Analysis Overview
SHA256
42a136c900f23537bd25ec83a138ee734ccebdc1eaa0c7b78c6794b28b38a1c3
Threat Level: Known bad
The file 42a136c900f23537bd25ec83a138ee734ccebdc1eaa0c7b78c6794b28b38a1c3 was found to be: Known bad.
Malicious Activity Summary
Mystic
Modifies Windows Defender Real-time Protection settings
Detects Healer an antivirus disabler dropper
Amadey
Detect Mystic stealer payload
RedLine
Healer
Checks computer location settings
Windows security modification
Loads dropped DLL
Executes dropped EXE
Adds Run key to start application
Suspicious use of SetThreadContext
Launches sc.exe
Unsigned PE
Program crash
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:28
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:28
Reported
2023-10-10 20:40
Platform
win10v2004-20230915-en
Max time kernel
151s
Max time network
157s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5698440.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3445601.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\42a136c900f23537bd25ec83a138ee734ccebdc1eaa0c7b78c6794b28b38a1c3.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3944 set thread context of 3112 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 2176 set thread context of 2704 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6725775.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\42a136c900f23537bd25ec83a138ee734ccebdc1eaa0c7b78c6794b28b38a1c3.exe
"C:\Users\Admin\AppData\Local\Temp\42a136c900f23537bd25ec83a138ee734ccebdc1eaa0c7b78c6794b28b38a1c3.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3112 -ip 3112
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3944 -ip 3944
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 580
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6725775.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6725775.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2176 -ip 2176
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 580
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5698440.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5698440.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3445601.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3445601.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5595195.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5595195.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.99.105.20.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 211.143.182.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
| MD5 | a7077ca4fc302bd0d1f73800e892ae43 |
| SHA1 | 5deec330dd1fc8b3f594cbb07e59896a0c31faa8 |
| SHA256 | a79d5042b7173c9be665bca34b033903ad9c43b27d2263e5edcff03e5ca65ca1 |
| SHA512 | d769dc9bc9c2a52e0afa51b8f4b7df792a6046b62a34b30bdaed730fbb5b6f5b294d3503cc9631a94c9b0a477df3759d5d3eeb0bca8e72f483ac8d97d4f05b6a |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
| MD5 | a7077ca4fc302bd0d1f73800e892ae43 |
| SHA1 | 5deec330dd1fc8b3f594cbb07e59896a0c31faa8 |
| SHA256 | a79d5042b7173c9be665bca34b033903ad9c43b27d2263e5edcff03e5ca65ca1 |
| SHA512 | d769dc9bc9c2a52e0afa51b8f4b7df792a6046b62a34b30bdaed730fbb5b6f5b294d3503cc9631a94c9b0a477df3759d5d3eeb0bca8e72f483ac8d97d4f05b6a |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
| MD5 | f0c11aa04516a3997995a3486a19c81a |
| SHA1 | fa574bb79cbf356dba307ddd7a5e9f8d6829aa2f |
| SHA256 | 38e56aede2a07faa23ecd89017266fbbce65d9a4b1d157b66118e3147fa60e47 |
| SHA512 | bf0344737411bbdb6eb5ac7e7d652b1d984a60d5923986a41b16bd8745d2d4b7cdd845d0839a8f3b68f5ff39e0af24b4b80c8db626449fc4fb1995a20319ae8e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
| MD5 | f0c11aa04516a3997995a3486a19c81a |
| SHA1 | fa574bb79cbf356dba307ddd7a5e9f8d6829aa2f |
| SHA256 | 38e56aede2a07faa23ecd89017266fbbce65d9a4b1d157b66118e3147fa60e47 |
| SHA512 | bf0344737411bbdb6eb5ac7e7d652b1d984a60d5923986a41b16bd8745d2d4b7cdd845d0839a8f3b68f5ff39e0af24b4b80c8db626449fc4fb1995a20319ae8e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
| MD5 | 910c13e3c323b1a944ff1f5e6e4a49f3 |
| SHA1 | 94463f0386f7e2734df577b653cd7fde2cfd6946 |
| SHA256 | 82d534ad6190f4db6f8390dc468c66d42a7903f73fd2dc3f71189d98b1aaf7da |
| SHA512 | c0526f29a7ffce979cfaa1745ee0225862a204dc31047ba2cc81ebb6c3f0ddc812bddb9ab652f34562ac2c23408eff7d7afcc80eb6695c86006c477560ebdf0d |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
| MD5 | 910c13e3c323b1a944ff1f5e6e4a49f3 |
| SHA1 | 94463f0386f7e2734df577b653cd7fde2cfd6946 |
| SHA256 | 82d534ad6190f4db6f8390dc468c66d42a7903f73fd2dc3f71189d98b1aaf7da |
| SHA512 | c0526f29a7ffce979cfaa1745ee0225862a204dc31047ba2cc81ebb6c3f0ddc812bddb9ab652f34562ac2c23408eff7d7afcc80eb6695c86006c477560ebdf0d |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
| MD5 | 9e0ed6726b1908027774fdf97a013a53 |
| SHA1 | 528988e5c2a5a87aa43f35358d867f7e61f7c1c0 |
| SHA256 | 7715246047fd36f1a1b1660e86db7b73bfe8079fde9a7479bf7e5a3f0f01005f |
| SHA512 | 6fe1fc07d9b9199a60a94552a0ad002ddb350d4350d3ddeadb269bee67ebe996e0dd448dd14b2fd1c8c93c68db77d2c96686f899a3cfdf35cd3053aaad2cc2af |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
| MD5 | 9e0ed6726b1908027774fdf97a013a53 |
| SHA1 | 528988e5c2a5a87aa43f35358d867f7e61f7c1c0 |
| SHA256 | 7715246047fd36f1a1b1660e86db7b73bfe8079fde9a7479bf7e5a3f0f01005f |
| SHA512 | 6fe1fc07d9b9199a60a94552a0ad002ddb350d4350d3ddeadb269bee67ebe996e0dd448dd14b2fd1c8c93c68db77d2c96686f899a3cfdf35cd3053aaad2cc2af |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe
| MD5 | 3f4a7169268f120eee5647e72569b7ac |
| SHA1 | 1b84e23142b6b9a2686b891d575b683772fde50a |
| SHA256 | 82f20b18adfee2fd76a73fad5c4f4ba76aaa57a668acd266cda19a0f2886bb2f |
| SHA512 | c7c5c4ee269e5768de57564b750c3243bc1d7ab086a624ed779a502380ed652b5cf4b5168b6c42ac7f9c01aa6f0b6603427dab9c7ce3daa6ea98d6756632e9af |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe
| MD5 | 3f4a7169268f120eee5647e72569b7ac |
| SHA1 | 1b84e23142b6b9a2686b891d575b683772fde50a |
| SHA256 | 82f20b18adfee2fd76a73fad5c4f4ba76aaa57a668acd266cda19a0f2886bb2f |
| SHA512 | c7c5c4ee269e5768de57564b750c3243bc1d7ab086a624ed779a502380ed652b5cf4b5168b6c42ac7f9c01aa6f0b6603427dab9c7ce3daa6ea98d6756632e9af |
memory/3644-35-0x0000000000B20000-0x0000000000B2A000-memory.dmp
memory/3644-36-0x00007FFF68480000-0x00007FFF68F41000-memory.dmp
memory/3644-37-0x00007FFF68480000-0x00007FFF68F41000-memory.dmp
memory/3644-39-0x00007FFF68480000-0x00007FFF68F41000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
memory/3112-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3112-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3112-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3112-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6725775.exe
| MD5 | 661abb35f157c1a7d5b76babd3e9ad56 |
| SHA1 | d2d050836a146dbb0a0cfda89181b2074367ad6d |
| SHA256 | b24b299aa96cec5d170d1bdbf2362129d3d174a6e19766e62c5cca6827a92684 |
| SHA512 | 4e05c2b2cbadbfccafa867319a4b1834437e43c486e44c7ad32b3206588e15e5231dacb33cd87f6a33c0b68d62a55c20fe44362b0eec45e9d07e590c8486e0cb |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6725775.exe
| MD5 | 661abb35f157c1a7d5b76babd3e9ad56 |
| SHA1 | d2d050836a146dbb0a0cfda89181b2074367ad6d |
| SHA256 | b24b299aa96cec5d170d1bdbf2362129d3d174a6e19766e62c5cca6827a92684 |
| SHA512 | 4e05c2b2cbadbfccafa867319a4b1834437e43c486e44c7ad32b3206588e15e5231dacb33cd87f6a33c0b68d62a55c20fe44362b0eec45e9d07e590c8486e0cb |
memory/2704-51-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2704-52-0x00000000742B0000-0x0000000074A60000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5698440.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5698440.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2704-56-0x0000000002BC0000-0x0000000002BC6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2704-66-0x0000000005880000-0x0000000005E98000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3445601.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3445601.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2704-71-0x0000000005370000-0x000000000547A000-memory.dmp
memory/2704-74-0x0000000005250000-0x0000000005260000-memory.dmp
memory/2704-73-0x0000000005260000-0x0000000005272000-memory.dmp
memory/2704-75-0x0000000005280000-0x00000000052BC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5595195.exe
| MD5 | 94dbbbf88710bbc49fa4ec0941eafc0f |
| SHA1 | 7e1cf0c175ceec633722076f3f0bee434dfba667 |
| SHA256 | 06ed3bcd06a9cd2d67e6fa3e297b58b3770c389e79c3ad57e1a9dfcf68f6a365 |
| SHA512 | 902aba855b3b12ac1baae5618f5d9eb22d09fadf2ef6e2673bec9750b30e686c688789f104bfa60fea343385923cd547a38674d4feff6fc53eae944f9c700e3b |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5595195.exe
| MD5 | 94dbbbf88710bbc49fa4ec0941eafc0f |
| SHA1 | 7e1cf0c175ceec633722076f3f0bee434dfba667 |
| SHA256 | 06ed3bcd06a9cd2d67e6fa3e297b58b3770c389e79c3ad57e1a9dfcf68f6a365 |
| SHA512 | 902aba855b3b12ac1baae5618f5d9eb22d09fadf2ef6e2673bec9750b30e686c688789f104bfa60fea343385923cd547a38674d4feff6fc53eae944f9c700e3b |
memory/2704-85-0x0000000005300000-0x000000000534C000-memory.dmp
memory/2704-87-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/2704-88-0x0000000005250000-0x0000000005260000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:28
Reported
2023-10-10 20:40
Platform
win7-20230831-en
Max time kernel
121s
Max time network
136s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\42a136c900f23537bd25ec83a138ee734ccebdc1eaa0c7b78c6794b28b38a1c3.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1668 set thread context of 2872 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\42a136c900f23537bd25ec83a138ee734ccebdc1eaa0c7b78c6794b28b38a1c3.exe
"C:\Users\Admin\AppData\Local\Temp\42a136c900f23537bd25ec83a138ee734ccebdc1eaa0c7b78c6794b28b38a1c3.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 36
Network
| Country | Destination | Domain | Proto |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
| MD5 | a7077ca4fc302bd0d1f73800e892ae43 |
| SHA1 | 5deec330dd1fc8b3f594cbb07e59896a0c31faa8 |
| SHA256 | a79d5042b7173c9be665bca34b033903ad9c43b27d2263e5edcff03e5ca65ca1 |
| SHA512 | d769dc9bc9c2a52e0afa51b8f4b7df792a6046b62a34b30bdaed730fbb5b6f5b294d3503cc9631a94c9b0a477df3759d5d3eeb0bca8e72f483ac8d97d4f05b6a |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
| MD5 | a7077ca4fc302bd0d1f73800e892ae43 |
| SHA1 | 5deec330dd1fc8b3f594cbb07e59896a0c31faa8 |
| SHA256 | a79d5042b7173c9be665bca34b033903ad9c43b27d2263e5edcff03e5ca65ca1 |
| SHA512 | d769dc9bc9c2a52e0afa51b8f4b7df792a6046b62a34b30bdaed730fbb5b6f5b294d3503cc9631a94c9b0a477df3759d5d3eeb0bca8e72f483ac8d97d4f05b6a |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
| MD5 | a7077ca4fc302bd0d1f73800e892ae43 |
| SHA1 | 5deec330dd1fc8b3f594cbb07e59896a0c31faa8 |
| SHA256 | a79d5042b7173c9be665bca34b033903ad9c43b27d2263e5edcff03e5ca65ca1 |
| SHA512 | d769dc9bc9c2a52e0afa51b8f4b7df792a6046b62a34b30bdaed730fbb5b6f5b294d3503cc9631a94c9b0a477df3759d5d3eeb0bca8e72f483ac8d97d4f05b6a |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4719501.exe
| MD5 | a7077ca4fc302bd0d1f73800e892ae43 |
| SHA1 | 5deec330dd1fc8b3f594cbb07e59896a0c31faa8 |
| SHA256 | a79d5042b7173c9be665bca34b033903ad9c43b27d2263e5edcff03e5ca65ca1 |
| SHA512 | d769dc9bc9c2a52e0afa51b8f4b7df792a6046b62a34b30bdaed730fbb5b6f5b294d3503cc9631a94c9b0a477df3759d5d3eeb0bca8e72f483ac8d97d4f05b6a |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
| MD5 | f0c11aa04516a3997995a3486a19c81a |
| SHA1 | fa574bb79cbf356dba307ddd7a5e9f8d6829aa2f |
| SHA256 | 38e56aede2a07faa23ecd89017266fbbce65d9a4b1d157b66118e3147fa60e47 |
| SHA512 | bf0344737411bbdb6eb5ac7e7d652b1d984a60d5923986a41b16bd8745d2d4b7cdd845d0839a8f3b68f5ff39e0af24b4b80c8db626449fc4fb1995a20319ae8e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
| MD5 | f0c11aa04516a3997995a3486a19c81a |
| SHA1 | fa574bb79cbf356dba307ddd7a5e9f8d6829aa2f |
| SHA256 | 38e56aede2a07faa23ecd89017266fbbce65d9a4b1d157b66118e3147fa60e47 |
| SHA512 | bf0344737411bbdb6eb5ac7e7d652b1d984a60d5923986a41b16bd8745d2d4b7cdd845d0839a8f3b68f5ff39e0af24b4b80c8db626449fc4fb1995a20319ae8e |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
| MD5 | f0c11aa04516a3997995a3486a19c81a |
| SHA1 | fa574bb79cbf356dba307ddd7a5e9f8d6829aa2f |
| SHA256 | 38e56aede2a07faa23ecd89017266fbbce65d9a4b1d157b66118e3147fa60e47 |
| SHA512 | bf0344737411bbdb6eb5ac7e7d652b1d984a60d5923986a41b16bd8745d2d4b7cdd845d0839a8f3b68f5ff39e0af24b4b80c8db626449fc4fb1995a20319ae8e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5933752.exe
| MD5 | f0c11aa04516a3997995a3486a19c81a |
| SHA1 | fa574bb79cbf356dba307ddd7a5e9f8d6829aa2f |
| SHA256 | 38e56aede2a07faa23ecd89017266fbbce65d9a4b1d157b66118e3147fa60e47 |
| SHA512 | bf0344737411bbdb6eb5ac7e7d652b1d984a60d5923986a41b16bd8745d2d4b7cdd845d0839a8f3b68f5ff39e0af24b4b80c8db626449fc4fb1995a20319ae8e |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
| MD5 | 910c13e3c323b1a944ff1f5e6e4a49f3 |
| SHA1 | 94463f0386f7e2734df577b653cd7fde2cfd6946 |
| SHA256 | 82d534ad6190f4db6f8390dc468c66d42a7903f73fd2dc3f71189d98b1aaf7da |
| SHA512 | c0526f29a7ffce979cfaa1745ee0225862a204dc31047ba2cc81ebb6c3f0ddc812bddb9ab652f34562ac2c23408eff7d7afcc80eb6695c86006c477560ebdf0d |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
| MD5 | 910c13e3c323b1a944ff1f5e6e4a49f3 |
| SHA1 | 94463f0386f7e2734df577b653cd7fde2cfd6946 |
| SHA256 | 82d534ad6190f4db6f8390dc468c66d42a7903f73fd2dc3f71189d98b1aaf7da |
| SHA512 | c0526f29a7ffce979cfaa1745ee0225862a204dc31047ba2cc81ebb6c3f0ddc812bddb9ab652f34562ac2c23408eff7d7afcc80eb6695c86006c477560ebdf0d |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
| MD5 | 910c13e3c323b1a944ff1f5e6e4a49f3 |
| SHA1 | 94463f0386f7e2734df577b653cd7fde2cfd6946 |
| SHA256 | 82d534ad6190f4db6f8390dc468c66d42a7903f73fd2dc3f71189d98b1aaf7da |
| SHA512 | c0526f29a7ffce979cfaa1745ee0225862a204dc31047ba2cc81ebb6c3f0ddc812bddb9ab652f34562ac2c23408eff7d7afcc80eb6695c86006c477560ebdf0d |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4344298.exe
| MD5 | 910c13e3c323b1a944ff1f5e6e4a49f3 |
| SHA1 | 94463f0386f7e2734df577b653cd7fde2cfd6946 |
| SHA256 | 82d534ad6190f4db6f8390dc468c66d42a7903f73fd2dc3f71189d98b1aaf7da |
| SHA512 | c0526f29a7ffce979cfaa1745ee0225862a204dc31047ba2cc81ebb6c3f0ddc812bddb9ab652f34562ac2c23408eff7d7afcc80eb6695c86006c477560ebdf0d |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
| MD5 | 9e0ed6726b1908027774fdf97a013a53 |
| SHA1 | 528988e5c2a5a87aa43f35358d867f7e61f7c1c0 |
| SHA256 | 7715246047fd36f1a1b1660e86db7b73bfe8079fde9a7479bf7e5a3f0f01005f |
| SHA512 | 6fe1fc07d9b9199a60a94552a0ad002ddb350d4350d3ddeadb269bee67ebe996e0dd448dd14b2fd1c8c93c68db77d2c96686f899a3cfdf35cd3053aaad2cc2af |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
| MD5 | 9e0ed6726b1908027774fdf97a013a53 |
| SHA1 | 528988e5c2a5a87aa43f35358d867f7e61f7c1c0 |
| SHA256 | 7715246047fd36f1a1b1660e86db7b73bfe8079fde9a7479bf7e5a3f0f01005f |
| SHA512 | 6fe1fc07d9b9199a60a94552a0ad002ddb350d4350d3ddeadb269bee67ebe996e0dd448dd14b2fd1c8c93c68db77d2c96686f899a3cfdf35cd3053aaad2cc2af |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
| MD5 | 9e0ed6726b1908027774fdf97a013a53 |
| SHA1 | 528988e5c2a5a87aa43f35358d867f7e61f7c1c0 |
| SHA256 | 7715246047fd36f1a1b1660e86db7b73bfe8079fde9a7479bf7e5a3f0f01005f |
| SHA512 | 6fe1fc07d9b9199a60a94552a0ad002ddb350d4350d3ddeadb269bee67ebe996e0dd448dd14b2fd1c8c93c68db77d2c96686f899a3cfdf35cd3053aaad2cc2af |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0379505.exe
| MD5 | 9e0ed6726b1908027774fdf97a013a53 |
| SHA1 | 528988e5c2a5a87aa43f35358d867f7e61f7c1c0 |
| SHA256 | 7715246047fd36f1a1b1660e86db7b73bfe8079fde9a7479bf7e5a3f0f01005f |
| SHA512 | 6fe1fc07d9b9199a60a94552a0ad002ddb350d4350d3ddeadb269bee67ebe996e0dd448dd14b2fd1c8c93c68db77d2c96686f899a3cfdf35cd3053aaad2cc2af |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe
| MD5 | 3f4a7169268f120eee5647e72569b7ac |
| SHA1 | 1b84e23142b6b9a2686b891d575b683772fde50a |
| SHA256 | 82f20b18adfee2fd76a73fad5c4f4ba76aaa57a668acd266cda19a0f2886bb2f |
| SHA512 | c7c5c4ee269e5768de57564b750c3243bc1d7ab086a624ed779a502380ed652b5cf4b5168b6c42ac7f9c01aa6f0b6603427dab9c7ce3daa6ea98d6756632e9af |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe
| MD5 | 3f4a7169268f120eee5647e72569b7ac |
| SHA1 | 1b84e23142b6b9a2686b891d575b683772fde50a |
| SHA256 | 82f20b18adfee2fd76a73fad5c4f4ba76aaa57a668acd266cda19a0f2886bb2f |
| SHA512 | c7c5c4ee269e5768de57564b750c3243bc1d7ab086a624ed779a502380ed652b5cf4b5168b6c42ac7f9c01aa6f0b6603427dab9c7ce3daa6ea98d6756632e9af |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4182726.exe
| MD5 | 3f4a7169268f120eee5647e72569b7ac |
| SHA1 | 1b84e23142b6b9a2686b891d575b683772fde50a |
| SHA256 | 82f20b18adfee2fd76a73fad5c4f4ba76aaa57a668acd266cda19a0f2886bb2f |
| SHA512 | c7c5c4ee269e5768de57564b750c3243bc1d7ab086a624ed779a502380ed652b5cf4b5168b6c42ac7f9c01aa6f0b6603427dab9c7ce3daa6ea98d6756632e9af |
memory/2728-48-0x0000000000840000-0x000000000084A000-memory.dmp
memory/2728-49-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp
memory/2728-50-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp
memory/2728-51-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
memory/2872-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2872-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2872-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2872-69-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2872-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2872-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2872-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2872-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2872-72-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2872-74-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2872-75-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5927552.exe
| MD5 | 3b08f4571e930aa67dacbaace0edae29 |
| SHA1 | b89f86a739b26542f2ccf794a93e29a565131b40 |
| SHA256 | d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3 |
| SHA512 | 5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb |
memory/2872-80-0x0000000000400000-0x0000000000428000-memory.dmp