Analysis Overview
SHA256
6b169f467f79113a5bb599bc4a3d72c839aabe7914cff07c81c9a78a497eefed
Threat Level: Known bad
The file 6b169f467f79113a5bb599bc4a3d72c839aabe7914cff07c81c9a78a497eefed was found to be: Known bad.
Malicious Activity Summary
Healer
Detects Healer an antivirus disabler dropper
RedLine
Amadey
Detect Mystic stealer payload
Modifies Windows Defender Real-time Protection settings
Mystic
Windows security modification
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Program crash
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:18
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:18
Reported
2023-10-10 20:22
Platform
win7-20230831-en
Max time kernel
120s
Max time network
123s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\6b169f467f79113a5bb599bc4a3d72c839aabe7914cff07c81c9a78a497eefed.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2172 set thread context of 2512 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6b169f467f79113a5bb599bc4a3d72c839aabe7914cff07c81c9a78a497eefed.exe
"C:\Users\Admin\AppData\Local\Temp\6b169f467f79113a5bb599bc4a3d72c839aabe7914cff07c81c9a78a497eefed.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 36
Network
| Country | Destination | Domain | Proto |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
| MD5 | c7b58e4478e7bf896876686a460abd52 |
| SHA1 | 0bfad0a0ccd5f161d7fcbd1f1b25ee68cbe6610a |
| SHA256 | fded8eb707dba7e1997720c5c12223e9c79aa749789d4cef562c1be0cbbc2c85 |
| SHA512 | 58ea779297c4eae59da41294fc00e5e9996855c5f124fc81f04fe37030d6e4959c9ee8f0981061e6965ac6bb1ed922413ecb3be861ffa8788664b7be48355f34 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
| MD5 | c7b58e4478e7bf896876686a460abd52 |
| SHA1 | 0bfad0a0ccd5f161d7fcbd1f1b25ee68cbe6610a |
| SHA256 | fded8eb707dba7e1997720c5c12223e9c79aa749789d4cef562c1be0cbbc2c85 |
| SHA512 | 58ea779297c4eae59da41294fc00e5e9996855c5f124fc81f04fe37030d6e4959c9ee8f0981061e6965ac6bb1ed922413ecb3be861ffa8788664b7be48355f34 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
| MD5 | c7b58e4478e7bf896876686a460abd52 |
| SHA1 | 0bfad0a0ccd5f161d7fcbd1f1b25ee68cbe6610a |
| SHA256 | fded8eb707dba7e1997720c5c12223e9c79aa749789d4cef562c1be0cbbc2c85 |
| SHA512 | 58ea779297c4eae59da41294fc00e5e9996855c5f124fc81f04fe37030d6e4959c9ee8f0981061e6965ac6bb1ed922413ecb3be861ffa8788664b7be48355f34 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
| MD5 | c7b58e4478e7bf896876686a460abd52 |
| SHA1 | 0bfad0a0ccd5f161d7fcbd1f1b25ee68cbe6610a |
| SHA256 | fded8eb707dba7e1997720c5c12223e9c79aa749789d4cef562c1be0cbbc2c85 |
| SHA512 | 58ea779297c4eae59da41294fc00e5e9996855c5f124fc81f04fe37030d6e4959c9ee8f0981061e6965ac6bb1ed922413ecb3be861ffa8788664b7be48355f34 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
| MD5 | f6a3a25231ae9c2248271dd9c1ac2c31 |
| SHA1 | fe8b38af6c4e9f77111c50974634fa4152948c80 |
| SHA256 | 22ae4bd62fe516fadf4932af4cffb2602b6ba7655fb7f0e420fa210fc7c406a3 |
| SHA512 | 490056521d0e40bd09f3b022a548ac1c003860bc474a078acd2f9a2f639c0fc64a68a3a8e105fd3f61f6e931ed04f03ef69d5fce250eaeb237f845c9b2bbed91 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
| MD5 | f6a3a25231ae9c2248271dd9c1ac2c31 |
| SHA1 | fe8b38af6c4e9f77111c50974634fa4152948c80 |
| SHA256 | 22ae4bd62fe516fadf4932af4cffb2602b6ba7655fb7f0e420fa210fc7c406a3 |
| SHA512 | 490056521d0e40bd09f3b022a548ac1c003860bc474a078acd2f9a2f639c0fc64a68a3a8e105fd3f61f6e931ed04f03ef69d5fce250eaeb237f845c9b2bbed91 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
| MD5 | f6a3a25231ae9c2248271dd9c1ac2c31 |
| SHA1 | fe8b38af6c4e9f77111c50974634fa4152948c80 |
| SHA256 | 22ae4bd62fe516fadf4932af4cffb2602b6ba7655fb7f0e420fa210fc7c406a3 |
| SHA512 | 490056521d0e40bd09f3b022a548ac1c003860bc474a078acd2f9a2f639c0fc64a68a3a8e105fd3f61f6e931ed04f03ef69d5fce250eaeb237f845c9b2bbed91 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
| MD5 | f6a3a25231ae9c2248271dd9c1ac2c31 |
| SHA1 | fe8b38af6c4e9f77111c50974634fa4152948c80 |
| SHA256 | 22ae4bd62fe516fadf4932af4cffb2602b6ba7655fb7f0e420fa210fc7c406a3 |
| SHA512 | 490056521d0e40bd09f3b022a548ac1c003860bc474a078acd2f9a2f639c0fc64a68a3a8e105fd3f61f6e931ed04f03ef69d5fce250eaeb237f845c9b2bbed91 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
| MD5 | c6088b9fee2ec6b55e54d490fc712ccb |
| SHA1 | e7dd076ce9be0c5ca4022be054d6b5a98f96521e |
| SHA256 | 063634932f4aa66fadd262cbcd4b1b2be3efb6866326026477d198b30c59082f |
| SHA512 | 18936966fa08919e8397281bd86b30e4be5e56d6f23c4d5b1d8a4c824f4e81054ed92123b6ec5a3a7debc563f31c65f36744275abc0a205736aff68f3ff9a7d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
| MD5 | c6088b9fee2ec6b55e54d490fc712ccb |
| SHA1 | e7dd076ce9be0c5ca4022be054d6b5a98f96521e |
| SHA256 | 063634932f4aa66fadd262cbcd4b1b2be3efb6866326026477d198b30c59082f |
| SHA512 | 18936966fa08919e8397281bd86b30e4be5e56d6f23c4d5b1d8a4c824f4e81054ed92123b6ec5a3a7debc563f31c65f36744275abc0a205736aff68f3ff9a7d8 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
| MD5 | c6088b9fee2ec6b55e54d490fc712ccb |
| SHA1 | e7dd076ce9be0c5ca4022be054d6b5a98f96521e |
| SHA256 | 063634932f4aa66fadd262cbcd4b1b2be3efb6866326026477d198b30c59082f |
| SHA512 | 18936966fa08919e8397281bd86b30e4be5e56d6f23c4d5b1d8a4c824f4e81054ed92123b6ec5a3a7debc563f31c65f36744275abc0a205736aff68f3ff9a7d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
| MD5 | c6088b9fee2ec6b55e54d490fc712ccb |
| SHA1 | e7dd076ce9be0c5ca4022be054d6b5a98f96521e |
| SHA256 | 063634932f4aa66fadd262cbcd4b1b2be3efb6866326026477d198b30c59082f |
| SHA512 | 18936966fa08919e8397281bd86b30e4be5e56d6f23c4d5b1d8a4c824f4e81054ed92123b6ec5a3a7debc563f31c65f36744275abc0a205736aff68f3ff9a7d8 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
| MD5 | 2f0b994d01959ff8ba6dd26cbe5dad74 |
| SHA1 | 819a1fac87b499f033fd0192a68d3aec6be6e139 |
| SHA256 | b705d7e47c7d2d75540652f62ac46085621e0c95d7153e3bbb8c20b9ccf94a0c |
| SHA512 | 4e02f94679568de88d2396a998b26511cde0ae1868ebc63ccc67d3bed26acaac987d034cf9d879aa5c76d13417962a1524a43e809882b190fbf45a63bfc14d2b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
| MD5 | 2f0b994d01959ff8ba6dd26cbe5dad74 |
| SHA1 | 819a1fac87b499f033fd0192a68d3aec6be6e139 |
| SHA256 | b705d7e47c7d2d75540652f62ac46085621e0c95d7153e3bbb8c20b9ccf94a0c |
| SHA512 | 4e02f94679568de88d2396a998b26511cde0ae1868ebc63ccc67d3bed26acaac987d034cf9d879aa5c76d13417962a1524a43e809882b190fbf45a63bfc14d2b |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
| MD5 | 2f0b994d01959ff8ba6dd26cbe5dad74 |
| SHA1 | 819a1fac87b499f033fd0192a68d3aec6be6e139 |
| SHA256 | b705d7e47c7d2d75540652f62ac46085621e0c95d7153e3bbb8c20b9ccf94a0c |
| SHA512 | 4e02f94679568de88d2396a998b26511cde0ae1868ebc63ccc67d3bed26acaac987d034cf9d879aa5c76d13417962a1524a43e809882b190fbf45a63bfc14d2b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
| MD5 | 2f0b994d01959ff8ba6dd26cbe5dad74 |
| SHA1 | 819a1fac87b499f033fd0192a68d3aec6be6e139 |
| SHA256 | b705d7e47c7d2d75540652f62ac46085621e0c95d7153e3bbb8c20b9ccf94a0c |
| SHA512 | 4e02f94679568de88d2396a998b26511cde0ae1868ebc63ccc67d3bed26acaac987d034cf9d879aa5c76d13417962a1524a43e809882b190fbf45a63bfc14d2b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe
| MD5 | 1c7f92cfc91b63f7be2cf2d01a14c52f |
| SHA1 | ba59d1fba9d1750c3700cdf40193457511ea5695 |
| SHA256 | 394d9cda3c0b51ae273827590292b9ade56004fe06f395c6a293e632d9c1ef69 |
| SHA512 | 3151affdb3ff802a1da404bfb8e08667bfa5bdf13a5136a3c8876267270fb5704ef0d4d75a7a7ef44dbabef40268378d75a851524029db156894bd287ee94621 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe
| MD5 | 1c7f92cfc91b63f7be2cf2d01a14c52f |
| SHA1 | ba59d1fba9d1750c3700cdf40193457511ea5695 |
| SHA256 | 394d9cda3c0b51ae273827590292b9ade56004fe06f395c6a293e632d9c1ef69 |
| SHA512 | 3151affdb3ff802a1da404bfb8e08667bfa5bdf13a5136a3c8876267270fb5704ef0d4d75a7a7ef44dbabef40268378d75a851524029db156894bd287ee94621 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe
| MD5 | 1c7f92cfc91b63f7be2cf2d01a14c52f |
| SHA1 | ba59d1fba9d1750c3700cdf40193457511ea5695 |
| SHA256 | 394d9cda3c0b51ae273827590292b9ade56004fe06f395c6a293e632d9c1ef69 |
| SHA512 | 3151affdb3ff802a1da404bfb8e08667bfa5bdf13a5136a3c8876267270fb5704ef0d4d75a7a7ef44dbabef40268378d75a851524029db156894bd287ee94621 |
memory/2704-48-0x0000000000190000-0x000000000019A000-memory.dmp
memory/2704-49-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp
memory/2704-50-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp
memory/2704-51-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
memory/2512-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2512-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2512-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2512-69-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2512-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2512-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2512-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2512-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2512-72-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2512-74-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2512-75-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
memory/2512-80-0x0000000000400000-0x0000000000428000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:18
Reported
2023-10-10 20:22
Platform
win10v2004-20230915-en
Max time kernel
163s
Max time network
178s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1518243.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4200544.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\6b169f467f79113a5bb599bc4a3d72c839aabe7914cff07c81c9a78a497eefed.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2440 set thread context of 472 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 1564 set thread context of 1304 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1675017.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6b169f467f79113a5bb599bc4a3d72c839aabe7914cff07c81c9a78a497eefed.exe
"C:\Users\Admin\AppData\Local\Temp\6b169f467f79113a5bb599bc4a3d72c839aabe7914cff07c81c9a78a497eefed.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 472 -ip 472
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2440 -ip 2440
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 152
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 196
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1675017.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1675017.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1564 -ip 1564
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 156
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1518243.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1518243.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4200544.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4200544.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3058730.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3058730.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.1.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
| MD5 | c7b58e4478e7bf896876686a460abd52 |
| SHA1 | 0bfad0a0ccd5f161d7fcbd1f1b25ee68cbe6610a |
| SHA256 | fded8eb707dba7e1997720c5c12223e9c79aa749789d4cef562c1be0cbbc2c85 |
| SHA512 | 58ea779297c4eae59da41294fc00e5e9996855c5f124fc81f04fe37030d6e4959c9ee8f0981061e6965ac6bb1ed922413ecb3be861ffa8788664b7be48355f34 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8003247.exe
| MD5 | c7b58e4478e7bf896876686a460abd52 |
| SHA1 | 0bfad0a0ccd5f161d7fcbd1f1b25ee68cbe6610a |
| SHA256 | fded8eb707dba7e1997720c5c12223e9c79aa749789d4cef562c1be0cbbc2c85 |
| SHA512 | 58ea779297c4eae59da41294fc00e5e9996855c5f124fc81f04fe37030d6e4959c9ee8f0981061e6965ac6bb1ed922413ecb3be861ffa8788664b7be48355f34 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
| MD5 | f6a3a25231ae9c2248271dd9c1ac2c31 |
| SHA1 | fe8b38af6c4e9f77111c50974634fa4152948c80 |
| SHA256 | 22ae4bd62fe516fadf4932af4cffb2602b6ba7655fb7f0e420fa210fc7c406a3 |
| SHA512 | 490056521d0e40bd09f3b022a548ac1c003860bc474a078acd2f9a2f639c0fc64a68a3a8e105fd3f61f6e931ed04f03ef69d5fce250eaeb237f845c9b2bbed91 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7281518.exe
| MD5 | f6a3a25231ae9c2248271dd9c1ac2c31 |
| SHA1 | fe8b38af6c4e9f77111c50974634fa4152948c80 |
| SHA256 | 22ae4bd62fe516fadf4932af4cffb2602b6ba7655fb7f0e420fa210fc7c406a3 |
| SHA512 | 490056521d0e40bd09f3b022a548ac1c003860bc474a078acd2f9a2f639c0fc64a68a3a8e105fd3f61f6e931ed04f03ef69d5fce250eaeb237f845c9b2bbed91 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
| MD5 | c6088b9fee2ec6b55e54d490fc712ccb |
| SHA1 | e7dd076ce9be0c5ca4022be054d6b5a98f96521e |
| SHA256 | 063634932f4aa66fadd262cbcd4b1b2be3efb6866326026477d198b30c59082f |
| SHA512 | 18936966fa08919e8397281bd86b30e4be5e56d6f23c4d5b1d8a4c824f4e81054ed92123b6ec5a3a7debc563f31c65f36744275abc0a205736aff68f3ff9a7d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1280605.exe
| MD5 | c6088b9fee2ec6b55e54d490fc712ccb |
| SHA1 | e7dd076ce9be0c5ca4022be054d6b5a98f96521e |
| SHA256 | 063634932f4aa66fadd262cbcd4b1b2be3efb6866326026477d198b30c59082f |
| SHA512 | 18936966fa08919e8397281bd86b30e4be5e56d6f23c4d5b1d8a4c824f4e81054ed92123b6ec5a3a7debc563f31c65f36744275abc0a205736aff68f3ff9a7d8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
| MD5 | 2f0b994d01959ff8ba6dd26cbe5dad74 |
| SHA1 | 819a1fac87b499f033fd0192a68d3aec6be6e139 |
| SHA256 | b705d7e47c7d2d75540652f62ac46085621e0c95d7153e3bbb8c20b9ccf94a0c |
| SHA512 | 4e02f94679568de88d2396a998b26511cde0ae1868ebc63ccc67d3bed26acaac987d034cf9d879aa5c76d13417962a1524a43e809882b190fbf45a63bfc14d2b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1053686.exe
| MD5 | 2f0b994d01959ff8ba6dd26cbe5dad74 |
| SHA1 | 819a1fac87b499f033fd0192a68d3aec6be6e139 |
| SHA256 | b705d7e47c7d2d75540652f62ac46085621e0c95d7153e3bbb8c20b9ccf94a0c |
| SHA512 | 4e02f94679568de88d2396a998b26511cde0ae1868ebc63ccc67d3bed26acaac987d034cf9d879aa5c76d13417962a1524a43e809882b190fbf45a63bfc14d2b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe
| MD5 | 1c7f92cfc91b63f7be2cf2d01a14c52f |
| SHA1 | ba59d1fba9d1750c3700cdf40193457511ea5695 |
| SHA256 | 394d9cda3c0b51ae273827590292b9ade56004fe06f395c6a293e632d9c1ef69 |
| SHA512 | 3151affdb3ff802a1da404bfb8e08667bfa5bdf13a5136a3c8876267270fb5704ef0d4d75a7a7ef44dbabef40268378d75a851524029db156894bd287ee94621 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7247405.exe
| MD5 | 1c7f92cfc91b63f7be2cf2d01a14c52f |
| SHA1 | ba59d1fba9d1750c3700cdf40193457511ea5695 |
| SHA256 | 394d9cda3c0b51ae273827590292b9ade56004fe06f395c6a293e632d9c1ef69 |
| SHA512 | 3151affdb3ff802a1da404bfb8e08667bfa5bdf13a5136a3c8876267270fb5704ef0d4d75a7a7ef44dbabef40268378d75a851524029db156894bd287ee94621 |
memory/4064-35-0x0000000000240000-0x000000000024A000-memory.dmp
memory/4064-36-0x00007FFA8DD40000-0x00007FFA8E801000-memory.dmp
memory/4064-37-0x00007FFA8DD40000-0x00007FFA8E801000-memory.dmp
memory/4064-39-0x00007FFA8DD40000-0x00007FFA8E801000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3010869.exe
| MD5 | c3890912d8005586978a7d96a033ce44 |
| SHA1 | 60645433662de409e4891697782d9b039f0c2ba6 |
| SHA256 | 575fe852c39caba34297ba7876ede2fc49911785967a220a936d54bf56283de2 |
| SHA512 | 64bc4800c7f35c2cf25866cad39ee74776f115cdb8d85aaefe67fd2a9c4da3e9840fd1bd0b93a1191563e7f3e7f9ebffafd6b7b1e1c0949e7409361b0d3dc5fe |
memory/472-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/472-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/472-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/472-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1675017.exe
| MD5 | 887d3f82bb8f7c85843c981e81e21953 |
| SHA1 | 9c5c7e47e20601b685d7a2461c321b0593d6608e |
| SHA256 | 85ae1ceae831d3518ca37c2a2366767464875da1cdc2a46ca087c9063d72aa1d |
| SHA512 | 53328d3b1362c1fef478c4a446204bd8ad6680a2eb8b77c2b51c03b06c7522ccc5aabe6708baa9912d7291808d6f7572ef26d1fbf4f9e80814ab821b337bbb93 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1675017.exe
| MD5 | 887d3f82bb8f7c85843c981e81e21953 |
| SHA1 | 9c5c7e47e20601b685d7a2461c321b0593d6608e |
| SHA256 | 85ae1ceae831d3518ca37c2a2366767464875da1cdc2a46ca087c9063d72aa1d |
| SHA512 | 53328d3b1362c1fef478c4a446204bd8ad6680a2eb8b77c2b51c03b06c7522ccc5aabe6708baa9912d7291808d6f7572ef26d1fbf4f9e80814ab821b337bbb93 |
memory/1304-51-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1304-53-0x0000000074080000-0x0000000074830000-memory.dmp
memory/1304-52-0x0000000005330000-0x0000000005336000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1518243.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1518243.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/1304-60-0x0000000005AF0000-0x0000000006108000-memory.dmp
memory/1304-64-0x00000000055E0000-0x00000000056EA000-memory.dmp
memory/1304-66-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/1304-65-0x0000000005380000-0x0000000005392000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/1304-70-0x0000000005510000-0x000000000554C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4200544.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4200544.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/1304-76-0x0000000005550000-0x000000000559C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3058730.exe
| MD5 | 11cae75a862f8bd325cc41f36097cd75 |
| SHA1 | 6d8bc283bd6f478e267bf750a73cda9bece764a8 |
| SHA256 | 887bb29ef4e97af6f98afcda0f2608a16237bfd900b682856d1437bf0bd14ab8 |
| SHA512 | e0ea14c169fcd2c58d6ec25565a9603db550e7f2861f68ad295c13d1b4af81f0895f5288bda28504af87b938440c27866f457bf96a9f5d2865ec9e848b62cee5 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3058730.exe
| MD5 | 11cae75a862f8bd325cc41f36097cd75 |
| SHA1 | 6d8bc283bd6f478e267bf750a73cda9bece764a8 |
| SHA256 | 887bb29ef4e97af6f98afcda0f2608a16237bfd900b682856d1437bf0bd14ab8 |
| SHA512 | e0ea14c169fcd2c58d6ec25565a9603db550e7f2861f68ad295c13d1b4af81f0895f5288bda28504af87b938440c27866f457bf96a9f5d2865ec9e848b62cee5 |
memory/1304-87-0x0000000074080000-0x0000000074830000-memory.dmp
memory/1304-88-0x00000000053C0000-0x00000000053D0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |