Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:13
Static task
static1
Behavioral task
behavioral1
Sample
800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe
Resource
win7-20230831-en
General
-
Target
800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe
-
Size
993KB
-
MD5
30e67ee2a199e78d2435ad5bacb66f0e
-
SHA1
36c302829a5e9921cc635527271aa7bf40fa8842
-
SHA256
800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d
-
SHA512
3dfe70553deb00e6456ee958b7306f1f7ca184ac4880f47ccdf437f7024463d131d9babe474ff15dc7f309b2a3cd2ca09e35e7b2ae7ce9ea4278e5f447dc58d7
-
SSDEEP
24576:yyWa5kv7i2f6hsp73eImeXaYCEntqdmeACAKAry5:ZW/v70HImIxKey
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5032-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5032-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5032-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/5032-46-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2284947.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2284947.exe healer behavioral2/memory/5016-35-0x0000000000980000-0x000000000098A000-memory.dmp healer -
Processes:
q2284947.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q2284947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q2284947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q2284947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q2284947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q2284947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q2284947.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t6765043.exeexplothe.exeu3051994.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t6765043.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u3051994.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z3458224.exez4288048.exez5870466.exez4584080.exeq2284947.exer1396827.exes0209581.exet6765043.exeexplothe.exeu3051994.exelegota.exew5434261.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 2864 z3458224.exe 3660 z4288048.exe 5036 z5870466.exe 2160 z4584080.exe 5016 q2284947.exe 1472 r1396827.exe 4804 s0209581.exe 3020 t6765043.exe 3388 explothe.exe 2876 u3051994.exe 3852 legota.exe 3792 w5434261.exe 4220 explothe.exe 3728 legota.exe 4060 explothe.exe 3264 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1008 rundll32.exe 2176 rundll32.exe -
Processes:
q2284947.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q2284947.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exez3458224.exez4288048.exez5870466.exez4584080.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3458224.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4288048.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z5870466.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z4584080.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r1396827.exes0209581.exedescription pid process target process PID 1472 set thread context of 5032 1472 r1396827.exe AppLaunch.exe PID 4804 set thread context of 1492 4804 s0209581.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3264 1472 WerFault.exe r1396827.exe 4020 5032 WerFault.exe AppLaunch.exe 1268 4804 WerFault.exe s0209581.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4584 schtasks.exe 3260 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q2284947.exepid process 5016 q2284947.exe 5016 q2284947.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q2284947.exedescription pid process Token: SeDebugPrivilege 5016 q2284947.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exez3458224.exez4288048.exez5870466.exez4584080.exer1396827.exes0209581.exet6765043.exeexplothe.exeu3051994.exelegota.execmd.exedescription pid process target process PID 5104 wrote to memory of 2864 5104 800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe z3458224.exe PID 5104 wrote to memory of 2864 5104 800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe z3458224.exe PID 5104 wrote to memory of 2864 5104 800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe z3458224.exe PID 2864 wrote to memory of 3660 2864 z3458224.exe z4288048.exe PID 2864 wrote to memory of 3660 2864 z3458224.exe z4288048.exe PID 2864 wrote to memory of 3660 2864 z3458224.exe z4288048.exe PID 3660 wrote to memory of 5036 3660 z4288048.exe z5870466.exe PID 3660 wrote to memory of 5036 3660 z4288048.exe z5870466.exe PID 3660 wrote to memory of 5036 3660 z4288048.exe z5870466.exe PID 5036 wrote to memory of 2160 5036 z5870466.exe z4584080.exe PID 5036 wrote to memory of 2160 5036 z5870466.exe z4584080.exe PID 5036 wrote to memory of 2160 5036 z5870466.exe z4584080.exe PID 2160 wrote to memory of 5016 2160 z4584080.exe q2284947.exe PID 2160 wrote to memory of 5016 2160 z4584080.exe q2284947.exe PID 2160 wrote to memory of 1472 2160 z4584080.exe r1396827.exe PID 2160 wrote to memory of 1472 2160 z4584080.exe r1396827.exe PID 2160 wrote to memory of 1472 2160 z4584080.exe r1396827.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 1472 wrote to memory of 5032 1472 r1396827.exe AppLaunch.exe PID 5036 wrote to memory of 4804 5036 z5870466.exe s0209581.exe PID 5036 wrote to memory of 4804 5036 z5870466.exe s0209581.exe PID 5036 wrote to memory of 4804 5036 z5870466.exe s0209581.exe PID 4804 wrote to memory of 1492 4804 s0209581.exe AppLaunch.exe PID 4804 wrote to memory of 1492 4804 s0209581.exe AppLaunch.exe PID 4804 wrote to memory of 1492 4804 s0209581.exe AppLaunch.exe PID 4804 wrote to memory of 1492 4804 s0209581.exe AppLaunch.exe PID 4804 wrote to memory of 1492 4804 s0209581.exe AppLaunch.exe PID 4804 wrote to memory of 1492 4804 s0209581.exe AppLaunch.exe PID 4804 wrote to memory of 1492 4804 s0209581.exe AppLaunch.exe PID 4804 wrote to memory of 1492 4804 s0209581.exe AppLaunch.exe PID 3660 wrote to memory of 3020 3660 z4288048.exe t6765043.exe PID 3660 wrote to memory of 3020 3660 z4288048.exe t6765043.exe PID 3660 wrote to memory of 3020 3660 z4288048.exe t6765043.exe PID 3020 wrote to memory of 3388 3020 t6765043.exe explothe.exe PID 3020 wrote to memory of 3388 3020 t6765043.exe explothe.exe PID 3020 wrote to memory of 3388 3020 t6765043.exe explothe.exe PID 2864 wrote to memory of 2876 2864 z3458224.exe u3051994.exe PID 2864 wrote to memory of 2876 2864 z3458224.exe u3051994.exe PID 2864 wrote to memory of 2876 2864 z3458224.exe u3051994.exe PID 3388 wrote to memory of 3260 3388 explothe.exe schtasks.exe PID 3388 wrote to memory of 3260 3388 explothe.exe schtasks.exe PID 3388 wrote to memory of 3260 3388 explothe.exe schtasks.exe PID 3388 wrote to memory of 2900 3388 explothe.exe cmd.exe PID 3388 wrote to memory of 2900 3388 explothe.exe cmd.exe PID 3388 wrote to memory of 2900 3388 explothe.exe cmd.exe PID 2876 wrote to memory of 3852 2876 u3051994.exe legota.exe PID 2876 wrote to memory of 3852 2876 u3051994.exe legota.exe PID 2876 wrote to memory of 3852 2876 u3051994.exe legota.exe PID 5104 wrote to memory of 3792 5104 800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe w5434261.exe PID 5104 wrote to memory of 3792 5104 800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe w5434261.exe PID 5104 wrote to memory of 3792 5104 800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe w5434261.exe PID 3852 wrote to memory of 4584 3852 legota.exe schtasks.exe PID 3852 wrote to memory of 4584 3852 legota.exe schtasks.exe PID 3852 wrote to memory of 4584 3852 legota.exe schtasks.exe PID 2900 wrote to memory of 3968 2900 cmd.exe cmd.exe PID 2900 wrote to memory of 3968 2900 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe"C:\Users\Admin\AppData\Local\Temp\800eff7a54297d0adcb4366b532857b2e9a0421c127ba310459017019c49b79d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3458224.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3458224.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4288048.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4288048.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5870466.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5870466.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4584080.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4584080.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2284947.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2284947.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1396827.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1396827.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 2207⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0209581.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0209581.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 5846⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6765043.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6765043.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3051994.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3051994.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5434261.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5434261.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1472 -ip 14721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4804 -ip 48041⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5434261.exeFilesize
23KB
MD5a65742245c244e1f15957c7b523a3bc1
SHA1f4a1f37d50b33020cc6994a5ff42696578f0cf8f
SHA2568f13068f8398c3856639bc3d84b071aaf52d24e47d6f28cc5f1d1faf0620bef8
SHA512d91743f59310bb17e5692998fd8485050051c69f0414ba492eb461b3248a44c523b70db48a3838ba32c59f8d32c82dbe1c8abb148b673fed7e3338160dc54268
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5434261.exeFilesize
23KB
MD5a65742245c244e1f15957c7b523a3bc1
SHA1f4a1f37d50b33020cc6994a5ff42696578f0cf8f
SHA2568f13068f8398c3856639bc3d84b071aaf52d24e47d6f28cc5f1d1faf0620bef8
SHA512d91743f59310bb17e5692998fd8485050051c69f0414ba492eb461b3248a44c523b70db48a3838ba32c59f8d32c82dbe1c8abb148b673fed7e3338160dc54268
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3458224.exeFilesize
892KB
MD5d56a64b03a98294ed058013d9ba82674
SHA11a0f2fe1bbee5f2f3f8db0ba9795c7a32826d76c
SHA25620fdb0d887eb1ad8103564cb665be623e6bb9970ab8584afb8f3b7d50b08806a
SHA5122747d11273d854300e8e1fe65964a02149d8ca962bc335a702c5431b301e8795d1052f56410fa6991fa517866d8bd50d558e1add1cb926bef3a19d5142d21c8f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3458224.exeFilesize
892KB
MD5d56a64b03a98294ed058013d9ba82674
SHA11a0f2fe1bbee5f2f3f8db0ba9795c7a32826d76c
SHA25620fdb0d887eb1ad8103564cb665be623e6bb9970ab8584afb8f3b7d50b08806a
SHA5122747d11273d854300e8e1fe65964a02149d8ca962bc335a702c5431b301e8795d1052f56410fa6991fa517866d8bd50d558e1add1cb926bef3a19d5142d21c8f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3051994.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3051994.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4288048.exeFilesize
709KB
MD56434ddf4438ec4f260a22032c5e4811f
SHA1699e0ee95696e54ecd5142991e611ee977d1a194
SHA25639ffa0e2ad4a8d1e7b21244f3265bc30d114c618335beb456d5ca9f68ed68dc5
SHA512dff133066de290342af532aec6e95188c67a1d30e5921389e5eeb94c9a9af23409423233d21b8a60305e923b313c68b310b76e108dcbb4d3a2a7bfa3ee8e0ddd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4288048.exeFilesize
709KB
MD56434ddf4438ec4f260a22032c5e4811f
SHA1699e0ee95696e54ecd5142991e611ee977d1a194
SHA25639ffa0e2ad4a8d1e7b21244f3265bc30d114c618335beb456d5ca9f68ed68dc5
SHA512dff133066de290342af532aec6e95188c67a1d30e5921389e5eeb94c9a9af23409423233d21b8a60305e923b313c68b310b76e108dcbb4d3a2a7bfa3ee8e0ddd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6765043.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6765043.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5870466.exeFilesize
527KB
MD5bd08a1b887e1b311e7426fbc7b786030
SHA1448e5bf231a4a9a706f5c5a1a5b069c643bbfda4
SHA2561fd2552021e62cf48858ed86a19717db679a0e1f6aee48c8e100c943b2daea53
SHA5121614bcf2653c80785ae3b371b4ba945480c075a55740cb584e440c76aa58a60e2b6da1257985ae13b91e09af5f7a80ddf73a18f480b94f7ec15050be45e1e04e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5870466.exeFilesize
527KB
MD5bd08a1b887e1b311e7426fbc7b786030
SHA1448e5bf231a4a9a706f5c5a1a5b069c643bbfda4
SHA2561fd2552021e62cf48858ed86a19717db679a0e1f6aee48c8e100c943b2daea53
SHA5121614bcf2653c80785ae3b371b4ba945480c075a55740cb584e440c76aa58a60e2b6da1257985ae13b91e09af5f7a80ddf73a18f480b94f7ec15050be45e1e04e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0209581.exeFilesize
310KB
MD5fde3f6670cd3afe2a89e992783b8e7a6
SHA1b1497ae43b4ac59da05f5724b026c481469385e0
SHA256bf5cc5378495ed21a0a27dd0ed69e01941ac8229f372c858e517fa6e185e0d45
SHA512f64219e25a22b2213daa07cb55b044c4bbc2a29d3b76e3cb1e019ba92af7adb3a6bcdb6e8ab114f89c9e86e613ea46ed1a630269f71b2022cea6395cd08dd2b9
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0209581.exeFilesize
310KB
MD5fde3f6670cd3afe2a89e992783b8e7a6
SHA1b1497ae43b4ac59da05f5724b026c481469385e0
SHA256bf5cc5378495ed21a0a27dd0ed69e01941ac8229f372c858e517fa6e185e0d45
SHA512f64219e25a22b2213daa07cb55b044c4bbc2a29d3b76e3cb1e019ba92af7adb3a6bcdb6e8ab114f89c9e86e613ea46ed1a630269f71b2022cea6395cd08dd2b9
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4584080.exeFilesize
296KB
MD59870586ea94a00e4176b179a3eaeca1d
SHA14b8d9847b14e6556ef89dc5da579425993c2e25c
SHA256aefe6e449c3f79a168bc356e9c27dd5e729ebb8fc2d71f414fea557afb602ff2
SHA512f240668fd2cf967d41235c74eb323055be7e59e2b41177e6a11f64982d3148a3154912efe04f464b7d31649aa46a3fc5f7c85f48aaca5496a48ba3c2022031fb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4584080.exeFilesize
296KB
MD59870586ea94a00e4176b179a3eaeca1d
SHA14b8d9847b14e6556ef89dc5da579425993c2e25c
SHA256aefe6e449c3f79a168bc356e9c27dd5e729ebb8fc2d71f414fea557afb602ff2
SHA512f240668fd2cf967d41235c74eb323055be7e59e2b41177e6a11f64982d3148a3154912efe04f464b7d31649aa46a3fc5f7c85f48aaca5496a48ba3c2022031fb
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2284947.exeFilesize
11KB
MD5b244afaa97855241ac1ed5cb6f70910f
SHA103900915b3122ba84c0e294e0f8996b50cd11bf7
SHA256b9386da645f260235f0a89bbbbc14335319434de613e98d373de6b7d656f191a
SHA512a00a04c1f98d98cf3cc48845000e9264f5a7f9866f28f40fbc4adc83132d7781237fa2895bdf81ddf9d56dc4e5eeac5130ab9f779da105d7a53566ce17b9d01f
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2284947.exeFilesize
11KB
MD5b244afaa97855241ac1ed5cb6f70910f
SHA103900915b3122ba84c0e294e0f8996b50cd11bf7
SHA256b9386da645f260235f0a89bbbbc14335319434de613e98d373de6b7d656f191a
SHA512a00a04c1f98d98cf3cc48845000e9264f5a7f9866f28f40fbc4adc83132d7781237fa2895bdf81ddf9d56dc4e5eeac5130ab9f779da105d7a53566ce17b9d01f
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1396827.exeFilesize
276KB
MD564f4446aafc745794553a9f724afbd54
SHA181415a6ee7724ff6aae8806bbac2adfe18f47952
SHA256804f7218408a33ea8c6b1f9c677cc131b9e9d116c53da74eb631514ee93d2077
SHA51207dbd0649c2a8ceb6bf905cb78be80c9bd95240d186b97282d8bfe2fae937a75bc20972eedd5cd948c4ec54a1cf45ea2921f78fe9ce3597ca230d8c44f41ad3f
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1396827.exeFilesize
276KB
MD564f4446aafc745794553a9f724afbd54
SHA181415a6ee7724ff6aae8806bbac2adfe18f47952
SHA256804f7218408a33ea8c6b1f9c677cc131b9e9d116c53da74eb631514ee93d2077
SHA51207dbd0649c2a8ceb6bf905cb78be80c9bd95240d186b97282d8bfe2fae937a75bc20972eedd5cd948c4ec54a1cf45ea2921f78fe9ce3597ca230d8c44f41ad3f
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1492-85-0x000000000A430000-0x000000000A46C000-memory.dmpFilesize
240KB
-
memory/1492-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1492-57-0x0000000004E10000-0x0000000004E16000-memory.dmpFilesize
24KB
-
memory/1492-61-0x0000000073CD0000-0x0000000074480000-memory.dmpFilesize
7.7MB
-
memory/1492-86-0x000000000A5B0000-0x000000000A5FC000-memory.dmpFilesize
304KB
-
memory/1492-87-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/1492-56-0x0000000073CD0000-0x0000000074480000-memory.dmpFilesize
7.7MB
-
memory/1492-81-0x0000000004EB0000-0x0000000004EC0000-memory.dmpFilesize
64KB
-
memory/1492-80-0x000000000A3D0000-0x000000000A3E2000-memory.dmpFilesize
72KB
-
memory/1492-71-0x000000000A960000-0x000000000AF78000-memory.dmpFilesize
6.1MB
-
memory/1492-79-0x000000000A4A0000-0x000000000A5AA000-memory.dmpFilesize
1.0MB
-
memory/5016-38-0x00007FFACE490000-0x00007FFACEF51000-memory.dmpFilesize
10.8MB
-
memory/5016-36-0x00007FFACE490000-0x00007FFACEF51000-memory.dmpFilesize
10.8MB
-
memory/5016-35-0x0000000000980000-0x000000000098A000-memory.dmpFilesize
40KB
-
memory/5032-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/5032-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/5032-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/5032-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB