Analysis Overview
SHA256
6cced2d0864c147675f604a6472c03cb1a94651e04162e4ab34b8b4346cab0d9
Threat Level: Known bad
The file 6cced2d0864c147675f604a6472c03cb1a94651e04162e4ab34b8b4346cab0d9 was found to be: Known bad.
Malicious Activity Summary
Detect Mystic stealer payload
Modifies Windows Defender Real-time Protection settings
Amadey
Healer
Detects Healer an antivirus disabler dropper
Mystic
RedLine
Windows security modification
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Program crash
Unsigned PE
Enumerates physical storage devices
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:21
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:21
Reported
2023-10-10 20:28
Platform
win7-20230831-en
Max time kernel
121s
Max time network
127s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\6cced2d0864c147675f604a6472c03cb1a94651e04162e4ab34b8b4346cab0d9.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2468 set thread context of 1956 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6cced2d0864c147675f604a6472c03cb1a94651e04162e4ab34b8b4346cab0d9.exe
"C:\Users\Admin\AppData\Local\Temp\6cced2d0864c147675f604a6472c03cb1a94651e04162e4ab34b8b4346cab0d9.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 292
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
| MD5 | 22581ca7f2b8b6e53bc77817e7d41ecb |
| SHA1 | 6b733672c038e8b190b9ef3198453884d3dbd894 |
| SHA256 | da34664226ba6d1b9ab0d8988a39d9d6f5ea09010c0a61716c481d9fa723ad57 |
| SHA512 | ac7429d52043c29f62a160a4f3008195185405b1bf0cf2ddcda97c79b0c4d07fa36b83758957d74c97e9f79d4260290bcb266b5a39e957866c188c184e2f03b8 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
| MD5 | 22581ca7f2b8b6e53bc77817e7d41ecb |
| SHA1 | 6b733672c038e8b190b9ef3198453884d3dbd894 |
| SHA256 | da34664226ba6d1b9ab0d8988a39d9d6f5ea09010c0a61716c481d9fa723ad57 |
| SHA512 | ac7429d52043c29f62a160a4f3008195185405b1bf0cf2ddcda97c79b0c4d07fa36b83758957d74c97e9f79d4260290bcb266b5a39e957866c188c184e2f03b8 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
| MD5 | 22581ca7f2b8b6e53bc77817e7d41ecb |
| SHA1 | 6b733672c038e8b190b9ef3198453884d3dbd894 |
| SHA256 | da34664226ba6d1b9ab0d8988a39d9d6f5ea09010c0a61716c481d9fa723ad57 |
| SHA512 | ac7429d52043c29f62a160a4f3008195185405b1bf0cf2ddcda97c79b0c4d07fa36b83758957d74c97e9f79d4260290bcb266b5a39e957866c188c184e2f03b8 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
| MD5 | 22581ca7f2b8b6e53bc77817e7d41ecb |
| SHA1 | 6b733672c038e8b190b9ef3198453884d3dbd894 |
| SHA256 | da34664226ba6d1b9ab0d8988a39d9d6f5ea09010c0a61716c481d9fa723ad57 |
| SHA512 | ac7429d52043c29f62a160a4f3008195185405b1bf0cf2ddcda97c79b0c4d07fa36b83758957d74c97e9f79d4260290bcb266b5a39e957866c188c184e2f03b8 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
| MD5 | 97dadd9195fd8cb5247d60825bcaf47b |
| SHA1 | fe74aae6f95c5d5a2b2830c5710ec2a172f73447 |
| SHA256 | b1d16c09a226686051aec64e7904411baa85a6cc8db23e3978de3ec87b394e95 |
| SHA512 | eff1c9fa4af4458d27a03dbe68d4f9d18470fe21c5664f7604a15721d4c71c0b2a1fb3cacac3e54cc847100052c23ba640307b2448d449163875f5cf75603d9e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
| MD5 | 97dadd9195fd8cb5247d60825bcaf47b |
| SHA1 | fe74aae6f95c5d5a2b2830c5710ec2a172f73447 |
| SHA256 | b1d16c09a226686051aec64e7904411baa85a6cc8db23e3978de3ec87b394e95 |
| SHA512 | eff1c9fa4af4458d27a03dbe68d4f9d18470fe21c5664f7604a15721d4c71c0b2a1fb3cacac3e54cc847100052c23ba640307b2448d449163875f5cf75603d9e |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
| MD5 | 97dadd9195fd8cb5247d60825bcaf47b |
| SHA1 | fe74aae6f95c5d5a2b2830c5710ec2a172f73447 |
| SHA256 | b1d16c09a226686051aec64e7904411baa85a6cc8db23e3978de3ec87b394e95 |
| SHA512 | eff1c9fa4af4458d27a03dbe68d4f9d18470fe21c5664f7604a15721d4c71c0b2a1fb3cacac3e54cc847100052c23ba640307b2448d449163875f5cf75603d9e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
| MD5 | 97dadd9195fd8cb5247d60825bcaf47b |
| SHA1 | fe74aae6f95c5d5a2b2830c5710ec2a172f73447 |
| SHA256 | b1d16c09a226686051aec64e7904411baa85a6cc8db23e3978de3ec87b394e95 |
| SHA512 | eff1c9fa4af4458d27a03dbe68d4f9d18470fe21c5664f7604a15721d4c71c0b2a1fb3cacac3e54cc847100052c23ba640307b2448d449163875f5cf75603d9e |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
| MD5 | fe6b00397a69789dace341553ab5b7dc |
| SHA1 | ac42567e851d22c3766a85d83f6a2cb59d4d364a |
| SHA256 | 2294b60339f4879233d918368c8939d510ba6cf250e2477ec30dc59a20d8232e |
| SHA512 | d33e7cef04ff54cbcb949fca20c07a46cfc1e09a39a01d18da1034ccac08cf2afd7e0799f7dfb201063cac7c2e54aea12dccbc834a1d14472c8b4d4fea94eb70 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
| MD5 | fe6b00397a69789dace341553ab5b7dc |
| SHA1 | ac42567e851d22c3766a85d83f6a2cb59d4d364a |
| SHA256 | 2294b60339f4879233d918368c8939d510ba6cf250e2477ec30dc59a20d8232e |
| SHA512 | d33e7cef04ff54cbcb949fca20c07a46cfc1e09a39a01d18da1034ccac08cf2afd7e0799f7dfb201063cac7c2e54aea12dccbc834a1d14472c8b4d4fea94eb70 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
| MD5 | fe6b00397a69789dace341553ab5b7dc |
| SHA1 | ac42567e851d22c3766a85d83f6a2cb59d4d364a |
| SHA256 | 2294b60339f4879233d918368c8939d510ba6cf250e2477ec30dc59a20d8232e |
| SHA512 | d33e7cef04ff54cbcb949fca20c07a46cfc1e09a39a01d18da1034ccac08cf2afd7e0799f7dfb201063cac7c2e54aea12dccbc834a1d14472c8b4d4fea94eb70 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
| MD5 | fe6b00397a69789dace341553ab5b7dc |
| SHA1 | ac42567e851d22c3766a85d83f6a2cb59d4d364a |
| SHA256 | 2294b60339f4879233d918368c8939d510ba6cf250e2477ec30dc59a20d8232e |
| SHA512 | d33e7cef04ff54cbcb949fca20c07a46cfc1e09a39a01d18da1034ccac08cf2afd7e0799f7dfb201063cac7c2e54aea12dccbc834a1d14472c8b4d4fea94eb70 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
| MD5 | c2958eafbd1df34e363aac64872d3767 |
| SHA1 | c38ed42ec3e481b61f93148701ec1cf15b1e2ead |
| SHA256 | 76f8cfab37c732615ae71a4f9c1ddf1092f2545ab426819a71cfb558b09c7827 |
| SHA512 | 42657f261fd0de09d273beb6b595e77f70fda71d1ad53c3d5f0fe2ecc74fd3dbbc6616552e26a7e2cb39158d1f0ebd3b04f960a2250c597abd4cbb54dc8e1798 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
| MD5 | c2958eafbd1df34e363aac64872d3767 |
| SHA1 | c38ed42ec3e481b61f93148701ec1cf15b1e2ead |
| SHA256 | 76f8cfab37c732615ae71a4f9c1ddf1092f2545ab426819a71cfb558b09c7827 |
| SHA512 | 42657f261fd0de09d273beb6b595e77f70fda71d1ad53c3d5f0fe2ecc74fd3dbbc6616552e26a7e2cb39158d1f0ebd3b04f960a2250c597abd4cbb54dc8e1798 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
| MD5 | c2958eafbd1df34e363aac64872d3767 |
| SHA1 | c38ed42ec3e481b61f93148701ec1cf15b1e2ead |
| SHA256 | 76f8cfab37c732615ae71a4f9c1ddf1092f2545ab426819a71cfb558b09c7827 |
| SHA512 | 42657f261fd0de09d273beb6b595e77f70fda71d1ad53c3d5f0fe2ecc74fd3dbbc6616552e26a7e2cb39158d1f0ebd3b04f960a2250c597abd4cbb54dc8e1798 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
| MD5 | c2958eafbd1df34e363aac64872d3767 |
| SHA1 | c38ed42ec3e481b61f93148701ec1cf15b1e2ead |
| SHA256 | 76f8cfab37c732615ae71a4f9c1ddf1092f2545ab426819a71cfb558b09c7827 |
| SHA512 | 42657f261fd0de09d273beb6b595e77f70fda71d1ad53c3d5f0fe2ecc74fd3dbbc6616552e26a7e2cb39158d1f0ebd3b04f960a2250c597abd4cbb54dc8e1798 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe
| MD5 | 23f943f98b2eef1d8427ba90111c34e2 |
| SHA1 | 47be76d126057e63dd8c9be3f7eac252a86a9b53 |
| SHA256 | 76ee34b15e8f7d1a38ba5d8221ac5144bc624a7253195afee8e83d93c68de6d5 |
| SHA512 | 32ea29df413fdc8f630212957a8e4fd91575a9431da4750758b156ec013f6c5c700feca8271aee81fb5dc6ef12ea4578f107781149563be2988a28a2feb9d811 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe
| MD5 | 23f943f98b2eef1d8427ba90111c34e2 |
| SHA1 | 47be76d126057e63dd8c9be3f7eac252a86a9b53 |
| SHA256 | 76ee34b15e8f7d1a38ba5d8221ac5144bc624a7253195afee8e83d93c68de6d5 |
| SHA512 | 32ea29df413fdc8f630212957a8e4fd91575a9431da4750758b156ec013f6c5c700feca8271aee81fb5dc6ef12ea4578f107781149563be2988a28a2feb9d811 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe
| MD5 | 23f943f98b2eef1d8427ba90111c34e2 |
| SHA1 | 47be76d126057e63dd8c9be3f7eac252a86a9b53 |
| SHA256 | 76ee34b15e8f7d1a38ba5d8221ac5144bc624a7253195afee8e83d93c68de6d5 |
| SHA512 | 32ea29df413fdc8f630212957a8e4fd91575a9431da4750758b156ec013f6c5c700feca8271aee81fb5dc6ef12ea4578f107781149563be2988a28a2feb9d811 |
memory/3000-48-0x00000000000C0000-0x00000000000CA000-memory.dmp
memory/3000-49-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp
memory/3000-50-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp
memory/3000-51-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
memory/1956-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1956-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1956-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1956-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1956-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1956-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1956-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/1956-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1956-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1956-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:21
Reported
2023-10-10 20:28
Platform
win10v2004-20230915-en
Max time kernel
125s
Max time network
146s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1867194.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3034390.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\6cced2d0864c147675f604a6472c03cb1a94651e04162e4ab34b8b4346cab0d9.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2652 set thread context of 1044 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3368 set thread context of 3780 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4836612.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6cced2d0864c147675f604a6472c03cb1a94651e04162e4ab34b8b4346cab0d9.exe
"C:\Users\Admin\AppData\Local\Temp\6cced2d0864c147675f604a6472c03cb1a94651e04162e4ab34b8b4346cab0d9.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1044 -ip 1044
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2652 -ip 2652
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 152
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4836612.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4836612.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3368 -ip 3368
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 156
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1867194.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1867194.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3034390.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3034390.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2792161.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2792161.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.1.85.104.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.173.189.20.in-addr.arpa | udp |
| US | 13.107.21.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
| MD5 | 22581ca7f2b8b6e53bc77817e7d41ecb |
| SHA1 | 6b733672c038e8b190b9ef3198453884d3dbd894 |
| SHA256 | da34664226ba6d1b9ab0d8988a39d9d6f5ea09010c0a61716c481d9fa723ad57 |
| SHA512 | ac7429d52043c29f62a160a4f3008195185405b1bf0cf2ddcda97c79b0c4d07fa36b83758957d74c97e9f79d4260290bcb266b5a39e957866c188c184e2f03b8 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1413441.exe
| MD5 | 22581ca7f2b8b6e53bc77817e7d41ecb |
| SHA1 | 6b733672c038e8b190b9ef3198453884d3dbd894 |
| SHA256 | da34664226ba6d1b9ab0d8988a39d9d6f5ea09010c0a61716c481d9fa723ad57 |
| SHA512 | ac7429d52043c29f62a160a4f3008195185405b1bf0cf2ddcda97c79b0c4d07fa36b83758957d74c97e9f79d4260290bcb266b5a39e957866c188c184e2f03b8 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
| MD5 | 97dadd9195fd8cb5247d60825bcaf47b |
| SHA1 | fe74aae6f95c5d5a2b2830c5710ec2a172f73447 |
| SHA256 | b1d16c09a226686051aec64e7904411baa85a6cc8db23e3978de3ec87b394e95 |
| SHA512 | eff1c9fa4af4458d27a03dbe68d4f9d18470fe21c5664f7604a15721d4c71c0b2a1fb3cacac3e54cc847100052c23ba640307b2448d449163875f5cf75603d9e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0061231.exe
| MD5 | 97dadd9195fd8cb5247d60825bcaf47b |
| SHA1 | fe74aae6f95c5d5a2b2830c5710ec2a172f73447 |
| SHA256 | b1d16c09a226686051aec64e7904411baa85a6cc8db23e3978de3ec87b394e95 |
| SHA512 | eff1c9fa4af4458d27a03dbe68d4f9d18470fe21c5664f7604a15721d4c71c0b2a1fb3cacac3e54cc847100052c23ba640307b2448d449163875f5cf75603d9e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
| MD5 | fe6b00397a69789dace341553ab5b7dc |
| SHA1 | ac42567e851d22c3766a85d83f6a2cb59d4d364a |
| SHA256 | 2294b60339f4879233d918368c8939d510ba6cf250e2477ec30dc59a20d8232e |
| SHA512 | d33e7cef04ff54cbcb949fca20c07a46cfc1e09a39a01d18da1034ccac08cf2afd7e0799f7dfb201063cac7c2e54aea12dccbc834a1d14472c8b4d4fea94eb70 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0550209.exe
| MD5 | fe6b00397a69789dace341553ab5b7dc |
| SHA1 | ac42567e851d22c3766a85d83f6a2cb59d4d364a |
| SHA256 | 2294b60339f4879233d918368c8939d510ba6cf250e2477ec30dc59a20d8232e |
| SHA512 | d33e7cef04ff54cbcb949fca20c07a46cfc1e09a39a01d18da1034ccac08cf2afd7e0799f7dfb201063cac7c2e54aea12dccbc834a1d14472c8b4d4fea94eb70 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
| MD5 | c2958eafbd1df34e363aac64872d3767 |
| SHA1 | c38ed42ec3e481b61f93148701ec1cf15b1e2ead |
| SHA256 | 76f8cfab37c732615ae71a4f9c1ddf1092f2545ab426819a71cfb558b09c7827 |
| SHA512 | 42657f261fd0de09d273beb6b595e77f70fda71d1ad53c3d5f0fe2ecc74fd3dbbc6616552e26a7e2cb39158d1f0ebd3b04f960a2250c597abd4cbb54dc8e1798 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4836988.exe
| MD5 | c2958eafbd1df34e363aac64872d3767 |
| SHA1 | c38ed42ec3e481b61f93148701ec1cf15b1e2ead |
| SHA256 | 76f8cfab37c732615ae71a4f9c1ddf1092f2545ab426819a71cfb558b09c7827 |
| SHA512 | 42657f261fd0de09d273beb6b595e77f70fda71d1ad53c3d5f0fe2ecc74fd3dbbc6616552e26a7e2cb39158d1f0ebd3b04f960a2250c597abd4cbb54dc8e1798 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe
| MD5 | 23f943f98b2eef1d8427ba90111c34e2 |
| SHA1 | 47be76d126057e63dd8c9be3f7eac252a86a9b53 |
| SHA256 | 76ee34b15e8f7d1a38ba5d8221ac5144bc624a7253195afee8e83d93c68de6d5 |
| SHA512 | 32ea29df413fdc8f630212957a8e4fd91575a9431da4750758b156ec013f6c5c700feca8271aee81fb5dc6ef12ea4578f107781149563be2988a28a2feb9d811 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0974317.exe
| MD5 | 23f943f98b2eef1d8427ba90111c34e2 |
| SHA1 | 47be76d126057e63dd8c9be3f7eac252a86a9b53 |
| SHA256 | 76ee34b15e8f7d1a38ba5d8221ac5144bc624a7253195afee8e83d93c68de6d5 |
| SHA512 | 32ea29df413fdc8f630212957a8e4fd91575a9431da4750758b156ec013f6c5c700feca8271aee81fb5dc6ef12ea4578f107781149563be2988a28a2feb9d811 |
memory/3044-35-0x0000000000150000-0x000000000015A000-memory.dmp
memory/3044-36-0x00007FFAFFCD0000-0x00007FFB00791000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
memory/3044-40-0x00007FFAFFCD0000-0x00007FFB00791000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5175735.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
memory/1044-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-46-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4836612.exe
| MD5 | e45fe91e278bc458780590e92e48b946 |
| SHA1 | cc403560084a954abf1e2baa809ed238bf151e40 |
| SHA256 | ebc3b453a3e692409dd422a396f72860c9d8a85634ed90aa300dd84fed932b86 |
| SHA512 | dfa9f4306f34e85580b6c196783e1971e7f14763afa13ff2d1ef2c76685f814e601869d4cca26cc86bbaf1234ebd9e08ff3baaf104dde4f87aa3906853d7058e |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4836612.exe
| MD5 | e45fe91e278bc458780590e92e48b946 |
| SHA1 | cc403560084a954abf1e2baa809ed238bf151e40 |
| SHA256 | ebc3b453a3e692409dd422a396f72860c9d8a85634ed90aa300dd84fed932b86 |
| SHA512 | dfa9f4306f34e85580b6c196783e1971e7f14763afa13ff2d1ef2c76685f814e601869d4cca26cc86bbaf1234ebd9e08ff3baaf104dde4f87aa3906853d7058e |
memory/3780-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3780-51-0x0000000073A20000-0x00000000741D0000-memory.dmp
memory/3780-52-0x0000000004FD0000-0x0000000004FD6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1867194.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1867194.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/3780-59-0x0000000005630000-0x0000000005C48000-memory.dmp
memory/3780-63-0x0000000005120000-0x000000000522A000-memory.dmp
memory/3780-64-0x0000000005030000-0x0000000005042000-memory.dmp
memory/3780-65-0x0000000005000000-0x0000000005010000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/3780-69-0x0000000005090000-0x00000000050CC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3034390.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3034390.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2792161.exe
| MD5 | 78e149e9bf92103bb27b7d5ce5b02181 |
| SHA1 | b2f93a9d353ca8129eac9737b258e92eb768ba72 |
| SHA256 | bb1088ac837cd88d4a049aa5c2cb5128d80f53b4ed729e8c6e1ff3a51d310c83 |
| SHA512 | 75b99cb4a6def4f763237c34a37e3c8678e3fd38bcc1cf9ff43e3c1cef5d966c69e454ec6b6e689ebe7321a1e4c37b5299542603b37311d934ab502e7b829db4 |
memory/3780-84-0x0000000005230000-0x000000000527C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2792161.exe
| MD5 | 78e149e9bf92103bb27b7d5ce5b02181 |
| SHA1 | b2f93a9d353ca8129eac9737b258e92eb768ba72 |
| SHA256 | bb1088ac837cd88d4a049aa5c2cb5128d80f53b4ed729e8c6e1ff3a51d310c83 |
| SHA512 | 75b99cb4a6def4f763237c34a37e3c8678e3fd38bcc1cf9ff43e3c1cef5d966c69e454ec6b6e689ebe7321a1e4c37b5299542603b37311d934ab502e7b829db4 |
memory/3780-86-0x0000000073A20000-0x00000000741D0000-memory.dmp
memory/3780-87-0x0000000005000000-0x0000000005010000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |