Analysis Overview
SHA256
5c30d6858f3c17f6007ba87a11b0fc948ecebd18394d704dd7c282fea9686e0d
Threat Level: Known bad
The file 5c30d6858f3c17f6007ba87a11b0fc948ecebd18394d704dd7c282fea9686e0d_JC.exe was found to be: Known bad.
Malicious Activity Summary
Detect Mystic stealer payload
Healer
Modifies Windows Defender Real-time Protection settings
Detects Healer an antivirus disabler dropper
Mystic
Amadey
RedLine
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Program crash
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 21:37
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 21:37
Reported
2023-10-10 23:12
Platform
win7-20230831-en
Max time kernel
119s
Max time network
133s
Command Line
Signatures
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe | N/A |
Loads dropped DLL
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\5c30d6858f3c17f6007ba87a11b0fc948ecebd18394d704dd7c282fea9686e0d_JC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2700 set thread context of 2580 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\5c30d6858f3c17f6007ba87a11b0fc948ecebd18394d704dd7c282fea9686e0d_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5c30d6858f3c17f6007ba87a11b0fc948ecebd18394d704dd7c282fea9686e0d_JC.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 276
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
| MD5 | 42ab68db42e7b7bef4741dba417898ce |
| SHA1 | 29979658ccd27f4d2f0b66797a3a05f138877fe8 |
| SHA256 | 5508a352989f2d4bc12b3a7927d645824e7e049e14d0811b707314b92d573b8c |
| SHA512 | 53272d50d9f62ea81a1d0306677906e4444bd0f1f36cce90b2c7dd7b8bd65fb6c561465b66059af10c1b3857612498fb0513017e4b996d8ebef9419f63fcd7b4 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
| MD5 | 42ab68db42e7b7bef4741dba417898ce |
| SHA1 | 29979658ccd27f4d2f0b66797a3a05f138877fe8 |
| SHA256 | 5508a352989f2d4bc12b3a7927d645824e7e049e14d0811b707314b92d573b8c |
| SHA512 | 53272d50d9f62ea81a1d0306677906e4444bd0f1f36cce90b2c7dd7b8bd65fb6c561465b66059af10c1b3857612498fb0513017e4b996d8ebef9419f63fcd7b4 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
| MD5 | 42ab68db42e7b7bef4741dba417898ce |
| SHA1 | 29979658ccd27f4d2f0b66797a3a05f138877fe8 |
| SHA256 | 5508a352989f2d4bc12b3a7927d645824e7e049e14d0811b707314b92d573b8c |
| SHA512 | 53272d50d9f62ea81a1d0306677906e4444bd0f1f36cce90b2c7dd7b8bd65fb6c561465b66059af10c1b3857612498fb0513017e4b996d8ebef9419f63fcd7b4 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
| MD5 | 42ab68db42e7b7bef4741dba417898ce |
| SHA1 | 29979658ccd27f4d2f0b66797a3a05f138877fe8 |
| SHA256 | 5508a352989f2d4bc12b3a7927d645824e7e049e14d0811b707314b92d573b8c |
| SHA512 | 53272d50d9f62ea81a1d0306677906e4444bd0f1f36cce90b2c7dd7b8bd65fb6c561465b66059af10c1b3857612498fb0513017e4b996d8ebef9419f63fcd7b4 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
| MD5 | 5cafeaefe6cb0209d2d35c87a9268b6b |
| SHA1 | aad2b2c63fc76472b1371bc68a59840ba336fa78 |
| SHA256 | b3582bc8bfa195a7c5847984c2c739c0de486fe266e1d6cceb6df00e0677dad0 |
| SHA512 | dccaf6dbe7db74900d5fa2f0bc9892c9fffd147238cc9f77a7b50f2f0bc566bc7670fbc4622d0977dd9771a0a7532e8dcd7304fc4f654dc0c5853b2bb1c37ab7 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
| MD5 | 5cafeaefe6cb0209d2d35c87a9268b6b |
| SHA1 | aad2b2c63fc76472b1371bc68a59840ba336fa78 |
| SHA256 | b3582bc8bfa195a7c5847984c2c739c0de486fe266e1d6cceb6df00e0677dad0 |
| SHA512 | dccaf6dbe7db74900d5fa2f0bc9892c9fffd147238cc9f77a7b50f2f0bc566bc7670fbc4622d0977dd9771a0a7532e8dcd7304fc4f654dc0c5853b2bb1c37ab7 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
| MD5 | 5cafeaefe6cb0209d2d35c87a9268b6b |
| SHA1 | aad2b2c63fc76472b1371bc68a59840ba336fa78 |
| SHA256 | b3582bc8bfa195a7c5847984c2c739c0de486fe266e1d6cceb6df00e0677dad0 |
| SHA512 | dccaf6dbe7db74900d5fa2f0bc9892c9fffd147238cc9f77a7b50f2f0bc566bc7670fbc4622d0977dd9771a0a7532e8dcd7304fc4f654dc0c5853b2bb1c37ab7 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
| MD5 | 5cafeaefe6cb0209d2d35c87a9268b6b |
| SHA1 | aad2b2c63fc76472b1371bc68a59840ba336fa78 |
| SHA256 | b3582bc8bfa195a7c5847984c2c739c0de486fe266e1d6cceb6df00e0677dad0 |
| SHA512 | dccaf6dbe7db74900d5fa2f0bc9892c9fffd147238cc9f77a7b50f2f0bc566bc7670fbc4622d0977dd9771a0a7532e8dcd7304fc4f654dc0c5853b2bb1c37ab7 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
| MD5 | 15da8e7dc7922665c407c0341c511fef |
| SHA1 | 41d3db13455c50f6ad04a9eeaa3b919318f8b58a |
| SHA256 | 0d57f362463f33c9daeb699fadae76ec975b01e46f09050ff5ce8c075017d515 |
| SHA512 | c8142ef7c9f1e18ec5d0b29a261693c0290c879297c1b87ee851f2eea6f69b817d4ec189637a5e64caf2854a51c6c7bc4264ddb114921c37d638c1e0149e5e4e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
| MD5 | 15da8e7dc7922665c407c0341c511fef |
| SHA1 | 41d3db13455c50f6ad04a9eeaa3b919318f8b58a |
| SHA256 | 0d57f362463f33c9daeb699fadae76ec975b01e46f09050ff5ce8c075017d515 |
| SHA512 | c8142ef7c9f1e18ec5d0b29a261693c0290c879297c1b87ee851f2eea6f69b817d4ec189637a5e64caf2854a51c6c7bc4264ddb114921c37d638c1e0149e5e4e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
| MD5 | 15da8e7dc7922665c407c0341c511fef |
| SHA1 | 41d3db13455c50f6ad04a9eeaa3b919318f8b58a |
| SHA256 | 0d57f362463f33c9daeb699fadae76ec975b01e46f09050ff5ce8c075017d515 |
| SHA512 | c8142ef7c9f1e18ec5d0b29a261693c0290c879297c1b87ee851f2eea6f69b817d4ec189637a5e64caf2854a51c6c7bc4264ddb114921c37d638c1e0149e5e4e |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
| MD5 | 15da8e7dc7922665c407c0341c511fef |
| SHA1 | 41d3db13455c50f6ad04a9eeaa3b919318f8b58a |
| SHA256 | 0d57f362463f33c9daeb699fadae76ec975b01e46f09050ff5ce8c075017d515 |
| SHA512 | c8142ef7c9f1e18ec5d0b29a261693c0290c879297c1b87ee851f2eea6f69b817d4ec189637a5e64caf2854a51c6c7bc4264ddb114921c37d638c1e0149e5e4e |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
| MD5 | ac8c6e6b4e8a26dd27743bdac3890a38 |
| SHA1 | 2d7b11091f8c736391f2ac70e29129ee22d6435a |
| SHA256 | 614d3ea61384d6ac84fd3b07a8204b9675804375039cba278a7834ac19b7b676 |
| SHA512 | 5f28fcfa46aacd46b8dab2a52953a443f8253433f2b2ce6826de8edd5ca78914d5c4aaaf6cba11c7f115dc2d464ece8502418411b1c81f91d380d0afa8b7b7eb |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
| MD5 | ac8c6e6b4e8a26dd27743bdac3890a38 |
| SHA1 | 2d7b11091f8c736391f2ac70e29129ee22d6435a |
| SHA256 | 614d3ea61384d6ac84fd3b07a8204b9675804375039cba278a7834ac19b7b676 |
| SHA512 | 5f28fcfa46aacd46b8dab2a52953a443f8253433f2b2ce6826de8edd5ca78914d5c4aaaf6cba11c7f115dc2d464ece8502418411b1c81f91d380d0afa8b7b7eb |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
| MD5 | ac8c6e6b4e8a26dd27743bdac3890a38 |
| SHA1 | 2d7b11091f8c736391f2ac70e29129ee22d6435a |
| SHA256 | 614d3ea61384d6ac84fd3b07a8204b9675804375039cba278a7834ac19b7b676 |
| SHA512 | 5f28fcfa46aacd46b8dab2a52953a443f8253433f2b2ce6826de8edd5ca78914d5c4aaaf6cba11c7f115dc2d464ece8502418411b1c81f91d380d0afa8b7b7eb |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
| MD5 | ac8c6e6b4e8a26dd27743bdac3890a38 |
| SHA1 | 2d7b11091f8c736391f2ac70e29129ee22d6435a |
| SHA256 | 614d3ea61384d6ac84fd3b07a8204b9675804375039cba278a7834ac19b7b676 |
| SHA512 | 5f28fcfa46aacd46b8dab2a52953a443f8253433f2b2ce6826de8edd5ca78914d5c4aaaf6cba11c7f115dc2d464ece8502418411b1c81f91d380d0afa8b7b7eb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
memory/2580-53-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2580-54-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2580-55-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2580-56-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2580-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2580-58-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2580-62-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2580-60-0x0000000000400000-0x000000000040A000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 21:37
Reported
2023-10-10 23:13
Platform
win10v2004-20230915-en
Max time kernel
160s
Max time network
183s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6826704.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9991115.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\5c30d6858f3c17f6007ba87a11b0fc948ecebd18394d704dd7c282fea9686e0d_JC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3212 set thread context of 4436 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 1336 set thread context of 1096 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5598012.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4996 set thread context of 1156 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8588401.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\5c30d6858f3c17f6007ba87a11b0fc948ecebd18394d704dd7c282fea9686e0d_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5c30d6858f3c17f6007ba87a11b0fc948ecebd18394d704dd7c282fea9686e0d_JC.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3212 -ip 3212
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 156
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5598012.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5598012.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1336 -ip 1336
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1096 -ip 1096
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 140
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8588401.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8588401.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4996 -ip 4996
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 588
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6826704.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6826704.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9991115.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9991115.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7754760.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7754760.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 32.101.122.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.120.234.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.81.21.72.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
| MD5 | 42ab68db42e7b7bef4741dba417898ce |
| SHA1 | 29979658ccd27f4d2f0b66797a3a05f138877fe8 |
| SHA256 | 5508a352989f2d4bc12b3a7927d645824e7e049e14d0811b707314b92d573b8c |
| SHA512 | 53272d50d9f62ea81a1d0306677906e4444bd0f1f36cce90b2c7dd7b8bd65fb6c561465b66059af10c1b3857612498fb0513017e4b996d8ebef9419f63fcd7b4 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5069071.exe
| MD5 | 42ab68db42e7b7bef4741dba417898ce |
| SHA1 | 29979658ccd27f4d2f0b66797a3a05f138877fe8 |
| SHA256 | 5508a352989f2d4bc12b3a7927d645824e7e049e14d0811b707314b92d573b8c |
| SHA512 | 53272d50d9f62ea81a1d0306677906e4444bd0f1f36cce90b2c7dd7b8bd65fb6c561465b66059af10c1b3857612498fb0513017e4b996d8ebef9419f63fcd7b4 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
| MD5 | 5cafeaefe6cb0209d2d35c87a9268b6b |
| SHA1 | aad2b2c63fc76472b1371bc68a59840ba336fa78 |
| SHA256 | b3582bc8bfa195a7c5847984c2c739c0de486fe266e1d6cceb6df00e0677dad0 |
| SHA512 | dccaf6dbe7db74900d5fa2f0bc9892c9fffd147238cc9f77a7b50f2f0bc566bc7670fbc4622d0977dd9771a0a7532e8dcd7304fc4f654dc0c5853b2bb1c37ab7 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1395316.exe
| MD5 | 5cafeaefe6cb0209d2d35c87a9268b6b |
| SHA1 | aad2b2c63fc76472b1371bc68a59840ba336fa78 |
| SHA256 | b3582bc8bfa195a7c5847984c2c739c0de486fe266e1d6cceb6df00e0677dad0 |
| SHA512 | dccaf6dbe7db74900d5fa2f0bc9892c9fffd147238cc9f77a7b50f2f0bc566bc7670fbc4622d0977dd9771a0a7532e8dcd7304fc4f654dc0c5853b2bb1c37ab7 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
| MD5 | 15da8e7dc7922665c407c0341c511fef |
| SHA1 | 41d3db13455c50f6ad04a9eeaa3b919318f8b58a |
| SHA256 | 0d57f362463f33c9daeb699fadae76ec975b01e46f09050ff5ce8c075017d515 |
| SHA512 | c8142ef7c9f1e18ec5d0b29a261693c0290c879297c1b87ee851f2eea6f69b817d4ec189637a5e64caf2854a51c6c7bc4264ddb114921c37d638c1e0149e5e4e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4811096.exe
| MD5 | 15da8e7dc7922665c407c0341c511fef |
| SHA1 | 41d3db13455c50f6ad04a9eeaa3b919318f8b58a |
| SHA256 | 0d57f362463f33c9daeb699fadae76ec975b01e46f09050ff5ce8c075017d515 |
| SHA512 | c8142ef7c9f1e18ec5d0b29a261693c0290c879297c1b87ee851f2eea6f69b817d4ec189637a5e64caf2854a51c6c7bc4264ddb114921c37d638c1e0149e5e4e |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
| MD5 | ac8c6e6b4e8a26dd27743bdac3890a38 |
| SHA1 | 2d7b11091f8c736391f2ac70e29129ee22d6435a |
| SHA256 | 614d3ea61384d6ac84fd3b07a8204b9675804375039cba278a7834ac19b7b676 |
| SHA512 | 5f28fcfa46aacd46b8dab2a52953a443f8253433f2b2ce6826de8edd5ca78914d5c4aaaf6cba11c7f115dc2d464ece8502418411b1c81f91d380d0afa8b7b7eb |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1145812.exe
| MD5 | ac8c6e6b4e8a26dd27743bdac3890a38 |
| SHA1 | 2d7b11091f8c736391f2ac70e29129ee22d6435a |
| SHA256 | 614d3ea61384d6ac84fd3b07a8204b9675804375039cba278a7834ac19b7b676 |
| SHA512 | 5f28fcfa46aacd46b8dab2a52953a443f8253433f2b2ce6826de8edd5ca78914d5c4aaaf6cba11c7f115dc2d464ece8502418411b1c81f91d380d0afa8b7b7eb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3955346.exe
| MD5 | 4e3b88807d6c7fa2950cf616b1f3f0b8 |
| SHA1 | f2edc0aa9e2746ceb1dc20734d3f8121758965b5 |
| SHA256 | 89e9d8747d8863b4c756663bd164b757b14799ffa6dc3d6a1fedef461c9cf878 |
| SHA512 | 0764ab25bd56c093c615a048bfcd0b0c3559d49201dc4e6177ec81294d2dd0bb559498586e58a6dab7ae0dc4766235dab5b425b3ef3597a1c038b4bfc877e350 |
memory/4436-35-0x0000000000400000-0x000000000040A000-memory.dmp
memory/4436-36-0x0000000073F50000-0x0000000074700000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5598012.exe
| MD5 | 8c09139aa3fa1b6eee3afd4a47beeeb3 |
| SHA1 | e40e07db5154bab253f98dc82521d1c58252fc7d |
| SHA256 | 6c95a00379963a52ceecc718191a6b92fb25aa41f3038d06966ec1450a1e7e05 |
| SHA512 | 46630fb43e19bef8ad1c6017be233847f118c726365a8d4f9d313f18a05e862e7bb8f34a3909ab3442549bf3d696b59cf57ab311fd04fadb42fda775ceaf5864 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5598012.exe
| MD5 | 8c09139aa3fa1b6eee3afd4a47beeeb3 |
| SHA1 | e40e07db5154bab253f98dc82521d1c58252fc7d |
| SHA256 | 6c95a00379963a52ceecc718191a6b92fb25aa41f3038d06966ec1450a1e7e05 |
| SHA512 | 46630fb43e19bef8ad1c6017be233847f118c726365a8d4f9d313f18a05e862e7bb8f34a3909ab3442549bf3d696b59cf57ab311fd04fadb42fda775ceaf5864 |
memory/1096-40-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1096-41-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1096-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1096-44-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8588401.exe
| MD5 | 0fea4fd1606d66a3532c638e7c652b34 |
| SHA1 | 7f923eb816a3e38c43d702c55a0b60f518547baa |
| SHA256 | 3d5fdd8d06103806aaa9db4267799a9fe757f0f7f102e7b9ed89572e820a89ef |
| SHA512 | 57375f3b84c2cdc0515cfe2f31fac8c29963dfc2b841bf1fd7bf6c1d492f815a1ee50e9843fc19a81797b017dd8ac7e678ec42690a2f991f12d16ecac8f9c66a |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8588401.exe
| MD5 | 0fea4fd1606d66a3532c638e7c652b34 |
| SHA1 | 7f923eb816a3e38c43d702c55a0b60f518547baa |
| SHA256 | 3d5fdd8d06103806aaa9db4267799a9fe757f0f7f102e7b9ed89572e820a89ef |
| SHA512 | 57375f3b84c2cdc0515cfe2f31fac8c29963dfc2b841bf1fd7bf6c1d492f815a1ee50e9843fc19a81797b017dd8ac7e678ec42690a2f991f12d16ecac8f9c66a |
memory/1156-48-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1156-49-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/1156-50-0x0000000001280000-0x0000000001286000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6826704.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6826704.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/1156-57-0x0000000005AF0000-0x0000000006108000-memory.dmp
memory/1156-61-0x00000000055E0000-0x00000000056EA000-memory.dmp
memory/1156-63-0x00000000053A0000-0x00000000053B2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/1156-64-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/1156-67-0x0000000005510000-0x000000000554C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9991115.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9991115.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/1156-73-0x0000000005560000-0x00000000055AC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7754760.exe
| MD5 | a4de1f676e11e33c0bde18d4a3bcd0a1 |
| SHA1 | 6d98bf445bbcc87b1578a06d76975ebd78b51bc3 |
| SHA256 | 274f8955965674b9a0cc2687d1bbc5a47d36da0ab798eb3dc2f1c8f07875868d |
| SHA512 | d11cb765dc53657f65aaa9a925b65462f13de9e8e2c18e53f15317d2e5b1296a940d1e5d36446ec1e443f4e5f864955fef136f05353f611da2785bb1ecec4228 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7754760.exe
| MD5 | a4de1f676e11e33c0bde18d4a3bcd0a1 |
| SHA1 | 6d98bf445bbcc87b1578a06d76975ebd78b51bc3 |
| SHA256 | 274f8955965674b9a0cc2687d1bbc5a47d36da0ab798eb3dc2f1c8f07875868d |
| SHA512 | d11cb765dc53657f65aaa9a925b65462f13de9e8e2c18e53f15317d2e5b1296a940d1e5d36446ec1e443f4e5f864955fef136f05353f611da2785bb1ecec4228 |
memory/4436-84-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/1156-85-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/4436-87-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/1156-88-0x00000000053C0000-0x00000000053D0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |