Analysis Overview
SHA256
7cb01016999849441abca4e084af74755a5fae1bbbfdaf8bcb9203917b777a72
Threat Level: Known bad
The file e0826d1a39cb4f47ed518014dc698b69.exe was found to be: Known bad.
Malicious Activity Summary
Modifies Windows Defender Real-time Protection settings
Detect Mystic stealer payload
Amadey
RedLine
Mystic
Detects Healer an antivirus disabler dropper
Healer
Checks computer location settings
Executes dropped EXE
Windows security modification
Loads dropped DLL
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Program crash
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 21:35
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 21:35
Reported
2023-10-10 23:06
Platform
win10v2004-20230915-en
Max time kernel
130s
Max time network
153s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5059904.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9100876.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\e0826d1a39cb4f47ed518014dc698b69.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4000 set thread context of 1864 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 2512 set thread context of 4124 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5213553.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e0826d1a39cb4f47ed518014dc698b69.exe
"C:\Users\Admin\AppData\Local\Temp\e0826d1a39cb4f47ed518014dc698b69.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4000 -ip 4000
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1864 -ip 1864
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 544
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 216
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5213553.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5213553.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2512 -ip 2512
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5059904.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5059904.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9100876.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9100876.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3134194.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3134194.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 126.177.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 24.73.42.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
| MD5 | 0fa37f642f0bbc710ccdc27f7900d338 |
| SHA1 | 62cd5069486f31b34ebb8556887d71c3fc2541be |
| SHA256 | 70f88710d42bb4cf853ee17858550bd933d7b5bd61b065e0aca990f8d2dbb007 |
| SHA512 | 534623322ad7d4c1aa2818e337356dff50ac9e22d21876b6ff25763e39465f15a1677c6d0b4d4da093863efe4a4589b87211a49b02b37b948d5881a16e005b9f |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
| MD5 | 0fa37f642f0bbc710ccdc27f7900d338 |
| SHA1 | 62cd5069486f31b34ebb8556887d71c3fc2541be |
| SHA256 | 70f88710d42bb4cf853ee17858550bd933d7b5bd61b065e0aca990f8d2dbb007 |
| SHA512 | 534623322ad7d4c1aa2818e337356dff50ac9e22d21876b6ff25763e39465f15a1677c6d0b4d4da093863efe4a4589b87211a49b02b37b948d5881a16e005b9f |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
| MD5 | b80183b0abac9c955e5ee10ca26376ec |
| SHA1 | 4cd7d14ce493ab22881433d8060da534edb69bf2 |
| SHA256 | 4f51ab3cf5d83590978b4caaeab57bb871995e48e04ea219b00898f0da8eda0e |
| SHA512 | 156f3bf3ee881d8f36eaf9a2f549aa079eba5c8f51c552f167a16bf360e03e45f209ee8acb5f42590fe34987dd9bdea8dc7d3b2bcd05c02d6079da805abe9e63 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
| MD5 | b80183b0abac9c955e5ee10ca26376ec |
| SHA1 | 4cd7d14ce493ab22881433d8060da534edb69bf2 |
| SHA256 | 4f51ab3cf5d83590978b4caaeab57bb871995e48e04ea219b00898f0da8eda0e |
| SHA512 | 156f3bf3ee881d8f36eaf9a2f549aa079eba5c8f51c552f167a16bf360e03e45f209ee8acb5f42590fe34987dd9bdea8dc7d3b2bcd05c02d6079da805abe9e63 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
| MD5 | 7ddd70edc09447e0e47cf7fd2763d50a |
| SHA1 | 1fafc49a2cd3fbae411fe47721ac3bcd8be39f1f |
| SHA256 | 7cfe051c245923a8939bf9c57b2ef9cfd20f53a981399a9fe73e8d32b748a51c |
| SHA512 | 3d117fe7cf80ddbeaf5e61a9d0ccdd4a2e6f8c1b22336f55a65de77ecd9f2310c22c53aa6eb0e214fe372f5a0f3e45a81ecc4a5c954eacbc7753cb2639338e35 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
| MD5 | 7ddd70edc09447e0e47cf7fd2763d50a |
| SHA1 | 1fafc49a2cd3fbae411fe47721ac3bcd8be39f1f |
| SHA256 | 7cfe051c245923a8939bf9c57b2ef9cfd20f53a981399a9fe73e8d32b748a51c |
| SHA512 | 3d117fe7cf80ddbeaf5e61a9d0ccdd4a2e6f8c1b22336f55a65de77ecd9f2310c22c53aa6eb0e214fe372f5a0f3e45a81ecc4a5c954eacbc7753cb2639338e35 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
| MD5 | 15b564a1c891ee619b83d4614d4dd520 |
| SHA1 | f38e61fa2fc63d670c46b84f5e6d8e9a1ad36e97 |
| SHA256 | f6fec41a567a0b89afadfa424fd58433f5eb0794ce2af4404286f03f822b3b50 |
| SHA512 | f59aca73469403593691256d088f56de175f2a4406b6288040a41fd31ea4713653803150d29edab7c78ff3d8ca0979cd93a80775fdde75715bb5537149c2a703 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
| MD5 | 15b564a1c891ee619b83d4614d4dd520 |
| SHA1 | f38e61fa2fc63d670c46b84f5e6d8e9a1ad36e97 |
| SHA256 | f6fec41a567a0b89afadfa424fd58433f5eb0794ce2af4404286f03f822b3b50 |
| SHA512 | f59aca73469403593691256d088f56de175f2a4406b6288040a41fd31ea4713653803150d29edab7c78ff3d8ca0979cd93a80775fdde75715bb5537149c2a703 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe
| MD5 | f2beb8f47105e57c31af85fe1d119435 |
| SHA1 | 9132afcff5bd9961507c5fb039de4bb5857e7ef5 |
| SHA256 | 28f71325b472ca6a592ae1876f50cc5319c6cf2029996af074b51dd72b12e918 |
| SHA512 | 616005cd7b8f8b5a1523f795fbfbb689d1bd0482e8ec3182298c0ceb0366913d2cffbddf61c06124beae211f8dcd26ab3e1885f060eaa8619dea518546c03b5d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe
| MD5 | f2beb8f47105e57c31af85fe1d119435 |
| SHA1 | 9132afcff5bd9961507c5fb039de4bb5857e7ef5 |
| SHA256 | 28f71325b472ca6a592ae1876f50cc5319c6cf2029996af074b51dd72b12e918 |
| SHA512 | 616005cd7b8f8b5a1523f795fbfbb689d1bd0482e8ec3182298c0ceb0366913d2cffbddf61c06124beae211f8dcd26ab3e1885f060eaa8619dea518546c03b5d |
memory/4512-35-0x0000000000470000-0x000000000047A000-memory.dmp
memory/4512-36-0x00007FFED00E0000-0x00007FFED0BA1000-memory.dmp
memory/4512-38-0x00007FFED00E0000-0x00007FFED0BA1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
memory/1864-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1864-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1864-46-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1864-43-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5213553.exe
| MD5 | e37a1b525a73fa6e54aeb04e0aab5b46 |
| SHA1 | 2f37b2bc4db321376133c95b6405e674cc246d62 |
| SHA256 | 2d1c18724b8c5c4b48252dcf27b3bf0a3ca4f3082ae209e6ca7789b574312c39 |
| SHA512 | 4a243de84b04ced8a27ee23b29c2d75f6018baa993c904ec917fcf5c7b57d90933b228104deb8eccb6f5aea59522ef2602c63ab9966a7a2070b356ac87a8dcf8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5213553.exe
| MD5 | e37a1b525a73fa6e54aeb04e0aab5b46 |
| SHA1 | 2f37b2bc4db321376133c95b6405e674cc246d62 |
| SHA256 | 2d1c18724b8c5c4b48252dcf27b3bf0a3ca4f3082ae209e6ca7789b574312c39 |
| SHA512 | 4a243de84b04ced8a27ee23b29c2d75f6018baa993c904ec917fcf5c7b57d90933b228104deb8eccb6f5aea59522ef2602c63ab9966a7a2070b356ac87a8dcf8 |
memory/4124-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4124-51-0x0000000073A10000-0x00000000741C0000-memory.dmp
memory/4124-52-0x0000000002B20000-0x0000000002B26000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5059904.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5059904.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9100876.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9100876.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/4124-70-0x00000000057D0000-0x0000000005DE8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/4124-71-0x00000000052C0000-0x00000000053CA000-memory.dmp
memory/4124-73-0x0000000005170000-0x0000000005182000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/4124-81-0x00000000051B0000-0x00000000051EC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3134194.exe
| MD5 | 737225784f86f31682603096b4181c99 |
| SHA1 | bf1ac40e2d0e12cdd6b2a8662eaa957b258f3517 |
| SHA256 | 524e60405318fda44eb5c60f85571a276a27a6160824166fe45bb4429dc2c533 |
| SHA512 | 746bbabb301105455238eabd75ad65dc3f5d3671e9c658735a9de369fd644d78e159a79d3483783ad487991481b5f7fbeadeb4ac5df1828696d1d264ad83a94b |
memory/4124-72-0x00000000051A0000-0x00000000051B0000-memory.dmp
memory/4124-84-0x0000000005220000-0x000000000526C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3134194.exe
| MD5 | 737225784f86f31682603096b4181c99 |
| SHA1 | bf1ac40e2d0e12cdd6b2a8662eaa957b258f3517 |
| SHA256 | 524e60405318fda44eb5c60f85571a276a27a6160824166fe45bb4429dc2c533 |
| SHA512 | 746bbabb301105455238eabd75ad65dc3f5d3671e9c658735a9de369fd644d78e159a79d3483783ad487991481b5f7fbeadeb4ac5df1828696d1d264ad83a94b |
memory/4124-86-0x0000000073A10000-0x00000000741C0000-memory.dmp
memory/4124-87-0x00000000051A0000-0x00000000051B0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 21:35
Reported
2023-10-10 23:07
Platform
win7-20230831-en
Max time kernel
122s
Max time network
142s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\e0826d1a39cb4f47ed518014dc698b69.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2564 set thread context of 2596 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e0826d1a39cb4f47ed518014dc698b69.exe
"C:\Users\Admin\AppData\Local\Temp\e0826d1a39cb4f47ed518014dc698b69.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 268
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 36
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
| MD5 | 0fa37f642f0bbc710ccdc27f7900d338 |
| SHA1 | 62cd5069486f31b34ebb8556887d71c3fc2541be |
| SHA256 | 70f88710d42bb4cf853ee17858550bd933d7b5bd61b065e0aca990f8d2dbb007 |
| SHA512 | 534623322ad7d4c1aa2818e337356dff50ac9e22d21876b6ff25763e39465f15a1677c6d0b4d4da093863efe4a4589b87211a49b02b37b948d5881a16e005b9f |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
| MD5 | 0fa37f642f0bbc710ccdc27f7900d338 |
| SHA1 | 62cd5069486f31b34ebb8556887d71c3fc2541be |
| SHA256 | 70f88710d42bb4cf853ee17858550bd933d7b5bd61b065e0aca990f8d2dbb007 |
| SHA512 | 534623322ad7d4c1aa2818e337356dff50ac9e22d21876b6ff25763e39465f15a1677c6d0b4d4da093863efe4a4589b87211a49b02b37b948d5881a16e005b9f |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
| MD5 | 0fa37f642f0bbc710ccdc27f7900d338 |
| SHA1 | 62cd5069486f31b34ebb8556887d71c3fc2541be |
| SHA256 | 70f88710d42bb4cf853ee17858550bd933d7b5bd61b065e0aca990f8d2dbb007 |
| SHA512 | 534623322ad7d4c1aa2818e337356dff50ac9e22d21876b6ff25763e39465f15a1677c6d0b4d4da093863efe4a4589b87211a49b02b37b948d5881a16e005b9f |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9343511.exe
| MD5 | 0fa37f642f0bbc710ccdc27f7900d338 |
| SHA1 | 62cd5069486f31b34ebb8556887d71c3fc2541be |
| SHA256 | 70f88710d42bb4cf853ee17858550bd933d7b5bd61b065e0aca990f8d2dbb007 |
| SHA512 | 534623322ad7d4c1aa2818e337356dff50ac9e22d21876b6ff25763e39465f15a1677c6d0b4d4da093863efe4a4589b87211a49b02b37b948d5881a16e005b9f |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
| MD5 | b80183b0abac9c955e5ee10ca26376ec |
| SHA1 | 4cd7d14ce493ab22881433d8060da534edb69bf2 |
| SHA256 | 4f51ab3cf5d83590978b4caaeab57bb871995e48e04ea219b00898f0da8eda0e |
| SHA512 | 156f3bf3ee881d8f36eaf9a2f549aa079eba5c8f51c552f167a16bf360e03e45f209ee8acb5f42590fe34987dd9bdea8dc7d3b2bcd05c02d6079da805abe9e63 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
| MD5 | b80183b0abac9c955e5ee10ca26376ec |
| SHA1 | 4cd7d14ce493ab22881433d8060da534edb69bf2 |
| SHA256 | 4f51ab3cf5d83590978b4caaeab57bb871995e48e04ea219b00898f0da8eda0e |
| SHA512 | 156f3bf3ee881d8f36eaf9a2f549aa079eba5c8f51c552f167a16bf360e03e45f209ee8acb5f42590fe34987dd9bdea8dc7d3b2bcd05c02d6079da805abe9e63 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
| MD5 | b80183b0abac9c955e5ee10ca26376ec |
| SHA1 | 4cd7d14ce493ab22881433d8060da534edb69bf2 |
| SHA256 | 4f51ab3cf5d83590978b4caaeab57bb871995e48e04ea219b00898f0da8eda0e |
| SHA512 | 156f3bf3ee881d8f36eaf9a2f549aa079eba5c8f51c552f167a16bf360e03e45f209ee8acb5f42590fe34987dd9bdea8dc7d3b2bcd05c02d6079da805abe9e63 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0532921.exe
| MD5 | b80183b0abac9c955e5ee10ca26376ec |
| SHA1 | 4cd7d14ce493ab22881433d8060da534edb69bf2 |
| SHA256 | 4f51ab3cf5d83590978b4caaeab57bb871995e48e04ea219b00898f0da8eda0e |
| SHA512 | 156f3bf3ee881d8f36eaf9a2f549aa079eba5c8f51c552f167a16bf360e03e45f209ee8acb5f42590fe34987dd9bdea8dc7d3b2bcd05c02d6079da805abe9e63 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
| MD5 | 7ddd70edc09447e0e47cf7fd2763d50a |
| SHA1 | 1fafc49a2cd3fbae411fe47721ac3bcd8be39f1f |
| SHA256 | 7cfe051c245923a8939bf9c57b2ef9cfd20f53a981399a9fe73e8d32b748a51c |
| SHA512 | 3d117fe7cf80ddbeaf5e61a9d0ccdd4a2e6f8c1b22336f55a65de77ecd9f2310c22c53aa6eb0e214fe372f5a0f3e45a81ecc4a5c954eacbc7753cb2639338e35 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
| MD5 | 7ddd70edc09447e0e47cf7fd2763d50a |
| SHA1 | 1fafc49a2cd3fbae411fe47721ac3bcd8be39f1f |
| SHA256 | 7cfe051c245923a8939bf9c57b2ef9cfd20f53a981399a9fe73e8d32b748a51c |
| SHA512 | 3d117fe7cf80ddbeaf5e61a9d0ccdd4a2e6f8c1b22336f55a65de77ecd9f2310c22c53aa6eb0e214fe372f5a0f3e45a81ecc4a5c954eacbc7753cb2639338e35 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
| MD5 | 7ddd70edc09447e0e47cf7fd2763d50a |
| SHA1 | 1fafc49a2cd3fbae411fe47721ac3bcd8be39f1f |
| SHA256 | 7cfe051c245923a8939bf9c57b2ef9cfd20f53a981399a9fe73e8d32b748a51c |
| SHA512 | 3d117fe7cf80ddbeaf5e61a9d0ccdd4a2e6f8c1b22336f55a65de77ecd9f2310c22c53aa6eb0e214fe372f5a0f3e45a81ecc4a5c954eacbc7753cb2639338e35 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8879212.exe
| MD5 | 7ddd70edc09447e0e47cf7fd2763d50a |
| SHA1 | 1fafc49a2cd3fbae411fe47721ac3bcd8be39f1f |
| SHA256 | 7cfe051c245923a8939bf9c57b2ef9cfd20f53a981399a9fe73e8d32b748a51c |
| SHA512 | 3d117fe7cf80ddbeaf5e61a9d0ccdd4a2e6f8c1b22336f55a65de77ecd9f2310c22c53aa6eb0e214fe372f5a0f3e45a81ecc4a5c954eacbc7753cb2639338e35 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
| MD5 | 15b564a1c891ee619b83d4614d4dd520 |
| SHA1 | f38e61fa2fc63d670c46b84f5e6d8e9a1ad36e97 |
| SHA256 | f6fec41a567a0b89afadfa424fd58433f5eb0794ce2af4404286f03f822b3b50 |
| SHA512 | f59aca73469403593691256d088f56de175f2a4406b6288040a41fd31ea4713653803150d29edab7c78ff3d8ca0979cd93a80775fdde75715bb5537149c2a703 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
| MD5 | 15b564a1c891ee619b83d4614d4dd520 |
| SHA1 | f38e61fa2fc63d670c46b84f5e6d8e9a1ad36e97 |
| SHA256 | f6fec41a567a0b89afadfa424fd58433f5eb0794ce2af4404286f03f822b3b50 |
| SHA512 | f59aca73469403593691256d088f56de175f2a4406b6288040a41fd31ea4713653803150d29edab7c78ff3d8ca0979cd93a80775fdde75715bb5537149c2a703 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
| MD5 | 15b564a1c891ee619b83d4614d4dd520 |
| SHA1 | f38e61fa2fc63d670c46b84f5e6d8e9a1ad36e97 |
| SHA256 | f6fec41a567a0b89afadfa424fd58433f5eb0794ce2af4404286f03f822b3b50 |
| SHA512 | f59aca73469403593691256d088f56de175f2a4406b6288040a41fd31ea4713653803150d29edab7c78ff3d8ca0979cd93a80775fdde75715bb5537149c2a703 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3732890.exe
| MD5 | 15b564a1c891ee619b83d4614d4dd520 |
| SHA1 | f38e61fa2fc63d670c46b84f5e6d8e9a1ad36e97 |
| SHA256 | f6fec41a567a0b89afadfa424fd58433f5eb0794ce2af4404286f03f822b3b50 |
| SHA512 | f59aca73469403593691256d088f56de175f2a4406b6288040a41fd31ea4713653803150d29edab7c78ff3d8ca0979cd93a80775fdde75715bb5537149c2a703 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe
| MD5 | f2beb8f47105e57c31af85fe1d119435 |
| SHA1 | 9132afcff5bd9961507c5fb039de4bb5857e7ef5 |
| SHA256 | 28f71325b472ca6a592ae1876f50cc5319c6cf2029996af074b51dd72b12e918 |
| SHA512 | 616005cd7b8f8b5a1523f795fbfbb689d1bd0482e8ec3182298c0ceb0366913d2cffbddf61c06124beae211f8dcd26ab3e1885f060eaa8619dea518546c03b5d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe
| MD5 | f2beb8f47105e57c31af85fe1d119435 |
| SHA1 | 9132afcff5bd9961507c5fb039de4bb5857e7ef5 |
| SHA256 | 28f71325b472ca6a592ae1876f50cc5319c6cf2029996af074b51dd72b12e918 |
| SHA512 | 616005cd7b8f8b5a1523f795fbfbb689d1bd0482e8ec3182298c0ceb0366913d2cffbddf61c06124beae211f8dcd26ab3e1885f060eaa8619dea518546c03b5d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8112196.exe
| MD5 | f2beb8f47105e57c31af85fe1d119435 |
| SHA1 | 9132afcff5bd9961507c5fb039de4bb5857e7ef5 |
| SHA256 | 28f71325b472ca6a592ae1876f50cc5319c6cf2029996af074b51dd72b12e918 |
| SHA512 | 616005cd7b8f8b5a1523f795fbfbb689d1bd0482e8ec3182298c0ceb0366913d2cffbddf61c06124beae211f8dcd26ab3e1885f060eaa8619dea518546c03b5d |
memory/2768-48-0x0000000001190000-0x000000000119A000-memory.dmp
memory/2768-49-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp
memory/2768-50-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp
memory/2768-51-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
memory/2596-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2596-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2596-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2596-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2596-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2596-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2596-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2596-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2596-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2596-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0035227.exe
| MD5 | 45097c0f58dced28b150b4c6c25d51b3 |
| SHA1 | a0e97b97876c7a3120bfc9fd45643fff4b85e357 |
| SHA256 | e5075747cc242093d3780dfe0eb8d38e1db5d3cbda1a7d772f84896ee1f285cc |
| SHA512 | 0f4105b36d2d495931f0791d963e9193ea4c5f74bf1bf0f53d6529a30e4aeb89376b2103e95c9a9cdf65f5b5f0c2df5168be7fbe91da6527e4d3818faa366918 |