5 | 077da35c7316c4e5aaafd46315867b55 |
| SHA1 | 33341e9ae4637a563a59c3e7d90e6b731b69ab65 |
| SHA256 | 8bbd4b8eb57f342fdf0b4833b128341c15f7f9a6317b602d014fa566b57ae662 |
| SHA512 | d4b5ba7eec7b7d523ec4710bd57af0b5548c57de40dac2319920765d1da3114141a7301a9aa2728d5f5551358990149ac608f49b1c75288291542b625c224c3f |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
| MD5 | a1c4730a5209966893c94d97a912b132 |
| SHA1 | ed8e8140c639e03267e030dd4015d73a61ef3bfb |
| SHA256 | 4f9a84113b5fd96df2f2dd3bf05d867eb723d523df5afdf8491dd917f218048d |
| SHA512 | de444c3443dcbbfed0088d7c28348b3289d8d0f48dda4ec9396dde28a0c7a534b9d2bf7267c869f233f7889408d42ae4b059aa76c51359eb59158320f281cde0 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
| MD5 | a1c4730a5209966893c94d97a912b132 |
| SHA1 | ed8e8140c639e03267e030dd4015d73a61ef3bfb |
| SHA256 | 4f9a84113b5fd96df2f2dd3bf05d867eb723d523df5afdf8491dd917f218048d |
| SHA512 | de444c3443dcbbfed0088d7c28348b3289d8d0f48dda4ec9396dde28a0c7a534b9d2bf7267c869f233f7889408d42ae4b059aa76c51359eb59158320f281cde0 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
| MD5 | a1c4730a5209966893c94d97a912b132 |
| SHA1 | ed8e8140c639e03267e030dd4015d73a61ef3bfb |
| SHA256 | 4f9a84113b5fd96df2f2dd3bf05d867eb723d523df5afdf8491dd917f218048d |
| SHA512 | de444c3443dcbbfed0088d7c28348b3289d8d0f48dda4ec9396dde28a0c7a534b9d2bf7267c869f233f7889408d42ae4b059aa76c51359eb59158320f281cde0 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
| MD5 | a1c4730a5209966893c94d97a912b132 |
| SHA1 | ed8e8140c639e03267e030dd4015d73a61ef3bfb |
| SHA256 | 4f9a84113b5fd96df2f2dd3bf05d867eb723d523df5afdf8491dd917f218048d |
| SHA512 | de444c3443dcbbfed0088d7c28348b3289d8d0f48dda4ec9396dde28a0c7a534b9d2bf7267c869f233f7889408d42ae4b059aa76c51359eb59158320f281cde0 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
| MD5 | c51b15a6ed00a14c8066fd3d0ad1e6ef |
| SHA1 | 23ed8eefad00a17de33deb78a9543fd0f3283100 |
| SHA256 | ad2867c7a8ff10ae6b2f64ddb60109e81fb968518a54feb9b32c77cd8089a769 |
| SHA512 | 850cdce8df635c6a5aca1682285671ca78af9aedbfa666b2eaa939128c90be5376263ee6b2a1aaa7cacaeb1ab62606f71de0e129c3f20b4f3b10f19a2a0f3f5f |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
| MD5 | c51b15a6ed00a14c8066fd3d0ad1e6ef |
| SHA1 | 23ed8eefad00a17de33deb78a9543fd0f3283100 |
| SHA256 | ad2867c7a8ff10ae6b2f64ddb60109e81fb968518a54feb9b32c77cd8089a769 |
| SHA512 | 850cdce8df635c6a5aca1682285671ca78af9aedbfa666b2eaa939128c90be5376263ee6b2a1aaa7cacaeb1ab62606f71de0e129c3f20b4f3b10f19a2a0f3f5f |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
| MD5 | c51b15a6ed00a14c8066fd3d0ad1e6ef |
| SHA1 | 23ed8eefad00a17de33deb78a9543fd0f3283100 |
| SHA256 | ad2867c7a8ff10ae6b2f64ddb60109e81fb968518a54feb9b32c77cd8089a769 |
| SHA512 | 850cdce8df635c6a5aca1682285671ca78af9aedbfa666b2eaa939128c90be5376263ee6b2a1aaa7cacaeb1ab62606f71de0e129c3f20b4f3b10f19a2a0f3f5f |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
| MD5 | c51b15a6ed00a14c8066fd3d0ad1e6ef |
| SHA1 | 23ed8eefad00a17de33deb78a9543fd0f3283100 |
| SHA256 | ad2867c7a8ff10ae6b2f64ddb60109e81fb968518a54feb9b32c77cd8089a769 |
| SHA512 | 850cdce8df635c6a5aca1682285671ca78af9aedbfa666b2eaa939128c90be5376263ee6b2a1aaa7cacaeb1ab62606f71de0e129c3f20b4f3b10f19a2a0f3f5f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
memory/2516-53-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2516-54-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2516-55-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2516-56-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2516-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2516-58-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2516-60-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2516-62-0x0000000000400000-0x000000000040A000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 21:35
Reported
2023-10-10 23:05
Platform
win10v2004-20230915-en
Max time kernel
147s
Max time network
159s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8641600.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3203303.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\6914377ccb1e95eb5708d111909e5e3616f465303e246f5590a6d9d4b891089f_JC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4884 set thread context of 3956 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 2916 set thread context of 4208 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2737874.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4236 set thread context of 1340 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3746040.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6914377ccb1e95eb5708d111909e5e3616f465303e246f5590a6d9d4b891089f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6914377ccb1e95eb5708d111909e5e3616f465303e246f5590a6d9d4b891089f_JC.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4884 -ip 4884
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 596
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2737874.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2737874.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2916 -ip 2916
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4208 -ip 4208
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 140
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3746040.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3746040.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4236 -ip 4236
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3203303.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3203303.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8641600.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8641600.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6127731.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6127731.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.121.18.2.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
| MD5 | 710e909b7b07c7caa451923b2c25507c |
| SHA1 | 03789411b9c5ec114cd181b06e032de08c3ccca9 |
| SHA256 | 80f6397fe46488b9dbc246c68faefb9808b42b73ab631606157a120dd422f9ce |
| SHA512 | eb3b7954038b5458a08289523d99acd65df056d5569a5a6ee41a924e84166f182b217dc4e1e569fea93bc9f03ca30bd25ab1481da23961a3cd92ea0d29ba2e88 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1961647.exe
| MD5 | 710e909b7b07c7caa451923b2c25507c |
| SHA1 | 03789411b9c5ec114cd181b06e032de08c3ccca9 |
| SHA256 | 80f6397fe46488b9dbc246c68faefb9808b42b73ab631606157a120dd422f9ce |
| SHA512 | eb3b7954038b5458a08289523d99acd65df056d5569a5a6ee41a924e84166f182b217dc4e1e569fea93bc9f03ca30bd25ab1481da23961a3cd92ea0d29ba2e88 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
| MD5 | 077da35c7316c4e5aaafd46315867b55 |
| SHA1 | 33341e9ae4637a563a59c3e7d90e6b731b69ab65 |
| SHA256 | 8bbd4b8eb57f342fdf0b4833b128341c15f7f9a6317b602d014fa566b57ae662 |
| SHA512 | d4b5ba7eec7b7d523ec4710bd57af0b5548c57de40dac2319920765d1da3114141a7301a9aa2728d5f5551358990149ac608f49b1c75288291542b625c224c3f |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5175974.exe
| MD5 | 077da35c7316c4e5aaafd46315867b55 |
| SHA1 | 33341e9ae4637a563a59c3e7d90e6b731b69ab65 |
| SHA256 | 8bbd4b8eb57f342fdf0b4833b128341c15f7f9a6317b602d014fa566b57ae662 |
| SHA512 | d4b5ba7eec7b7d523ec4710bd57af0b5548c57de40dac2319920765d1da3114141a7301a9aa2728d5f5551358990149ac608f49b1c75288291542b625c224c3f |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
| MD5 | a1c4730a5209966893c94d97a912b132 |
| SHA1 | ed8e8140c639e03267e030dd4015d73a61ef3bfb |
| SHA256 | 4f9a84113b5fd96df2f2dd3bf05d867eb723d523df5afdf8491dd917f218048d |
| SHA512 | de444c3443dcbbfed0088d7c28348b3289d8d0f48dda4ec9396dde28a0c7a534b9d2bf7267c869f233f7889408d42ae4b059aa76c51359eb59158320f281cde0 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7851688.exe
| MD5 | a1c4730a5209966893c94d97a912b132 |
| SHA1 | ed8e8140c639e03267e030dd4015d73a61ef3bfb |
| SHA256 | 4f9a84113b5fd96df2f2dd3bf05d867eb723d523df5afdf8491dd917f218048d |
| SHA512 | de444c3443dcbbfed0088d7c28348b3289d8d0f48dda4ec9396dde28a0c7a534b9d2bf7267c869f233f7889408d42ae4b059aa76c51359eb59158320f281cde0 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
| MD5 | c51b15a6ed00a14c8066fd3d0ad1e6ef |
| SHA1 | 23ed8eefad00a17de33deb78a9543fd0f3283100 |
| SHA256 | ad2867c7a8ff10ae6b2f64ddb60109e81fb968518a54feb9b32c77cd8089a769 |
| SHA512 | 850cdce8df635c6a5aca1682285671ca78af9aedbfa666b2eaa939128c90be5376263ee6b2a1aaa7cacaeb1ab62606f71de0e129c3f20b4f3b10f19a2a0f3f5f |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9721808.exe
| MD5 | c51b15a6ed00a14c8066fd3d0ad1e6ef |
| SHA1 | 23ed8eefad00a17de33deb78a9543fd0f3283100 |
| SHA256 | ad2867c7a8ff10ae6b2f64ddb60109e81fb968518a54feb9b32c77cd8089a769 |
| SHA512 | 850cdce8df635c6a5aca1682285671ca78af9aedbfa666b2eaa939128c90be5376263ee6b2a1aaa7cacaeb1ab62606f71de0e129c3f20b4f3b10f19a2a0f3f5f |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2821801.exe
| MD5 | cfb91e4b0a6204cc013d27f133ad60c6 |
| SHA1 | 9dff6d7ce6083c9fb49c5ba4f47a13c69ea2fbaf |
| SHA256 | c6027913c423dd0515f12e0670663f416ce428977b7b52126cdc406a89f6c8ee |
| SHA512 | dc00f99c6181edc0b47275fa1138e7afb18c1a3993791ddbc947b628887f049620a3160fa1c0e6abb13661c614e1f0b0adbb6004bd54c46e70eccbef163619fd |
memory/3956-35-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-36-0x0000000074A00000-0x00000000751B0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2737874.exe
| MD5 | c06c9ea079847bf00c6dcee510599999 |
| SHA1 | dbae9d6b6560e61ed03ae2c0ae2ef66113562ba9 |
| SHA256 | 87e3754efa9292c1a7c4138ac9681fba2c3565b1f9215557ff3a4d0d19848fba |
| SHA512 | 222932d7d3e07f13523f73d66f6d84361a6d699c059475eeac4eb258bb768c614b5de0db258b8c147c2563b8f4192d254a38b0e418eb5f686f8a02ecec8a3132 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2737874.exe
| MD5 | c06c9ea079847bf00c6dcee510599999 |
| SHA1 | dbae9d6b6560e61ed03ae2c0ae2ef66113562ba9 |
| SHA256 | 87e3754efa9292c1a7c4138ac9681fba2c3565b1f9215557ff3a4d0d19848fba |
| SHA512 | 222932d7d3e07f13523f73d66f6d84361a6d699c059475eeac4eb258bb768c614b5de0db258b8c147c2563b8f4192d254a38b0e418eb5f686f8a02ecec8a3132 |
memory/4208-40-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4208-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4208-41-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4208-44-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3746040.exe
| MD5 | 11b172f8017b7a40ee79774376f22be6 |
| SHA1 | 2ac967bf80f5eed3fa5136d60239ef53141880b1 |
| SHA256 | 58d6511e277824870449306233186ebb2ad32ddd0ccbba0526bd9b68247e40f4 |
| SHA512 | 7d61bb36bbc647636bf270e6f038c21498274cf75f5f62b9bfd6c953093fa2e7ab6d40b72429aa6ea881fd3fa3f11fd8a71ed4f523c1205d12d7e3fcdbd0b8e8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3746040.exe
| MD5 | 11b172f8017b7a40ee79774376f22be6 |
| SHA1 | 2ac967bf80f5eed3fa5136d60239ef53141880b1 |
| SHA256 | 58d6511e277824870449306233186ebb2ad32ddd0ccbba0526bd9b68247e40f4 |
| SHA512 | 7d61bb36bbc647636bf270e6f038c21498274cf75f5f62b9bfd6c953093fa2e7ab6d40b72429aa6ea881fd3fa3f11fd8a71ed4f523c1205d12d7e3fcdbd0b8e8 |
memory/1340-48-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1340-49-0x0000000001250000-0x0000000001256000-memory.dmp
memory/1340-50-0x0000000074A00000-0x00000000751B0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3203303.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3203303.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/1340-56-0x000000000AEA0000-0x000000000B4B8000-memory.dmp
memory/1340-57-0x000000000A990000-0x000000000AA9A000-memory.dmp
memory/1340-58-0x0000000002CE0000-0x0000000002CF0000-memory.dmp
memory/1340-59-0x0000000002E80000-0x0000000002E92000-memory.dmp
memory/1340-61-0x000000000A8C0000-0x000000000A8FC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8641600.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/1340-67-0x000000000A900000-0x000000000A94C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8641600.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6127731.exe
| MD5 | f40dc45bc1062ec4650fd78db79b067b |
| SHA1 | 9e82d1d4a216288274dd3b45b073dc108914b8a6 |
| SHA256 | 477de5ec4b70ab1e4c9190d59aae5d7bf3fecb2710db3b293e555a9722b2b3f6 |
| SHA512 | b6cfdacbe8d504660a8c0850dc9c6b51cc2ab6e36c38e114c55f963e4e3ea29fc7033dfa3c2b36f61f50eda960dbd41529c676c7cde28bd69e597ed438d16071 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6127731.exe
| MD5 | f40dc45bc1062ec4650fd78db79b067b |
| SHA1 | 9e82d1d4a216288274dd3b45b073dc108914b8a6 |
| SHA256 | 477de5ec4b70ab1e4c9190d59aae5d7bf3fecb2710db3b293e555a9722b2b3f6 |
| SHA512 | b6cfdacbe8d504660a8c0850dc9c6b51cc2ab6e36c38e114c55f963e4e3ea29fc7033dfa3c2b36f61f50eda960dbd41529c676c7cde28bd69e597ed438d16071 |
memory/3956-85-0x0000000074A00000-0x00000000751B0000-memory.dmp
memory/1340-86-0x0000000074A00000-0x00000000751B0000-memory.dmp
memory/1340-87-0x0000000002CE0000-0x0000000002CF0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |