Analysis Overview
SHA256
8f8eca488aa8954e2788ed7922382663829cabbda5e5e78b2d2cf9eba09659ae
Threat Level: Known bad
The file 8f8eca488aa8954e2788ed7922382663829cabbda5e5e78b2d2cf9eba09659ae was found to be: Known bad.
Malicious Activity Summary
Detects Healer an antivirus disabler dropper
Detect Mystic stealer payload
Healer
Modifies Windows Defender Real-time Protection settings
Amadey
RedLine
Mystic
Windows security modification
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Adds Run key to start application
Suspicious use of SetThreadContext
Program crash
Unsigned PE
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 21:25
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 21:25
Reported
2023-10-10 22:35
Platform
win7-20230831-en
Max time kernel
120s
Max time network
123s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\8f8eca488aa8954e2788ed7922382663829cabbda5e5e78b2d2cf9eba09659ae.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2972 set thread context of 2860 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\8f8eca488aa8954e2788ed7922382663829cabbda5e5e78b2d2cf9eba09659ae.exe
"C:\Users\Admin\AppData\Local\Temp\8f8eca488aa8954e2788ed7922382663829cabbda5e5e78b2d2cf9eba09659ae.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 36
Network
| Country | Destination | Domain | Proto |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
| MD5 | 557f6e229a56055dbd0fc1e1460a9626 |
| SHA1 | e71d9b2d1d2c707475d171e9c19cd0027e1533f2 |
| SHA256 | dce6964348e2b7f5a81dec0e15169550624a4a3645453ddd9c8329a3bf753274 |
| SHA512 | 6939ac942f2d691523ad5b615c3dbac1ba4aee32720ad229b476e8c09abfa8dc17eafdd91466a6d48c2d8860b51317845216e969a20a665e0dc5d45dfbe74a23 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
| MD5 | 557f6e229a56055dbd0fc1e1460a9626 |
| SHA1 | e71d9b2d1d2c707475d171e9c19cd0027e1533f2 |
| SHA256 | dce6964348e2b7f5a81dec0e15169550624a4a3645453ddd9c8329a3bf753274 |
| SHA512 | 6939ac942f2d691523ad5b615c3dbac1ba4aee32720ad229b476e8c09abfa8dc17eafdd91466a6d48c2d8860b51317845216e969a20a665e0dc5d45dfbe74a23 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
| MD5 | 557f6e229a56055dbd0fc1e1460a9626 |
| SHA1 | e71d9b2d1d2c707475d171e9c19cd0027e1533f2 |
| SHA256 | dce6964348e2b7f5a81dec0e15169550624a4a3645453ddd9c8329a3bf753274 |
| SHA512 | 6939ac942f2d691523ad5b615c3dbac1ba4aee32720ad229b476e8c09abfa8dc17eafdd91466a6d48c2d8860b51317845216e969a20a665e0dc5d45dfbe74a23 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
| MD5 | 557f6e229a56055dbd0fc1e1460a9626 |
| SHA1 | e71d9b2d1d2c707475d171e9c19cd0027e1533f2 |
| SHA256 | dce6964348e2b7f5a81dec0e15169550624a4a3645453ddd9c8329a3bf753274 |
| SHA512 | 6939ac942f2d691523ad5b615c3dbac1ba4aee32720ad229b476e8c09abfa8dc17eafdd91466a6d48c2d8860b51317845216e969a20a665e0dc5d45dfbe74a23 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
| MD5 | c2fa8ed06e2029d052bd39d414fd2a8c |
| SHA1 | b48afd7233edab953aaced2de85a33febd725292 |
| SHA256 | 82ece7b3a2e3e58578107f249fc14bf75503710bea0c8882afd81ea1d6debef1 |
| SHA512 | e0a94e0dae856abdc8468a79e7923ac23f11b3d751e7db8c3a20c453135052f6af1ba8c8d70b631549b04dccfc6786c94c9a5f101226f8c9e49782510497a173 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
| MD5 | c2fa8ed06e2029d052bd39d414fd2a8c |
| SHA1 | b48afd7233edab953aaced2de85a33febd725292 |
| SHA256 | 82ece7b3a2e3e58578107f249fc14bf75503710bea0c8882afd81ea1d6debef1 |
| SHA512 | e0a94e0dae856abdc8468a79e7923ac23f11b3d751e7db8c3a20c453135052f6af1ba8c8d70b631549b04dccfc6786c94c9a5f101226f8c9e49782510497a173 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
| MD5 | c2fa8ed06e2029d052bd39d414fd2a8c |
| SHA1 | b48afd7233edab953aaced2de85a33febd725292 |
| SHA256 | 82ece7b3a2e3e58578107f249fc14bf75503710bea0c8882afd81ea1d6debef1 |
| SHA512 | e0a94e0dae856abdc8468a79e7923ac23f11b3d751e7db8c3a20c453135052f6af1ba8c8d70b631549b04dccfc6786c94c9a5f101226f8c9e49782510497a173 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
| MD5 | c2fa8ed06e2029d052bd39d414fd2a8c |
| SHA1 | b48afd7233edab953aaced2de85a33febd725292 |
| SHA256 | 82ece7b3a2e3e58578107f249fc14bf75503710bea0c8882afd81ea1d6debef1 |
| SHA512 | e0a94e0dae856abdc8468a79e7923ac23f11b3d751e7db8c3a20c453135052f6af1ba8c8d70b631549b04dccfc6786c94c9a5f101226f8c9e49782510497a173 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
| MD5 | ae905fc14b0efe05c12030cec659d6e2 |
| SHA1 | 04d59a36ad254c0907da344569083716e1b09e2b |
| SHA256 | 7aad007036439363cfe4da8e9a1004a101456616e6215f955783eb7d30f5a798 |
| SHA512 | 6d6337c09853fb8032d69f397339b79f2e3fb7629b5590df37ef5fc22ff19f92258e7ef5ce169ef9916c1b08e572c004de55fa0a6342a987f17bd2694167365a |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
| MD5 | ae905fc14b0efe05c12030cec659d6e2 |
| SHA1 | 04d59a36ad254c0907da344569083716e1b09e2b |
| SHA256 | 7aad007036439363cfe4da8e9a1004a101456616e6215f955783eb7d30f5a798 |
| SHA512 | 6d6337c09853fb8032d69f397339b79f2e3fb7629b5590df37ef5fc22ff19f92258e7ef5ce169ef9916c1b08e572c004de55fa0a6342a987f17bd2694167365a |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
| MD5 | ae905fc14b0efe05c12030cec659d6e2 |
| SHA1 | 04d59a36ad254c0907da344569083716e1b09e2b |
| SHA256 | 7aad007036439363cfe4da8e9a1004a101456616e6215f955783eb7d30f5a798 |
| SHA512 | 6d6337c09853fb8032d69f397339b79f2e3fb7629b5590df37ef5fc22ff19f92258e7ef5ce169ef9916c1b08e572c004de55fa0a6342a987f17bd2694167365a |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
| MD5 | ae905fc14b0efe05c12030cec659d6e2 |
| SHA1 | 04d59a36ad254c0907da344569083716e1b09e2b |
| SHA256 | 7aad007036439363cfe4da8e9a1004a101456616e6215f955783eb7d30f5a798 |
| SHA512 | 6d6337c09853fb8032d69f397339b79f2e3fb7629b5590df37ef5fc22ff19f92258e7ef5ce169ef9916c1b08e572c004de55fa0a6342a987f17bd2694167365a |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
| MD5 | 650234d5139f7b28a81102e973be959c |
| SHA1 | b1ad5eeb36a4edd0180c66f6dc2e5bbd336840a8 |
| SHA256 | cacdeec4a4651ddbccf61012e26353fdf87aa44e79b8931e6ddfb5fe0665912f |
| SHA512 | 142179c7cc55f99b259980d0563bbd7160afe30e161f7215c81169c708648de8a135717cc070c3b1cf60bc7846570960406556c5e84a9ee12aabcff388a59d16 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
| MD5 | 650234d5139f7b28a81102e973be959c |
| SHA1 | b1ad5eeb36a4edd0180c66f6dc2e5bbd336840a8 |
| SHA256 | cacdeec4a4651ddbccf61012e26353fdf87aa44e79b8931e6ddfb5fe0665912f |
| SHA512 | 142179c7cc55f99b259980d0563bbd7160afe30e161f7215c81169c708648de8a135717cc070c3b1cf60bc7846570960406556c5e84a9ee12aabcff388a59d16 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
| MD5 | 650234d5139f7b28a81102e973be959c |
| SHA1 | b1ad5eeb36a4edd0180c66f6dc2e5bbd336840a8 |
| SHA256 | cacdeec4a4651ddbccf61012e26353fdf87aa44e79b8931e6ddfb5fe0665912f |
| SHA512 | 142179c7cc55f99b259980d0563bbd7160afe30e161f7215c81169c708648de8a135717cc070c3b1cf60bc7846570960406556c5e84a9ee12aabcff388a59d16 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
| MD5 | 650234d5139f7b28a81102e973be959c |
| SHA1 | b1ad5eeb36a4edd0180c66f6dc2e5bbd336840a8 |
| SHA256 | cacdeec4a4651ddbccf61012e26353fdf87aa44e79b8931e6ddfb5fe0665912f |
| SHA512 | 142179c7cc55f99b259980d0563bbd7160afe30e161f7215c81169c708648de8a135717cc070c3b1cf60bc7846570960406556c5e84a9ee12aabcff388a59d16 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe
| MD5 | 8af5a0b45c9f8bb2e7f0fab976697103 |
| SHA1 | 5a48f42c586c5ac8b42afe8114de9ae3481f864f |
| SHA256 | 8169823840c271c76b5e69b3634f9f9dee6017589f32fbdb37f43a34b145cff9 |
| SHA512 | 33a0ebe0727a276d94c176885f9c04c0026b1bad5dbee68ad11fff97455c2ba50381081f2df7bcb3d74576374d9e5c3872708ed4890aa716dde4a6e6e0b74847 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe
| MD5 | 8af5a0b45c9f8bb2e7f0fab976697103 |
| SHA1 | 5a48f42c586c5ac8b42afe8114de9ae3481f864f |
| SHA256 | 8169823840c271c76b5e69b3634f9f9dee6017589f32fbdb37f43a34b145cff9 |
| SHA512 | 33a0ebe0727a276d94c176885f9c04c0026b1bad5dbee68ad11fff97455c2ba50381081f2df7bcb3d74576374d9e5c3872708ed4890aa716dde4a6e6e0b74847 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe
| MD5 | 8af5a0b45c9f8bb2e7f0fab976697103 |
| SHA1 | 5a48f42c586c5ac8b42afe8114de9ae3481f864f |
| SHA256 | 8169823840c271c76b5e69b3634f9f9dee6017589f32fbdb37f43a34b145cff9 |
| SHA512 | 33a0ebe0727a276d94c176885f9c04c0026b1bad5dbee68ad11fff97455c2ba50381081f2df7bcb3d74576374d9e5c3872708ed4890aa716dde4a6e6e0b74847 |
memory/2844-48-0x0000000000940000-0x000000000094A000-memory.dmp
memory/2844-49-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp
memory/2844-50-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp
memory/2844-51-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
memory/2860-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2860-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2860-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2860-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2860-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2860-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2860-69-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2860-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2860-72-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2860-74-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2860-75-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
memory/2860-80-0x0000000000400000-0x0000000000428000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 21:25
Reported
2023-10-10 22:36
Platform
win10v2004-20230915-en
Max time kernel
151s
Max time network
174s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0984936.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0670560.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\8f8eca488aa8954e2788ed7922382663829cabbda5e5e78b2d2cf9eba09659ae.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1324 set thread context of 3544 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4524 set thread context of 224 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2955673.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\8f8eca488aa8954e2788ed7922382663829cabbda5e5e78b2d2cf9eba09659ae.exe
"C:\Users\Admin\AppData\Local\Temp\8f8eca488aa8954e2788ed7922382663829cabbda5e5e78b2d2cf9eba09659ae.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1324 -ip 1324
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3544 -ip 3544
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 224
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2955673.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2955673.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4524 -ip 4524
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 580
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0984936.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0984936.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0670560.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0670560.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7456714.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7456714.exe
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 254.20.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.113.22.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.120.234.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
| MD5 | 557f6e229a56055dbd0fc1e1460a9626 |
| SHA1 | e71d9b2d1d2c707475d171e9c19cd0027e1533f2 |
| SHA256 | dce6964348e2b7f5a81dec0e15169550624a4a3645453ddd9c8329a3bf753274 |
| SHA512 | 6939ac942f2d691523ad5b615c3dbac1ba4aee32720ad229b476e8c09abfa8dc17eafdd91466a6d48c2d8860b51317845216e969a20a665e0dc5d45dfbe74a23 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1542755.exe
| MD5 | 557f6e229a56055dbd0fc1e1460a9626 |
| SHA1 | e71d9b2d1d2c707475d171e9c19cd0027e1533f2 |
| SHA256 | dce6964348e2b7f5a81dec0e15169550624a4a3645453ddd9c8329a3bf753274 |
| SHA512 | 6939ac942f2d691523ad5b615c3dbac1ba4aee32720ad229b476e8c09abfa8dc17eafdd91466a6d48c2d8860b51317845216e969a20a665e0dc5d45dfbe74a23 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
| MD5 | c2fa8ed06e2029d052bd39d414fd2a8c |
| SHA1 | b48afd7233edab953aaced2de85a33febd725292 |
| SHA256 | 82ece7b3a2e3e58578107f249fc14bf75503710bea0c8882afd81ea1d6debef1 |
| SHA512 | e0a94e0dae856abdc8468a79e7923ac23f11b3d751e7db8c3a20c453135052f6af1ba8c8d70b631549b04dccfc6786c94c9a5f101226f8c9e49782510497a173 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9003942.exe
| MD5 | c2fa8ed06e2029d052bd39d414fd2a8c |
| SHA1 | b48afd7233edab953aaced2de85a33febd725292 |
| SHA256 | 82ece7b3a2e3e58578107f249fc14bf75503710bea0c8882afd81ea1d6debef1 |
| SHA512 | e0a94e0dae856abdc8468a79e7923ac23f11b3d751e7db8c3a20c453135052f6af1ba8c8d70b631549b04dccfc6786c94c9a5f101226f8c9e49782510497a173 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
| MD5 | ae905fc14b0efe05c12030cec659d6e2 |
| SHA1 | 04d59a36ad254c0907da344569083716e1b09e2b |
| SHA256 | 7aad007036439363cfe4da8e9a1004a101456616e6215f955783eb7d30f5a798 |
| SHA512 | 6d6337c09853fb8032d69f397339b79f2e3fb7629b5590df37ef5fc22ff19f92258e7ef5ce169ef9916c1b08e572c004de55fa0a6342a987f17bd2694167365a |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1168906.exe
| MD5 | ae905fc14b0efe05c12030cec659d6e2 |
| SHA1 | 04d59a36ad254c0907da344569083716e1b09e2b |
| SHA256 | 7aad007036439363cfe4da8e9a1004a101456616e6215f955783eb7d30f5a798 |
| SHA512 | 6d6337c09853fb8032d69f397339b79f2e3fb7629b5590df37ef5fc22ff19f92258e7ef5ce169ef9916c1b08e572c004de55fa0a6342a987f17bd2694167365a |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
| MD5 | 650234d5139f7b28a81102e973be959c |
| SHA1 | b1ad5eeb36a4edd0180c66f6dc2e5bbd336840a8 |
| SHA256 | cacdeec4a4651ddbccf61012e26353fdf87aa44e79b8931e6ddfb5fe0665912f |
| SHA512 | 142179c7cc55f99b259980d0563bbd7160afe30e161f7215c81169c708648de8a135717cc070c3b1cf60bc7846570960406556c5e84a9ee12aabcff388a59d16 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2720784.exe
| MD5 | 650234d5139f7b28a81102e973be959c |
| SHA1 | b1ad5eeb36a4edd0180c66f6dc2e5bbd336840a8 |
| SHA256 | cacdeec4a4651ddbccf61012e26353fdf87aa44e79b8931e6ddfb5fe0665912f |
| SHA512 | 142179c7cc55f99b259980d0563bbd7160afe30e161f7215c81169c708648de8a135717cc070c3b1cf60bc7846570960406556c5e84a9ee12aabcff388a59d16 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe
| MD5 | 8af5a0b45c9f8bb2e7f0fab976697103 |
| SHA1 | 5a48f42c586c5ac8b42afe8114de9ae3481f864f |
| SHA256 | 8169823840c271c76b5e69b3634f9f9dee6017589f32fbdb37f43a34b145cff9 |
| SHA512 | 33a0ebe0727a276d94c176885f9c04c0026b1bad5dbee68ad11fff97455c2ba50381081f2df7bcb3d74576374d9e5c3872708ed4890aa716dde4a6e6e0b74847 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6985220.exe
| MD5 | 8af5a0b45c9f8bb2e7f0fab976697103 |
| SHA1 | 5a48f42c586c5ac8b42afe8114de9ae3481f864f |
| SHA256 | 8169823840c271c76b5e69b3634f9f9dee6017589f32fbdb37f43a34b145cff9 |
| SHA512 | 33a0ebe0727a276d94c176885f9c04c0026b1bad5dbee68ad11fff97455c2ba50381081f2df7bcb3d74576374d9e5c3872708ed4890aa716dde4a6e6e0b74847 |
memory/3296-35-0x00000000002C0000-0x00000000002CA000-memory.dmp
memory/3296-36-0x00007FFCCEF00000-0x00007FFCCF9C1000-memory.dmp
memory/3296-37-0x00007FFCCEF00000-0x00007FFCCF9C1000-memory.dmp
memory/3296-39-0x00007FFCCEF00000-0x00007FFCCF9C1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2724735.exe
| MD5 | 38bb3a1acba1def231c3cc73aba206c7 |
| SHA1 | cec65375e00013034d3be98a17539d52a4df61ef |
| SHA256 | 4f6f70f7f4f89a4d606c1407ad3067998114f0b3f93a0b8e1434ee3dac243876 |
| SHA512 | 737b6ddfcef88abc552ab1e1851ff90f4a737ace1a76594fef80d115342229fe2068f9319f4e092909cd30be5d1f09d863df0f04c91aa4f1e5e1b9c85c1cd8aa |
memory/3544-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3544-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3544-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3544-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2955673.exe
| MD5 | 5df3bd0d813f4fff15c9190f68678692 |
| SHA1 | ad5aed135c894609d0f06985ac5f961c8f50d65f |
| SHA256 | d6ce80496287ded90a3dbd3b17dbcaec737247c3cd7247fd0865bc5e9bbf9894 |
| SHA512 | 34ab6d7b864a09bec48cd00ebc9ac757841ed3e62824a8587f4e83338060bcd0ff1c6e12bac318e892a74ba1a7e95b6de4293f94b73a8459f19bffe6290ba6c5 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2955673.exe
| MD5 | 5df3bd0d813f4fff15c9190f68678692 |
| SHA1 | ad5aed135c894609d0f06985ac5f961c8f50d65f |
| SHA256 | d6ce80496287ded90a3dbd3b17dbcaec737247c3cd7247fd0865bc5e9bbf9894 |
| SHA512 | 34ab6d7b864a09bec48cd00ebc9ac757841ed3e62824a8587f4e83338060bcd0ff1c6e12bac318e892a74ba1a7e95b6de4293f94b73a8459f19bffe6290ba6c5 |
memory/224-51-0x0000000000400000-0x0000000000430000-memory.dmp
memory/224-52-0x0000000073B20000-0x00000000742D0000-memory.dmp
memory/224-53-0x0000000002BB0000-0x0000000002BB6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0984936.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0984936.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/224-60-0x00000000059A0000-0x0000000005FB8000-memory.dmp
memory/224-64-0x0000000005490000-0x000000000559A000-memory.dmp
memory/224-66-0x0000000005370000-0x0000000005380000-memory.dmp
memory/224-65-0x00000000052F0000-0x0000000005302000-memory.dmp
memory/224-67-0x0000000005380000-0x00000000053BC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0670560.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0670560.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/224-76-0x00000000053C0000-0x000000000540C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7456714.exe
| MD5 | 5fbb3e6f42a160f572daa5a38407f4a1 |
| SHA1 | 48fefe24e22cdc790d08bc56fb1792ae5265e21e |
| SHA256 | 69e6bba522e215b8af49df21b75412935a9486282c2d7571d7b4a649d5c64030 |
| SHA512 | 02ece5a8d8ac204b370abbcf175b35ffa4f4a33d6f118b0b72399679dd6082c73b10a381ae36c4ce3499b19e968b6a1b87fd8e723c5c063e95c96e3b013e2e7c |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7456714.exe
| MD5 | 5fbb3e6f42a160f572daa5a38407f4a1 |
| SHA1 | 48fefe24e22cdc790d08bc56fb1792ae5265e21e |
| SHA256 | 69e6bba522e215b8af49df21b75412935a9486282c2d7571d7b4a649d5c64030 |
| SHA512 | 02ece5a8d8ac204b370abbcf175b35ffa4f4a33d6f118b0b72399679dd6082c73b10a381ae36c4ce3499b19e968b6a1b87fd8e723c5c063e95c96e3b013e2e7c |
memory/224-87-0x0000000073B20000-0x00000000742D0000-memory.dmp
memory/224-88-0x0000000005370000-0x0000000005380000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |