Analysis
-
max time kernel
134s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:11
Static task
static1
Behavioral task
behavioral1
Sample
08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe
Resource
win7-20230831-en
General
-
Target
08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe
-
Size
994KB
-
MD5
7a979124e3aebcf4e9689e2bf7026ed2
-
SHA1
e1bb2942d7dbf1171b4d6cee45758f52bc1e994c
-
SHA256
08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9
-
SHA512
726e9fffe5159c735cf0c502da3893ecde3c0a88f4c7b96aa9d9e3d156fb0a09d05651298c45f5327745c6b5e5c8f1cffa72899b4181b1398d128fc31bcb2b61
-
SSDEEP
24576:nyF6WFzjzS1Ytt1bLqGGbCnps63N7gKNp/bM8yeFhJle0F:yFIWZLO2b3N0o/IHeFh
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4920-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4920-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4920-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4920-46-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7653291.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7653291.exe healer behavioral2/memory/3216-35-0x0000000000A20000-0x0000000000A2A000-memory.dmp healer -
Processes:
q7653291.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q7653291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q7653291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q7653291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q7653291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q7653291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q7653291.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explothe.exeu1367557.exelegota.exet2452221.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation u1367557.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation t2452221.exe -
Executes dropped EXE 16 IoCs
Processes:
z4410799.exez2909601.exez6439335.exez4883012.exeq7653291.exer2709637.exes1704280.exet2452221.exeexplothe.exeu1367557.exelegota.exew1172642.exelegota.exeexplothe.exelegota.exeexplothe.exepid process 3484 z4410799.exe 4164 z2909601.exe 536 z6439335.exe 1324 z4883012.exe 3216 q7653291.exe 4176 r2709637.exe 1356 s1704280.exe 3812 t2452221.exe 3872 explothe.exe 3464 u1367557.exe 4328 legota.exe 532 w1172642.exe 2828 legota.exe 3056 explothe.exe 956 legota.exe 3156 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3660 rundll32.exe 2300 rundll32.exe -
Processes:
q7653291.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q7653291.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z4883012.exe08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exez4410799.exez2909601.exez6439335.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z4883012.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4410799.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z2909601.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z6439335.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r2709637.exes1704280.exedescription pid process target process PID 4176 set thread context of 4920 4176 r2709637.exe AppLaunch.exe PID 1356 set thread context of 2872 1356 s1704280.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1284 4176 WerFault.exe r2709637.exe 4900 4920 WerFault.exe AppLaunch.exe 4104 1356 WerFault.exe s1704280.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1808 schtasks.exe 4296 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q7653291.exepid process 3216 q7653291.exe 3216 q7653291.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q7653291.exedescription pid process Token: SeDebugPrivilege 3216 q7653291.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exez4410799.exez2909601.exez6439335.exez4883012.exer2709637.exes1704280.exet2452221.exeexplothe.exeu1367557.execmd.exedescription pid process target process PID 4864 wrote to memory of 3484 4864 08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe z4410799.exe PID 4864 wrote to memory of 3484 4864 08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe z4410799.exe PID 4864 wrote to memory of 3484 4864 08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe z4410799.exe PID 3484 wrote to memory of 4164 3484 z4410799.exe z2909601.exe PID 3484 wrote to memory of 4164 3484 z4410799.exe z2909601.exe PID 3484 wrote to memory of 4164 3484 z4410799.exe z2909601.exe PID 4164 wrote to memory of 536 4164 z2909601.exe z6439335.exe PID 4164 wrote to memory of 536 4164 z2909601.exe z6439335.exe PID 4164 wrote to memory of 536 4164 z2909601.exe z6439335.exe PID 536 wrote to memory of 1324 536 z6439335.exe z4883012.exe PID 536 wrote to memory of 1324 536 z6439335.exe z4883012.exe PID 536 wrote to memory of 1324 536 z6439335.exe z4883012.exe PID 1324 wrote to memory of 3216 1324 z4883012.exe q7653291.exe PID 1324 wrote to memory of 3216 1324 z4883012.exe q7653291.exe PID 1324 wrote to memory of 4176 1324 z4883012.exe r2709637.exe PID 1324 wrote to memory of 4176 1324 z4883012.exe r2709637.exe PID 1324 wrote to memory of 4176 1324 z4883012.exe r2709637.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 4176 wrote to memory of 4920 4176 r2709637.exe AppLaunch.exe PID 536 wrote to memory of 1356 536 z6439335.exe s1704280.exe PID 536 wrote to memory of 1356 536 z6439335.exe s1704280.exe PID 536 wrote to memory of 1356 536 z6439335.exe s1704280.exe PID 1356 wrote to memory of 2872 1356 s1704280.exe AppLaunch.exe PID 1356 wrote to memory of 2872 1356 s1704280.exe AppLaunch.exe PID 1356 wrote to memory of 2872 1356 s1704280.exe AppLaunch.exe PID 1356 wrote to memory of 2872 1356 s1704280.exe AppLaunch.exe PID 1356 wrote to memory of 2872 1356 s1704280.exe AppLaunch.exe PID 1356 wrote to memory of 2872 1356 s1704280.exe AppLaunch.exe PID 1356 wrote to memory of 2872 1356 s1704280.exe AppLaunch.exe PID 1356 wrote to memory of 2872 1356 s1704280.exe AppLaunch.exe PID 4164 wrote to memory of 3812 4164 z2909601.exe t2452221.exe PID 4164 wrote to memory of 3812 4164 z2909601.exe t2452221.exe PID 4164 wrote to memory of 3812 4164 z2909601.exe t2452221.exe PID 3812 wrote to memory of 3872 3812 t2452221.exe explothe.exe PID 3812 wrote to memory of 3872 3812 t2452221.exe explothe.exe PID 3812 wrote to memory of 3872 3812 t2452221.exe explothe.exe PID 3484 wrote to memory of 3464 3484 z4410799.exe u1367557.exe PID 3484 wrote to memory of 3464 3484 z4410799.exe u1367557.exe PID 3484 wrote to memory of 3464 3484 z4410799.exe u1367557.exe PID 3872 wrote to memory of 1808 3872 explothe.exe schtasks.exe PID 3872 wrote to memory of 1808 3872 explothe.exe schtasks.exe PID 3872 wrote to memory of 1808 3872 explothe.exe schtasks.exe PID 3464 wrote to memory of 4328 3464 u1367557.exe legota.exe PID 3464 wrote to memory of 4328 3464 u1367557.exe legota.exe PID 3464 wrote to memory of 4328 3464 u1367557.exe legota.exe PID 3872 wrote to memory of 3436 3872 explothe.exe cmd.exe PID 3872 wrote to memory of 3436 3872 explothe.exe cmd.exe PID 3872 wrote to memory of 3436 3872 explothe.exe cmd.exe PID 4864 wrote to memory of 532 4864 08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe w1172642.exe PID 4864 wrote to memory of 532 4864 08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe w1172642.exe PID 4864 wrote to memory of 532 4864 08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe w1172642.exe PID 3436 wrote to memory of 3360 3436 cmd.exe cmd.exe PID 3436 wrote to memory of 3360 3436 cmd.exe cmd.exe PID 3436 wrote to memory of 3360 3436 cmd.exe cmd.exe PID 3436 wrote to memory of 1304 3436 cmd.exe cacls.exe PID 3436 wrote to memory of 1304 3436 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe"C:\Users\Admin\AppData\Local\Temp\08c68b0700ffe30acf71355cdd76e9099377e0cf28286479e759eeb08e7b37c9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4410799.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4410799.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2909601.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2909601.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6439335.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6439335.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4883012.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4883012.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7653291.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7653291.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2709637.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2709637.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 1567⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1704280.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1704280.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 1566⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2452221.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2452221.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1367557.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1367557.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1172642.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1172642.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4176 -ip 41761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4920 -ip 49201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1356 -ip 13561⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1172642.exeFilesize
23KB
MD5bcfd55551bef43001eebbd8720c7f537
SHA1565457b6fad9611547b5afc26ac6e68c58b7f713
SHA25611827ddc003f538ca06766cf444f8af27d71b4fd7c04d7c01b0cf8cb54237e44
SHA512312e0b58d4705a3a9df57c802bd64ed8a3b1dd8e86fda94bd281dac43ef895a91d255ef4001e36fb9cf132354313a6ae6d3c90bc6a66cba0a1b37fd90f55cdf1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1172642.exeFilesize
23KB
MD5bcfd55551bef43001eebbd8720c7f537
SHA1565457b6fad9611547b5afc26ac6e68c58b7f713
SHA25611827ddc003f538ca06766cf444f8af27d71b4fd7c04d7c01b0cf8cb54237e44
SHA512312e0b58d4705a3a9df57c802bd64ed8a3b1dd8e86fda94bd281dac43ef895a91d255ef4001e36fb9cf132354313a6ae6d3c90bc6a66cba0a1b37fd90f55cdf1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4410799.exeFilesize
892KB
MD562383140b826eab5523ab5e7662ed72d
SHA11c9f35a11fc6611855de1732cd5e16609caebbcc
SHA2566215ce1a653ef9e963a6a30e9a72df7580afac2202929af0e9589af187f37e66
SHA5127ca97ecd6b8bc7922ba2523ebcda4073a7d67ee033888e0dddbd78e7b93471a86bafaed88e959622a36240a9c4c267b5b3665f00fce1642777f02b9a0c0daabb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4410799.exeFilesize
892KB
MD562383140b826eab5523ab5e7662ed72d
SHA11c9f35a11fc6611855de1732cd5e16609caebbcc
SHA2566215ce1a653ef9e963a6a30e9a72df7580afac2202929af0e9589af187f37e66
SHA5127ca97ecd6b8bc7922ba2523ebcda4073a7d67ee033888e0dddbd78e7b93471a86bafaed88e959622a36240a9c4c267b5b3665f00fce1642777f02b9a0c0daabb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1367557.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1367557.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2909601.exeFilesize
709KB
MD50ae710e43fb30cb0ad385d084cbdee5f
SHA16b45fef724c5676119055971137e90731fc2b794
SHA2564d35a6aa009fed5963180955337051d0049b5393c0a12879d5ad8e487f90cb7b
SHA512e4d926dd4f966dd11dfa5e35320b6718a0de7be8636d452c1b9e4adfd780c34d20b97fa1c694c3addd05a42b6837ed58c9e471c97fb13c24f42b2e69fa5cc455
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2909601.exeFilesize
709KB
MD50ae710e43fb30cb0ad385d084cbdee5f
SHA16b45fef724c5676119055971137e90731fc2b794
SHA2564d35a6aa009fed5963180955337051d0049b5393c0a12879d5ad8e487f90cb7b
SHA512e4d926dd4f966dd11dfa5e35320b6718a0de7be8636d452c1b9e4adfd780c34d20b97fa1c694c3addd05a42b6837ed58c9e471c97fb13c24f42b2e69fa5cc455
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2452221.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2452221.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6439335.exeFilesize
526KB
MD5b4717633e237be857a900fb417f2675b
SHA1c3907b59b8a1c57c9f443115f64aa669bbc1b6bc
SHA256a1106bd299e5d8ca5583ddb31e0a8dbbc2293dbeb3645fc20d40710d73354a4f
SHA5125bf77d240ee08efe89f0ee6bb406520549669b8cda8f47a1bbc381a7babfcde22642b29d0460870da5cff61e31ccb0de7a633d2ebd0d630f39d57d2c02071d1a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6439335.exeFilesize
526KB
MD5b4717633e237be857a900fb417f2675b
SHA1c3907b59b8a1c57c9f443115f64aa669bbc1b6bc
SHA256a1106bd299e5d8ca5583ddb31e0a8dbbc2293dbeb3645fc20d40710d73354a4f
SHA5125bf77d240ee08efe89f0ee6bb406520549669b8cda8f47a1bbc381a7babfcde22642b29d0460870da5cff61e31ccb0de7a633d2ebd0d630f39d57d2c02071d1a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1704280.exeFilesize
310KB
MD5c219666b0b352c44400430d4a8dc2ae4
SHA14b2332d99afebd6afa12e30b6534c0c6ec28663c
SHA256534054182d65c7180ebab3aa001a067e412f580f5c4f5accbad8cec84e95ce4b
SHA51292bd925381c82f4b6796bbed9e36c0a3d9b53f595e31e51eaccf1b35a0cf5c549a16eb9666e6255072bf78046e36725d400f2c50e163447ebfb63ec56d953e00
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1704280.exeFilesize
310KB
MD5c219666b0b352c44400430d4a8dc2ae4
SHA14b2332d99afebd6afa12e30b6534c0c6ec28663c
SHA256534054182d65c7180ebab3aa001a067e412f580f5c4f5accbad8cec84e95ce4b
SHA51292bd925381c82f4b6796bbed9e36c0a3d9b53f595e31e51eaccf1b35a0cf5c549a16eb9666e6255072bf78046e36725d400f2c50e163447ebfb63ec56d953e00
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4883012.exeFilesize
296KB
MD5800deb32530ad2f226b8f1ae251834c9
SHA1fe9deb1839c9fb813de4ee303ba8078cbc20ebb5
SHA256eae413beaa462dfada3940ab480d4b99a5010afa404dc8aeff3cc35fe3748abf
SHA5129857b9dadc70739ee4ed410b91cd72aa8dffd46c2db9da7054f31c523360bf3b4c88c5194b2637b15f5b4ddfe69a0330dc9b8f4fb12e3cfb6e0f96d8e59e5e8a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4883012.exeFilesize
296KB
MD5800deb32530ad2f226b8f1ae251834c9
SHA1fe9deb1839c9fb813de4ee303ba8078cbc20ebb5
SHA256eae413beaa462dfada3940ab480d4b99a5010afa404dc8aeff3cc35fe3748abf
SHA5129857b9dadc70739ee4ed410b91cd72aa8dffd46c2db9da7054f31c523360bf3b4c88c5194b2637b15f5b4ddfe69a0330dc9b8f4fb12e3cfb6e0f96d8e59e5e8a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7653291.exeFilesize
11KB
MD53f652ac3987ab9790e226efd2f2309e5
SHA1948b131f2d92f8f4aef78bc95dcf8cc2f900769d
SHA256dc5b5d3bb61422a17ef56270aba97cc57588d1950cc0df91abe5efe474327c28
SHA512b515ced1a3a522d051680a9f1118e896d90d9bcef7593445d7a20a0b00020cfbce27a5c3d7060f6e4f75ea87e052b27d900d190a54de36ca7442014d6509c9f7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7653291.exeFilesize
11KB
MD53f652ac3987ab9790e226efd2f2309e5
SHA1948b131f2d92f8f4aef78bc95dcf8cc2f900769d
SHA256dc5b5d3bb61422a17ef56270aba97cc57588d1950cc0df91abe5efe474327c28
SHA512b515ced1a3a522d051680a9f1118e896d90d9bcef7593445d7a20a0b00020cfbce27a5c3d7060f6e4f75ea87e052b27d900d190a54de36ca7442014d6509c9f7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2709637.exeFilesize
276KB
MD52f494b62ce3eaacb7db2e348cbfaf430
SHA11461ac28fdaf9659b44c3f4449048076e6fa93d1
SHA256f43aeda614e92a252d6208b8f09ec5adaf5263f76e76d1981d0b0dc67381f183
SHA5121eed4cb267991bdd1303722d46e48566a04966e833e56f6cfee34a2274113a838e52dfcffffe8ea01d707e474dee30966b454fb3e29d239cd62d36629b4122c2
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2709637.exeFilesize
276KB
MD52f494b62ce3eaacb7db2e348cbfaf430
SHA11461ac28fdaf9659b44c3f4449048076e6fa93d1
SHA256f43aeda614e92a252d6208b8f09ec5adaf5263f76e76d1981d0b0dc67381f183
SHA5121eed4cb267991bdd1303722d46e48566a04966e833e56f6cfee34a2274113a838e52dfcffffe8ea01d707e474dee30966b454fb3e29d239cd62d36629b4122c2
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2872-71-0x0000000004F00000-0x000000000500A000-memory.dmpFilesize
1.0MB
-
memory/2872-52-0x0000000004D40000-0x0000000004D46000-memory.dmpFilesize
24KB
-
memory/2872-87-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/2872-65-0x0000000005410000-0x0000000005A28000-memory.dmpFilesize
6.1MB
-
memory/2872-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2872-82-0x0000000004E90000-0x0000000004EDC000-memory.dmpFilesize
304KB
-
memory/2872-80-0x0000000004E10000-0x0000000004E4C000-memory.dmpFilesize
240KB
-
memory/2872-73-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/2872-72-0x0000000004DF0000-0x0000000004E02000-memory.dmpFilesize
72KB
-
memory/2872-86-0x0000000073900000-0x00000000740B0000-memory.dmpFilesize
7.7MB
-
memory/2872-51-0x0000000073900000-0x00000000740B0000-memory.dmpFilesize
7.7MB
-
memory/3216-38-0x00007FFF4E150000-0x00007FFF4EC11000-memory.dmpFilesize
10.8MB
-
memory/3216-36-0x00007FFF4E150000-0x00007FFF4EC11000-memory.dmpFilesize
10.8MB
-
memory/3216-35-0x0000000000A20000-0x0000000000A2A000-memory.dmpFilesize
40KB
-
memory/4920-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4920-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4920-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4920-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB