Analysis Overview
SHA256
0913538d8b20385c7404ce9a727c4fd85a20afc0b6d2eb37352874ba776fd10e
Threat Level: Known bad
The file 0913538d8b20385c7404ce9a727c4fd85a20afc0b6d2eb37352874ba776fd10e was found to be: Known bad.
Malicious Activity Summary
Healer
Detects Healer an antivirus disabler dropper
Mystic
Modifies Windows Defender Real-time Protection settings
Detect Mystic stealer payload
Amadey
RedLine
Checks computer location settings
Executes dropped EXE
Windows security modification
Loads dropped DLL
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Program crash
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:22
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:22
Reported
2023-10-10 20:29
Platform
win7-20230831-en
Max time kernel
119s
Max time network
122s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\0913538d8b20385c7404ce9a727c4fd85a20afc0b6d2eb37352874ba776fd10e.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2052 set thread context of 2708 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0913538d8b20385c7404ce9a727c4fd85a20afc0b6d2eb37352874ba776fd10e.exe
"C:\Users\Admin\AppData\Local\Temp\0913538d8b20385c7404ce9a727c4fd85a20afc0b6d2eb37352874ba776fd10e.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 36
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
| MD5 | 7f93610f52714d00ecc4e1798b912cfd |
| SHA1 | e3e634337ca35ac041caf8a997451e1e6373d484 |
| SHA256 | 7a7ee864d30bdb3b8b7350a6ec82291d91b7d9cb776f5391f08e667c414821c7 |
| SHA512 | 024adc27e95741edbfa910020fd275a880ead32ba7dadf4e99be4168a0ebc85ee0378dc6ccfecd3a32134429ee3d786240fc1618f86ec54cd777bab25027608d |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
| MD5 | 7f93610f52714d00ecc4e1798b912cfd |
| SHA1 | e3e634337ca35ac041caf8a997451e1e6373d484 |
| SHA256 | 7a7ee864d30bdb3b8b7350a6ec82291d91b7d9cb776f5391f08e667c414821c7 |
| SHA512 | 024adc27e95741edbfa910020fd275a880ead32ba7dadf4e99be4168a0ebc85ee0378dc6ccfecd3a32134429ee3d786240fc1618f86ec54cd777bab25027608d |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
| MD5 | 7f93610f52714d00ecc4e1798b912cfd |
| SHA1 | e3e634337ca35ac041caf8a997451e1e6373d484 |
| SHA256 | 7a7ee864d30bdb3b8b7350a6ec82291d91b7d9cb776f5391f08e667c414821c7 |
| SHA512 | 024adc27e95741edbfa910020fd275a880ead32ba7dadf4e99be4168a0ebc85ee0378dc6ccfecd3a32134429ee3d786240fc1618f86ec54cd777bab25027608d |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
| MD5 | 7f93610f52714d00ecc4e1798b912cfd |
| SHA1 | e3e634337ca35ac041caf8a997451e1e6373d484 |
| SHA256 | 7a7ee864d30bdb3b8b7350a6ec82291d91b7d9cb776f5391f08e667c414821c7 |
| SHA512 | 024adc27e95741edbfa910020fd275a880ead32ba7dadf4e99be4168a0ebc85ee0378dc6ccfecd3a32134429ee3d786240fc1618f86ec54cd777bab25027608d |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
| MD5 | 04429e12de6263e986d4b54655a79a47 |
| SHA1 | dd03a5a442fcec5f2561335870ee1375ee8f850e |
| SHA256 | 0f5550f61380d1213e8e9dc12002aefdc6eac7ba241aaf7c802662be0b669002 |
| SHA512 | cbb75033193cce482db385eda98bf29cee67f0520adff75c302a6dc6b865fee13cbe3f52d8b475201fe7f678e5f5e3a83ab12795389cd16fcaecaa73a5266872 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
| MD5 | 04429e12de6263e986d4b54655a79a47 |
| SHA1 | dd03a5a442fcec5f2561335870ee1375ee8f850e |
| SHA256 | 0f5550f61380d1213e8e9dc12002aefdc6eac7ba241aaf7c802662be0b669002 |
| SHA512 | cbb75033193cce482db385eda98bf29cee67f0520adff75c302a6dc6b865fee13cbe3f52d8b475201fe7f678e5f5e3a83ab12795389cd16fcaecaa73a5266872 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
| MD5 | 04429e12de6263e986d4b54655a79a47 |
| SHA1 | dd03a5a442fcec5f2561335870ee1375ee8f850e |
| SHA256 | 0f5550f61380d1213e8e9dc12002aefdc6eac7ba241aaf7c802662be0b669002 |
| SHA512 | cbb75033193cce482db385eda98bf29cee67f0520adff75c302a6dc6b865fee13cbe3f52d8b475201fe7f678e5f5e3a83ab12795389cd16fcaecaa73a5266872 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
| MD5 | 04429e12de6263e986d4b54655a79a47 |
| SHA1 | dd03a5a442fcec5f2561335870ee1375ee8f850e |
| SHA256 | 0f5550f61380d1213e8e9dc12002aefdc6eac7ba241aaf7c802662be0b669002 |
| SHA512 | cbb75033193cce482db385eda98bf29cee67f0520adff75c302a6dc6b865fee13cbe3f52d8b475201fe7f678e5f5e3a83ab12795389cd16fcaecaa73a5266872 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
| MD5 | e01dddd3b7c09f326bf0414b1ad47608 |
| SHA1 | 45ac52bf915c798c37c3fc5ad4d359ab78a63d6b |
| SHA256 | 679cc51bf1578f98104cb460208e6469e5a6f666b04abb5ac9b72ad76f36dc19 |
| SHA512 | 6f94e51caacc04374a27284217dee4bcdf6b2530b3f2ccc75a5bf1a7c0f8586200a02838bd6b653d30cb194962743e61c687eaf3776beddb8323b3fe302097d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
| MD5 | e01dddd3b7c09f326bf0414b1ad47608 |
| SHA1 | 45ac52bf915c798c37c3fc5ad4d359ab78a63d6b |
| SHA256 | 679cc51bf1578f98104cb460208e6469e5a6f666b04abb5ac9b72ad76f36dc19 |
| SHA512 | 6f94e51caacc04374a27284217dee4bcdf6b2530b3f2ccc75a5bf1a7c0f8586200a02838bd6b653d30cb194962743e61c687eaf3776beddb8323b3fe302097d8 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
| MD5 | e01dddd3b7c09f326bf0414b1ad47608 |
| SHA1 | 45ac52bf915c798c37c3fc5ad4d359ab78a63d6b |
| SHA256 | 679cc51bf1578f98104cb460208e6469e5a6f666b04abb5ac9b72ad76f36dc19 |
| SHA512 | 6f94e51caacc04374a27284217dee4bcdf6b2530b3f2ccc75a5bf1a7c0f8586200a02838bd6b653d30cb194962743e61c687eaf3776beddb8323b3fe302097d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
| MD5 | e01dddd3b7c09f326bf0414b1ad47608 |
| SHA1 | 45ac52bf915c798c37c3fc5ad4d359ab78a63d6b |
| SHA256 | 679cc51bf1578f98104cb460208e6469e5a6f666b04abb5ac9b72ad76f36dc19 |
| SHA512 | 6f94e51caacc04374a27284217dee4bcdf6b2530b3f2ccc75a5bf1a7c0f8586200a02838bd6b653d30cb194962743e61c687eaf3776beddb8323b3fe302097d8 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
| MD5 | 4783da6aec5126b3b7cd1ed46126b82e |
| SHA1 | c5bb2e9b0e68d0617644877db47dd15ed57099da |
| SHA256 | 3c702cb760064c17d6a17da48b9dd4132b9f5870e7b6cfe4a24de9c27a849b49 |
| SHA512 | 96c2514737bb2b372f69e7d839ba2b1f4c3f1e4cf2a3842526769a4e6db5b400204e5d9b0f7db76434f5844ae94392392c2aaf7c65cb8b0687d80451238501cc |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
| MD5 | 4783da6aec5126b3b7cd1ed46126b82e |
| SHA1 | c5bb2e9b0e68d0617644877db47dd15ed57099da |
| SHA256 | 3c702cb760064c17d6a17da48b9dd4132b9f5870e7b6cfe4a24de9c27a849b49 |
| SHA512 | 96c2514737bb2b372f69e7d839ba2b1f4c3f1e4cf2a3842526769a4e6db5b400204e5d9b0f7db76434f5844ae94392392c2aaf7c65cb8b0687d80451238501cc |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
| MD5 | 4783da6aec5126b3b7cd1ed46126b82e |
| SHA1 | c5bb2e9b0e68d0617644877db47dd15ed57099da |
| SHA256 | 3c702cb760064c17d6a17da48b9dd4132b9f5870e7b6cfe4a24de9c27a849b49 |
| SHA512 | 96c2514737bb2b372f69e7d839ba2b1f4c3f1e4cf2a3842526769a4e6db5b400204e5d9b0f7db76434f5844ae94392392c2aaf7c65cb8b0687d80451238501cc |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
| MD5 | 4783da6aec5126b3b7cd1ed46126b82e |
| SHA1 | c5bb2e9b0e68d0617644877db47dd15ed57099da |
| SHA256 | 3c702cb760064c17d6a17da48b9dd4132b9f5870e7b6cfe4a24de9c27a849b49 |
| SHA512 | 96c2514737bb2b372f69e7d839ba2b1f4c3f1e4cf2a3842526769a4e6db5b400204e5d9b0f7db76434f5844ae94392392c2aaf7c65cb8b0687d80451238501cc |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe
| MD5 | b530de265c83d5fe298e29c97e106d63 |
| SHA1 | c895f9bb76f26056719c587e2e62e23751ef3bd0 |
| SHA256 | 3cefc7b492ac144052388b62f1491823b9559226fd315efa8486011907fc18f7 |
| SHA512 | 4c415590a9862fd6256998e986982d1e03590993349dd0eda21244acf950c143992aa6929747ab8ce82457513a65f54fda8b77434da54af28f603b464f7f1fe2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe
| MD5 | b530de265c83d5fe298e29c97e106d63 |
| SHA1 | c895f9bb76f26056719c587e2e62e23751ef3bd0 |
| SHA256 | 3cefc7b492ac144052388b62f1491823b9559226fd315efa8486011907fc18f7 |
| SHA512 | 4c415590a9862fd6256998e986982d1e03590993349dd0eda21244acf950c143992aa6929747ab8ce82457513a65f54fda8b77434da54af28f603b464f7f1fe2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe
| MD5 | b530de265c83d5fe298e29c97e106d63 |
| SHA1 | c895f9bb76f26056719c587e2e62e23751ef3bd0 |
| SHA256 | 3cefc7b492ac144052388b62f1491823b9559226fd315efa8486011907fc18f7 |
| SHA512 | 4c415590a9862fd6256998e986982d1e03590993349dd0eda21244acf950c143992aa6929747ab8ce82457513a65f54fda8b77434da54af28f603b464f7f1fe2 |
memory/2668-48-0x0000000000270000-0x000000000027A000-memory.dmp
memory/2668-49-0x000007FEF5600000-0x000007FEF5FEC000-memory.dmp
memory/2668-50-0x000007FEF5600000-0x000007FEF5FEC000-memory.dmp
memory/2668-51-0x000007FEF5600000-0x000007FEF5FEC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
memory/2708-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2708-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2708-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2708-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2708-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2708-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2708-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2708-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2708-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2708-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:22
Reported
2023-10-10 20:29
Platform
win10v2004-20230915-en
Max time kernel
142s
Max time network
166s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6537295.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5903745.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\0913538d8b20385c7404ce9a727c4fd85a20afc0b6d2eb37352874ba776fd10e.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1840 set thread context of 4588 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 5020 set thread context of 4052 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1842683.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0913538d8b20385c7404ce9a727c4fd85a20afc0b6d2eb37352874ba776fd10e.exe
"C:\Users\Admin\AppData\Local\Temp\0913538d8b20385c7404ce9a727c4fd85a20afc0b6d2eb37352874ba776fd10e.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1840 -ip 1840
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4588 -ip 4588
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 156
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1842683.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1842683.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5020 -ip 5020
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 140
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5903745.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5903745.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6537295.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6537295.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8755152.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8755152.exe
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.1.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.99.105.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.81.21.72.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 18.173.189.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
| MD5 | 7f93610f52714d00ecc4e1798b912cfd |
| SHA1 | e3e634337ca35ac041caf8a997451e1e6373d484 |
| SHA256 | 7a7ee864d30bdb3b8b7350a6ec82291d91b7d9cb776f5391f08e667c414821c7 |
| SHA512 | 024adc27e95741edbfa910020fd275a880ead32ba7dadf4e99be4168a0ebc85ee0378dc6ccfecd3a32134429ee3d786240fc1618f86ec54cd777bab25027608d |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2982742.exe
| MD5 | 7f93610f52714d00ecc4e1798b912cfd |
| SHA1 | e3e634337ca35ac041caf8a997451e1e6373d484 |
| SHA256 | 7a7ee864d30bdb3b8b7350a6ec82291d91b7d9cb776f5391f08e667c414821c7 |
| SHA512 | 024adc27e95741edbfa910020fd275a880ead32ba7dadf4e99be4168a0ebc85ee0378dc6ccfecd3a32134429ee3d786240fc1618f86ec54cd777bab25027608d |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
| MD5 | 04429e12de6263e986d4b54655a79a47 |
| SHA1 | dd03a5a442fcec5f2561335870ee1375ee8f850e |
| SHA256 | 0f5550f61380d1213e8e9dc12002aefdc6eac7ba241aaf7c802662be0b669002 |
| SHA512 | cbb75033193cce482db385eda98bf29cee67f0520adff75c302a6dc6b865fee13cbe3f52d8b475201fe7f678e5f5e3a83ab12795389cd16fcaecaa73a5266872 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6669333.exe
| MD5 | 04429e12de6263e986d4b54655a79a47 |
| SHA1 | dd03a5a442fcec5f2561335870ee1375ee8f850e |
| SHA256 | 0f5550f61380d1213e8e9dc12002aefdc6eac7ba241aaf7c802662be0b669002 |
| SHA512 | cbb75033193cce482db385eda98bf29cee67f0520adff75c302a6dc6b865fee13cbe3f52d8b475201fe7f678e5f5e3a83ab12795389cd16fcaecaa73a5266872 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
| MD5 | e01dddd3b7c09f326bf0414b1ad47608 |
| SHA1 | 45ac52bf915c798c37c3fc5ad4d359ab78a63d6b |
| SHA256 | 679cc51bf1578f98104cb460208e6469e5a6f666b04abb5ac9b72ad76f36dc19 |
| SHA512 | 6f94e51caacc04374a27284217dee4bcdf6b2530b3f2ccc75a5bf1a7c0f8586200a02838bd6b653d30cb194962743e61c687eaf3776beddb8323b3fe302097d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1144533.exe
| MD5 | e01dddd3b7c09f326bf0414b1ad47608 |
| SHA1 | 45ac52bf915c798c37c3fc5ad4d359ab78a63d6b |
| SHA256 | 679cc51bf1578f98104cb460208e6469e5a6f666b04abb5ac9b72ad76f36dc19 |
| SHA512 | 6f94e51caacc04374a27284217dee4bcdf6b2530b3f2ccc75a5bf1a7c0f8586200a02838bd6b653d30cb194962743e61c687eaf3776beddb8323b3fe302097d8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
| MD5 | 4783da6aec5126b3b7cd1ed46126b82e |
| SHA1 | c5bb2e9b0e68d0617644877db47dd15ed57099da |
| SHA256 | 3c702cb760064c17d6a17da48b9dd4132b9f5870e7b6cfe4a24de9c27a849b49 |
| SHA512 | 96c2514737bb2b372f69e7d839ba2b1f4c3f1e4cf2a3842526769a4e6db5b400204e5d9b0f7db76434f5844ae94392392c2aaf7c65cb8b0687d80451238501cc |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7395171.exe
| MD5 | 4783da6aec5126b3b7cd1ed46126b82e |
| SHA1 | c5bb2e9b0e68d0617644877db47dd15ed57099da |
| SHA256 | 3c702cb760064c17d6a17da48b9dd4132b9f5870e7b6cfe4a24de9c27a849b49 |
| SHA512 | 96c2514737bb2b372f69e7d839ba2b1f4c3f1e4cf2a3842526769a4e6db5b400204e5d9b0f7db76434f5844ae94392392c2aaf7c65cb8b0687d80451238501cc |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe
| MD5 | b530de265c83d5fe298e29c97e106d63 |
| SHA1 | c895f9bb76f26056719c587e2e62e23751ef3bd0 |
| SHA256 | 3cefc7b492ac144052388b62f1491823b9559226fd315efa8486011907fc18f7 |
| SHA512 | 4c415590a9862fd6256998e986982d1e03590993349dd0eda21244acf950c143992aa6929747ab8ce82457513a65f54fda8b77434da54af28f603b464f7f1fe2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9560689.exe
| MD5 | b530de265c83d5fe298e29c97e106d63 |
| SHA1 | c895f9bb76f26056719c587e2e62e23751ef3bd0 |
| SHA256 | 3cefc7b492ac144052388b62f1491823b9559226fd315efa8486011907fc18f7 |
| SHA512 | 4c415590a9862fd6256998e986982d1e03590993349dd0eda21244acf950c143992aa6929747ab8ce82457513a65f54fda8b77434da54af28f603b464f7f1fe2 |
memory/3908-35-0x0000000000FB0000-0x0000000000FBA000-memory.dmp
memory/3908-36-0x00007FFCBEE60000-0x00007FFCBF921000-memory.dmp
memory/3908-37-0x00007FFCBEE60000-0x00007FFCBF921000-memory.dmp
memory/3908-39-0x00007FFCBEE60000-0x00007FFCBF921000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9836469.exe
| MD5 | 4f320dee9a1767599011977ea0a5da93 |
| SHA1 | 87d0b38ebe6af1289745bb59c2595f613bc3487d |
| SHA256 | f3f8f4535c9480681461b8332cc7735eb8a43b3509558bf35fe25520a13cf6bf |
| SHA512 | 316273207a45f67e06633e0f2e35bd852f77c79c2e4385a49d9d735103eaf64f18821780447f3c4bffcccc6b6a5f382c84e281b437459acb936639f157de2356 |
memory/4588-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4588-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4588-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4588-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1842683.exe
| MD5 | f8690187a61dfc3cc74ba1ef55cc2767 |
| SHA1 | c46e4826604bc234ced21f830c037ab3749784d3 |
| SHA256 | d54425e0517705789681eb82ad1c7f90b2a1f6e9ac2b927c594270053271bfe6 |
| SHA512 | 597dfdfb02d9984be783fd0e84849c8ab533ce6a31c263ebfd35ff6f2a7eb17b495cfe4640b19e68ccd75d1a05df7d4d181815faf4491eb0e6184e592c4fa0b8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1842683.exe
| MD5 | f8690187a61dfc3cc74ba1ef55cc2767 |
| SHA1 | c46e4826604bc234ced21f830c037ab3749784d3 |
| SHA256 | d54425e0517705789681eb82ad1c7f90b2a1f6e9ac2b927c594270053271bfe6 |
| SHA512 | 597dfdfb02d9984be783fd0e84849c8ab533ce6a31c263ebfd35ff6f2a7eb17b495cfe4640b19e68ccd75d1a05df7d4d181815faf4491eb0e6184e592c4fa0b8 |
memory/4052-51-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4052-52-0x0000000073E80000-0x0000000074630000-memory.dmp
memory/4052-53-0x0000000000FB0000-0x0000000000FB6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5903745.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5903745.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/4052-59-0x0000000005170000-0x0000000005788000-memory.dmp
memory/4052-61-0x0000000004C60000-0x0000000004D6A000-memory.dmp
memory/4052-66-0x0000000004B40000-0x0000000004B50000-memory.dmp
memory/4052-65-0x0000000004B00000-0x0000000004B12000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/4052-70-0x0000000004B90000-0x0000000004BCC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6537295.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6537295.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/4052-80-0x0000000004BD0000-0x0000000004C1C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8755152.exe
| MD5 | 3c37a8b23e40bde543a074543afbee3f |
| SHA1 | 5fec943ca927e56ca027d352b1b0c5241c4daa0a |
| SHA256 | 6469f65ba543b45617d5f686986a6b662b3803a8708973fd051df3cdff0c3dba |
| SHA512 | 17a40b67cc9e4d36dcdc7d17a2f9cda0d2b734195ceb9a54ca954876789aef6e9f394387ca7bad4da297a3292845954987fb64d49c13da1697385d847f790860 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8755152.exe
| MD5 | 3c37a8b23e40bde543a074543afbee3f |
| SHA1 | 5fec943ca927e56ca027d352b1b0c5241c4daa0a |
| SHA256 | 6469f65ba543b45617d5f686986a6b662b3803a8708973fd051df3cdff0c3dba |
| SHA512 | 17a40b67cc9e4d36dcdc7d17a2f9cda0d2b734195ceb9a54ca954876789aef6e9f394387ca7bad4da297a3292845954987fb64d49c13da1697385d847f790860 |
memory/4052-87-0x0000000073E80000-0x0000000074630000-memory.dmp
memory/4052-88-0x0000000004B40000-0x0000000004B50000-memory.dmp
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |