Analysis Overview
SHA256
f9e027623d3ed4e189050ddf9af760f52dada3db5daf0a45a3da0445b485d9cf
Threat Level: Known bad
The file f9e027623d3ed4e189050ddf9af760f52dada3db5daf0a45a3da0445b485d9cf was found to be: Known bad.
Malicious Activity Summary
RedLine
Detect Mystic stealer payload
Detects Healer an antivirus disabler dropper
Modifies Windows Defender Real-time Protection settings
Amadey
Mystic
Healer
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Windows security modification
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Program crash
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:27
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:27
Reported
2023-10-10 20:37
Platform
win7-20230831-en
Max time kernel
120s
Max time network
126s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\f9e027623d3ed4e189050ddf9af760f52dada3db5daf0a45a3da0445b485d9cf.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2684 set thread context of 2584 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\f9e027623d3ed4e189050ddf9af760f52dada3db5daf0a45a3da0445b485d9cf.exe
"C:\Users\Admin\AppData\Local\Temp\f9e027623d3ed4e189050ddf9af760f52dada3db5daf0a45a3da0445b485d9cf.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 36
Network
| Country | Destination | Domain | Proto |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
| MD5 | 16d26320e2faef738bb1d1c0c430bd9e |
| SHA1 | 6600bd6acad7e51ff2241d87955edca6e6e120d7 |
| SHA256 | 8f431777eefe750af2a6be302161328ae4c7e22711b04885b3d661a06ff117c4 |
| SHA512 | c2b990d22f01b1a635f4f6e579e67d230002fdef8ad29190dd2ad14cc6ce4b092ee77b2f0ac8487e2602bfd8cdb3c0115e80a15047c67e1e442dcbf447e65491 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
| MD5 | 16d26320e2faef738bb1d1c0c430bd9e |
| SHA1 | 6600bd6acad7e51ff2241d87955edca6e6e120d7 |
| SHA256 | 8f431777eefe750af2a6be302161328ae4c7e22711b04885b3d661a06ff117c4 |
| SHA512 | c2b990d22f01b1a635f4f6e579e67d230002fdef8ad29190dd2ad14cc6ce4b092ee77b2f0ac8487e2602bfd8cdb3c0115e80a15047c67e1e442dcbf447e65491 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
| MD5 | 16d26320e2faef738bb1d1c0c430bd9e |
| SHA1 | 6600bd6acad7e51ff2241d87955edca6e6e120d7 |
| SHA256 | 8f431777eefe750af2a6be302161328ae4c7e22711b04885b3d661a06ff117c4 |
| SHA512 | c2b990d22f01b1a635f4f6e579e67d230002fdef8ad29190dd2ad14cc6ce4b092ee77b2f0ac8487e2602bfd8cdb3c0115e80a15047c67e1e442dcbf447e65491 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
| MD5 | 16d26320e2faef738bb1d1c0c430bd9e |
| SHA1 | 6600bd6acad7e51ff2241d87955edca6e6e120d7 |
| SHA256 | 8f431777eefe750af2a6be302161328ae4c7e22711b04885b3d661a06ff117c4 |
| SHA512 | c2b990d22f01b1a635f4f6e579e67d230002fdef8ad29190dd2ad14cc6ce4b092ee77b2f0ac8487e2602bfd8cdb3c0115e80a15047c67e1e442dcbf447e65491 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
| MD5 | 1b681f321fd726e6818121ee9e3e9093 |
| SHA1 | 90630b28703bd4238d8424fe1e31520d5eea724f |
| SHA256 | f3cdc58db95cb5856fb028e9e49a5ca0287490ce23c927c76a12321e41f4afb8 |
| SHA512 | 7d0f6de7621d56de456a47a1d3a410b880eaeaa42a3974f748aa4874b9a3a5b16a8a84b448b120e87c1244eeabb9198bf8fb46f3130b1cf592708a0d38535906 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
| MD5 | 1b681f321fd726e6818121ee9e3e9093 |
| SHA1 | 90630b28703bd4238d8424fe1e31520d5eea724f |
| SHA256 | f3cdc58db95cb5856fb028e9e49a5ca0287490ce23c927c76a12321e41f4afb8 |
| SHA512 | 7d0f6de7621d56de456a47a1d3a410b880eaeaa42a3974f748aa4874b9a3a5b16a8a84b448b120e87c1244eeabb9198bf8fb46f3130b1cf592708a0d38535906 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
| MD5 | 1b681f321fd726e6818121ee9e3e9093 |
| SHA1 | 90630b28703bd4238d8424fe1e31520d5eea724f |
| SHA256 | f3cdc58db95cb5856fb028e9e49a5ca0287490ce23c927c76a12321e41f4afb8 |
| SHA512 | 7d0f6de7621d56de456a47a1d3a410b880eaeaa42a3974f748aa4874b9a3a5b16a8a84b448b120e87c1244eeabb9198bf8fb46f3130b1cf592708a0d38535906 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
| MD5 | 1b681f321fd726e6818121ee9e3e9093 |
| SHA1 | 90630b28703bd4238d8424fe1e31520d5eea724f |
| SHA256 | f3cdc58db95cb5856fb028e9e49a5ca0287490ce23c927c76a12321e41f4afb8 |
| SHA512 | 7d0f6de7621d56de456a47a1d3a410b880eaeaa42a3974f748aa4874b9a3a5b16a8a84b448b120e87c1244eeabb9198bf8fb46f3130b1cf592708a0d38535906 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
| MD5 | f351d21c8c3f7042f45fb6d121a8ca80 |
| SHA1 | 5a7849305bc6075ca581b0efc6392b677ab598b6 |
| SHA256 | a49c1be0693620359d12b3477649760ad6dffba6fda904295690d64659e80817 |
| SHA512 | 50663995dfa2f28aa1d9fd78d7b17b89d4efb0a992f17cc8527717f5b2aadce0c773a7b74ba7bb00799eece67c4549089a9ecc8abfa3b1574356a030c815ab56 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
| MD5 | f351d21c8c3f7042f45fb6d121a8ca80 |
| SHA1 | 5a7849305bc6075ca581b0efc6392b677ab598b6 |
| SHA256 | a49c1be0693620359d12b3477649760ad6dffba6fda904295690d64659e80817 |
| SHA512 | 50663995dfa2f28aa1d9fd78d7b17b89d4efb0a992f17cc8527717f5b2aadce0c773a7b74ba7bb00799eece67c4549089a9ecc8abfa3b1574356a030c815ab56 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
| MD5 | f351d21c8c3f7042f45fb6d121a8ca80 |
| SHA1 | 5a7849305bc6075ca581b0efc6392b677ab598b6 |
| SHA256 | a49c1be0693620359d12b3477649760ad6dffba6fda904295690d64659e80817 |
| SHA512 | 50663995dfa2f28aa1d9fd78d7b17b89d4efb0a992f17cc8527717f5b2aadce0c773a7b74ba7bb00799eece67c4549089a9ecc8abfa3b1574356a030c815ab56 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
| MD5 | f351d21c8c3f7042f45fb6d121a8ca80 |
| SHA1 | 5a7849305bc6075ca581b0efc6392b677ab598b6 |
| SHA256 | a49c1be0693620359d12b3477649760ad6dffba6fda904295690d64659e80817 |
| SHA512 | 50663995dfa2f28aa1d9fd78d7b17b89d4efb0a992f17cc8527717f5b2aadce0c773a7b74ba7bb00799eece67c4549089a9ecc8abfa3b1574356a030c815ab56 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
| MD5 | 05d718b3d97422f73d49fecf6607927f |
| SHA1 | 3a1da9b740347fc0820299f48deb45797b9c4ce4 |
| SHA256 | d5df38f476d0725eb6e8711cc06a305ef438ec4d8bac1b40f807021f4f8ec396 |
| SHA512 | e7d33be4cd4ccd93e0ca9d04df4db50c2565b2f5e7a9d4aeb77bbb785ca139023c9064e711dc97554ef4d89a5e1191b5f73e5726d40db24a10998d7de3282f33 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
| MD5 | 05d718b3d97422f73d49fecf6607927f |
| SHA1 | 3a1da9b740347fc0820299f48deb45797b9c4ce4 |
| SHA256 | d5df38f476d0725eb6e8711cc06a305ef438ec4d8bac1b40f807021f4f8ec396 |
| SHA512 | e7d33be4cd4ccd93e0ca9d04df4db50c2565b2f5e7a9d4aeb77bbb785ca139023c9064e711dc97554ef4d89a5e1191b5f73e5726d40db24a10998d7de3282f33 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
| MD5 | 05d718b3d97422f73d49fecf6607927f |
| SHA1 | 3a1da9b740347fc0820299f48deb45797b9c4ce4 |
| SHA256 | d5df38f476d0725eb6e8711cc06a305ef438ec4d8bac1b40f807021f4f8ec396 |
| SHA512 | e7d33be4cd4ccd93e0ca9d04df4db50c2565b2f5e7a9d4aeb77bbb785ca139023c9064e711dc97554ef4d89a5e1191b5f73e5726d40db24a10998d7de3282f33 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
| MD5 | 05d718b3d97422f73d49fecf6607927f |
| SHA1 | 3a1da9b740347fc0820299f48deb45797b9c4ce4 |
| SHA256 | d5df38f476d0725eb6e8711cc06a305ef438ec4d8bac1b40f807021f4f8ec396 |
| SHA512 | e7d33be4cd4ccd93e0ca9d04df4db50c2565b2f5e7a9d4aeb77bbb785ca139023c9064e711dc97554ef4d89a5e1191b5f73e5726d40db24a10998d7de3282f33 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe
| MD5 | ce87cbd393d973256a56185477416a4e |
| SHA1 | b2f7712f2ebfbffa2862d86c558333109d4562bf |
| SHA256 | 92c0ad9fb84548bd8208f4065cc48b47c529d96be6ad85e3218b0ff5c2248635 |
| SHA512 | 4bd8303126049dfaf519d21abb2a8f0cdc3a0b61bd2baab8fa0ce1e195ee77b8f96b325f5a4691b0980bb9eab06ce2cfe5555dc73aa91191dd4afb1dd719ebf7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe
| MD5 | ce87cbd393d973256a56185477416a4e |
| SHA1 | b2f7712f2ebfbffa2862d86c558333109d4562bf |
| SHA256 | 92c0ad9fb84548bd8208f4065cc48b47c529d96be6ad85e3218b0ff5c2248635 |
| SHA512 | 4bd8303126049dfaf519d21abb2a8f0cdc3a0b61bd2baab8fa0ce1e195ee77b8f96b325f5a4691b0980bb9eab06ce2cfe5555dc73aa91191dd4afb1dd719ebf7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe
| MD5 | ce87cbd393d973256a56185477416a4e |
| SHA1 | b2f7712f2ebfbffa2862d86c558333109d4562bf |
| SHA256 | 92c0ad9fb84548bd8208f4065cc48b47c529d96be6ad85e3218b0ff5c2248635 |
| SHA512 | 4bd8303126049dfaf519d21abb2a8f0cdc3a0b61bd2baab8fa0ce1e195ee77b8f96b325f5a4691b0980bb9eab06ce2cfe5555dc73aa91191dd4afb1dd719ebf7 |
memory/2756-48-0x0000000000020000-0x000000000002A000-memory.dmp
memory/2756-49-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp
memory/2756-50-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp
memory/2756-51-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
memory/2584-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2584-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2584-69-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2584-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2584-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2584-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2584-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2584-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2584-72-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2584-74-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2584-75-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
memory/2584-80-0x0000000000400000-0x0000000000428000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:27
Reported
2023-10-10 20:37
Platform
win10v2004-20230915-en
Max time kernel
148s
Max time network
155s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0850444.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5127489.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\f9e027623d3ed4e189050ddf9af760f52dada3db5daf0a45a3da0445b485d9cf.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2844 set thread context of 3932 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 624 set thread context of 2276 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8567039.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\f9e027623d3ed4e189050ddf9af760f52dada3db5daf0a45a3da0445b485d9cf.exe
"C:\Users\Admin\AppData\Local\Temp\f9e027623d3ed4e189050ddf9af760f52dada3db5daf0a45a3da0445b485d9cf.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2844 -ip 2844
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3932 -ip 3932
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 140
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8567039.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8567039.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 624 -ip 624
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 196
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5127489.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5127489.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0850444.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0850444.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1708466.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1708466.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 32.101.122.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 27.73.42.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
| MD5 | 16d26320e2faef738bb1d1c0c430bd9e |
| SHA1 | 6600bd6acad7e51ff2241d87955edca6e6e120d7 |
| SHA256 | 8f431777eefe750af2a6be302161328ae4c7e22711b04885b3d661a06ff117c4 |
| SHA512 | c2b990d22f01b1a635f4f6e579e67d230002fdef8ad29190dd2ad14cc6ce4b092ee77b2f0ac8487e2602bfd8cdb3c0115e80a15047c67e1e442dcbf447e65491 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4059046.exe
| MD5 | 16d26320e2faef738bb1d1c0c430bd9e |
| SHA1 | 6600bd6acad7e51ff2241d87955edca6e6e120d7 |
| SHA256 | 8f431777eefe750af2a6be302161328ae4c7e22711b04885b3d661a06ff117c4 |
| SHA512 | c2b990d22f01b1a635f4f6e579e67d230002fdef8ad29190dd2ad14cc6ce4b092ee77b2f0ac8487e2602bfd8cdb3c0115e80a15047c67e1e442dcbf447e65491 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
| MD5 | 1b681f321fd726e6818121ee9e3e9093 |
| SHA1 | 90630b28703bd4238d8424fe1e31520d5eea724f |
| SHA256 | f3cdc58db95cb5856fb028e9e49a5ca0287490ce23c927c76a12321e41f4afb8 |
| SHA512 | 7d0f6de7621d56de456a47a1d3a410b880eaeaa42a3974f748aa4874b9a3a5b16a8a84b448b120e87c1244eeabb9198bf8fb46f3130b1cf592708a0d38535906 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0263408.exe
| MD5 | 1b681f321fd726e6818121ee9e3e9093 |
| SHA1 | 90630b28703bd4238d8424fe1e31520d5eea724f |
| SHA256 | f3cdc58db95cb5856fb028e9e49a5ca0287490ce23c927c76a12321e41f4afb8 |
| SHA512 | 7d0f6de7621d56de456a47a1d3a410b880eaeaa42a3974f748aa4874b9a3a5b16a8a84b448b120e87c1244eeabb9198bf8fb46f3130b1cf592708a0d38535906 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
| MD5 | f351d21c8c3f7042f45fb6d121a8ca80 |
| SHA1 | 5a7849305bc6075ca581b0efc6392b677ab598b6 |
| SHA256 | a49c1be0693620359d12b3477649760ad6dffba6fda904295690d64659e80817 |
| SHA512 | 50663995dfa2f28aa1d9fd78d7b17b89d4efb0a992f17cc8527717f5b2aadce0c773a7b74ba7bb00799eece67c4549089a9ecc8abfa3b1574356a030c815ab56 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7902232.exe
| MD5 | f351d21c8c3f7042f45fb6d121a8ca80 |
| SHA1 | 5a7849305bc6075ca581b0efc6392b677ab598b6 |
| SHA256 | a49c1be0693620359d12b3477649760ad6dffba6fda904295690d64659e80817 |
| SHA512 | 50663995dfa2f28aa1d9fd78d7b17b89d4efb0a992f17cc8527717f5b2aadce0c773a7b74ba7bb00799eece67c4549089a9ecc8abfa3b1574356a030c815ab56 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
| MD5 | 05d718b3d97422f73d49fecf6607927f |
| SHA1 | 3a1da9b740347fc0820299f48deb45797b9c4ce4 |
| SHA256 | d5df38f476d0725eb6e8711cc06a305ef438ec4d8bac1b40f807021f4f8ec396 |
| SHA512 | e7d33be4cd4ccd93e0ca9d04df4db50c2565b2f5e7a9d4aeb77bbb785ca139023c9064e711dc97554ef4d89a5e1191b5f73e5726d40db24a10998d7de3282f33 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0635996.exe
| MD5 | 05d718b3d97422f73d49fecf6607927f |
| SHA1 | 3a1da9b740347fc0820299f48deb45797b9c4ce4 |
| SHA256 | d5df38f476d0725eb6e8711cc06a305ef438ec4d8bac1b40f807021f4f8ec396 |
| SHA512 | e7d33be4cd4ccd93e0ca9d04df4db50c2565b2f5e7a9d4aeb77bbb785ca139023c9064e711dc97554ef4d89a5e1191b5f73e5726d40db24a10998d7de3282f33 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe
| MD5 | ce87cbd393d973256a56185477416a4e |
| SHA1 | b2f7712f2ebfbffa2862d86c558333109d4562bf |
| SHA256 | 92c0ad9fb84548bd8208f4065cc48b47c529d96be6ad85e3218b0ff5c2248635 |
| SHA512 | 4bd8303126049dfaf519d21abb2a8f0cdc3a0b61bd2baab8fa0ce1e195ee77b8f96b325f5a4691b0980bb9eab06ce2cfe5555dc73aa91191dd4afb1dd719ebf7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7244829.exe
| MD5 | ce87cbd393d973256a56185477416a4e |
| SHA1 | b2f7712f2ebfbffa2862d86c558333109d4562bf |
| SHA256 | 92c0ad9fb84548bd8208f4065cc48b47c529d96be6ad85e3218b0ff5c2248635 |
| SHA512 | 4bd8303126049dfaf519d21abb2a8f0cdc3a0b61bd2baab8fa0ce1e195ee77b8f96b325f5a4691b0980bb9eab06ce2cfe5555dc73aa91191dd4afb1dd719ebf7 |
memory/4912-35-0x00000000004B0000-0x00000000004BA000-memory.dmp
memory/4912-36-0x00007FFEB4840000-0x00007FFEB5301000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
memory/4912-40-0x00007FFEB4840000-0x00007FFEB5301000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8366459.exe
| MD5 | c30c00bf6d6e8c989132e30077e7bdfb |
| SHA1 | 1344367ea24d41cc02891596580abe5d7a6d39bc |
| SHA256 | 15f0f9ead6d43458b06c40acca61564ed6e32b89e2bf7380ba0dd28910ac011f |
| SHA512 | 64884c5b42b6ef670455e2f8fa1554a02da938c485a26a5c60945671bcd3f4b4688e41e35f19a016ca9f4acf3176887c08140687c49599f23979ed105796d7db |
memory/3932-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3932-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3932-46-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3932-44-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8567039.exe
| MD5 | b7b96cdd13d773d6219fe7e898c6c6db |
| SHA1 | a69e38e2ddd1e51451f67706aea7a38fa93793ad |
| SHA256 | 6dc260cbf57c7a0b99fe008c1217ee28b3a5badd0d09713ed323d9004a61960c |
| SHA512 | 489eadca1b3c890e24744d66a14acbf15a89054ad4fb765f23b2d1c87f896ffbf49dae2ae9f260c9b9100718f2cf387a2f138efb038e5f9f9c005a88a6ec1409 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8567039.exe
| MD5 | b7b96cdd13d773d6219fe7e898c6c6db |
| SHA1 | a69e38e2ddd1e51451f67706aea7a38fa93793ad |
| SHA256 | 6dc260cbf57c7a0b99fe008c1217ee28b3a5badd0d09713ed323d9004a61960c |
| SHA512 | 489eadca1b3c890e24744d66a14acbf15a89054ad4fb765f23b2d1c87f896ffbf49dae2ae9f260c9b9100718f2cf387a2f138efb038e5f9f9c005a88a6ec1409 |
memory/2276-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2276-51-0x0000000073E50000-0x0000000074600000-memory.dmp
memory/2276-52-0x0000000001390000-0x0000000001396000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5127489.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5127489.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2276-58-0x00000000059F0000-0x0000000006008000-memory.dmp
memory/2276-59-0x00000000054E0000-0x00000000055EA000-memory.dmp
memory/2276-62-0x0000000005380000-0x0000000005392000-memory.dmp
memory/2276-61-0x00000000053C0000-0x00000000053D0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2276-70-0x0000000005450000-0x000000000549C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0850444.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0850444.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2276-66-0x0000000005410000-0x000000000544C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1708466.exe
| MD5 | 9b5024e3226b9a88bc207ae1a1e34c75 |
| SHA1 | a631726fad5e8cce10d90882b5f806f5903a4190 |
| SHA256 | 6c4dd078a22090f0b38c33ac0f3bb9824e98f2d0f40d291fbe451ba30cbeb562 |
| SHA512 | 67cec10be07e67df243f9e78720c7b089d08a3a657e4b9552176a1004173bc2a76d601564416cd3d65c28c0d1de52b084516a394e7f04e554a3a8b6978cb8094 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1708466.exe
| MD5 | 9b5024e3226b9a88bc207ae1a1e34c75 |
| SHA1 | a631726fad5e8cce10d90882b5f806f5903a4190 |
| SHA256 | 6c4dd078a22090f0b38c33ac0f3bb9824e98f2d0f40d291fbe451ba30cbeb562 |
| SHA512 | 67cec10be07e67df243f9e78720c7b089d08a3a657e4b9552176a1004173bc2a76d601564416cd3d65c28c0d1de52b084516a394e7f04e554a3a8b6978cb8094 |
memory/2276-86-0x0000000073E50000-0x0000000074600000-memory.dmp
memory/2276-87-0x00000000053C0000-0x00000000053D0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |