Analysis Overview
SHA256
ba72dd23776813767bf4ba2a34da6a8093cc84e9e72dbfc6bcdaa0e10448549f
Threat Level: Known bad
The file ba72dd23776813767bf4ba2a34da6a8093cc84e9e72dbfc6bcdaa0e10448549f_JC.exe was found to be: Known bad.
Malicious Activity Summary
Mystic
Modifies Windows Defender Real-time Protection settings
Detects Healer an antivirus disabler dropper
Detect Mystic stealer payload
RedLine
Amadey
Healer
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
Program crash
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 21:25
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 21:25
Reported
2023-10-10 22:34
Platform
win7-20230831-en
Max time kernel
121s
Max time network
132s
Command Line
Signatures
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe | N/A |
Loads dropped DLL
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\ba72dd23776813767bf4ba2a34da6a8093cc84e9e72dbfc6bcdaa0e10448549f_JC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2496 set thread context of 2660 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\ba72dd23776813767bf4ba2a34da6a8093cc84e9e72dbfc6bcdaa0e10448549f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ba72dd23776813767bf4ba2a34da6a8093cc84e9e72dbfc6bcdaa0e10448549f_JC.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 284
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
| MD5 | 03586b615982144df265f92344b8e375 |
| SHA1 | 95debdfbe04ad3a349a197bf5f0b8c5e37e39495 |
| SHA256 | a315de4ea1f0deafe05b172376297ff149a6d0b8985e1244df7fb38fcfb67ac8 |
| SHA512 | 2f98841a524f9679e2361a109dd9e710f6e4eb9049fab943106a79e4e09d83f70f64407bfa5903d4533702c59a36e85e2cbac274cda1565878ea98db5c70cb2b |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
| MD5 | 03586b615982144df265f92344b8e375 |
| SHA1 | 95debdfbe04ad3a349a197bf5f0b8c5e37e39495 |
| SHA256 | a315de4ea1f0deafe05b172376297ff149a6d0b8985e1244df7fb38fcfb67ac8 |
| SHA512 | 2f98841a524f9679e2361a109dd9e710f6e4eb9049fab943106a79e4e09d83f70f64407bfa5903d4533702c59a36e85e2cbac274cda1565878ea98db5c70cb2b |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
| MD5 | 03586b615982144df265f92344b8e375 |
| SHA1 | 95debdfbe04ad3a349a197bf5f0b8c5e37e39495 |
| SHA256 | a315de4ea1f0deafe05b172376297ff149a6d0b8985e1244df7fb38fcfb67ac8 |
| SHA512 | 2f98841a524f9679e2361a109dd9e710f6e4eb9049fab943106a79e4e09d83f70f64407bfa5903d4533702c59a36e85e2cbac274cda1565878ea98db5c70cb2b |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
| MD5 | 03586b615982144df265f92344b8e375 |
| SHA1 | 95debdfbe04ad3a349a197bf5f0b8c5e37e39495 |
| SHA256 | a315de4ea1f0deafe05b172376297ff149a6d0b8985e1244df7fb38fcfb67ac8 |
| SHA512 | 2f98841a524f9679e2361a109dd9e710f6e4eb9049fab943106a79e4e09d83f70f64407bfa5903d4533702c59a36e85e2cbac274cda1565878ea98db5c70cb2b |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
| MD5 | cf269ffe474df2ec293635e61ec55439 |
| SHA1 | 72b5d98b27fd177e7f314d9518c8868a910e7462 |
| SHA256 | 20a2873ca6f427688a7259ba0d5bf30e26a1787bbc87f2b77f167647d2a4dce8 |
| SHA512 | 8731827c9cfa074271fa3d6d1e06fd7f09c1821e782c9d10bf7040226e5c23d8ec4341209687915f5142916c3ee7c502fd67046371f2877570cf5ec18ad2be4c |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
| MD5 | cf269ffe474df2ec293635e61ec55439 |
| SHA1 | 72b5d98b27fd177e7f314d9518c8868a910e7462 |
| SHA256 | 20a2873ca6f427688a7259ba0d5bf30e26a1787bbc87f2b77f167647d2a4dce8 |
| SHA512 | 8731827c9cfa074271fa3d6d1e06fd7f09c1821e782c9d10bf7040226e5c23d8ec4341209687915f5142916c3ee7c502fd67046371f2877570cf5ec18ad2be4c |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
| MD5 | cf269ffe474df2ec293635e61ec55439 |
| SHA1 | 72b5d98b27fd177e7f314d9518c8868a910e7462 |
| SHA256 | 20a2873ca6f427688a7259ba0d5bf30e26a1787bbc87f2b77f167647d2a4dce8 |
| SHA512 | 8731827c9cfa074271fa3d6d1e06fd7f09c1821e782c9d10bf7040226e5c23d8ec4341209687915f5142916c3ee7c502fd67046371f2877570cf5ec18ad2be4c |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
| MD5 | cf269ffe474df2ec293635e61ec55439 |
| SHA1 | 72b5d98b27fd177e7f314d9518c8868a910e7462 |
| SHA256 | 20a2873ca6f427688a7259ba0d5bf30e26a1787bbc87f2b77f167647d2a4dce8 |
| SHA512 | 8731827c9cfa074271fa3d6d1e06fd7f09c1821e782c9d10bf7040226e5c23d8ec4341209687915f5142916c3ee7c502fd67046371f2877570cf5ec18ad2be4c |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
| MD5 | 74c9cabd66a1b60fd7bca4ea219e94f3 |
| SHA1 | 86c672059f44f5cc92521247dddf3d93e52bc4f5 |
| SHA256 | ba2908cf1b78ab8a9b9b145e22289753876232747d67119e180bba711eff8818 |
| SHA512 | e77392e1725484d325b335405e029ce9f98b859306df37cd6251eac019d675aa307667da76b547734fe2da79f59a8222751b2d7b684ddb79602d4609b696fa68 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
| MD5 | 74c9cabd66a1b60fd7bca4ea219e94f3 |
| SHA1 | 86c672059f44f5cc92521247dddf3d93e52bc4f5 |
| SHA256 | ba2908cf1b78ab8a9b9b145e22289753876232747d67119e180bba711eff8818 |
| SHA512 | e77392e1725484d325b335405e029ce9f98b859306df37cd6251eac019d675aa307667da76b547734fe2da79f59a8222751b2d7b684ddb79602d4609b696fa68 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
| MD5 | 74c9cabd66a1b60fd7bca4ea219e94f3 |
| SHA1 | 86c672059f44f5cc92521247dddf3d93e52bc4f5 |
| SHA256 | ba2908cf1b78ab8a9b9b145e22289753876232747d67119e180bba711eff8818 |
| SHA512 | e77392e1725484d325b335405e029ce9f98b859306df37cd6251eac019d675aa307667da76b547734fe2da79f59a8222751b2d7b684ddb79602d4609b696fa68 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
| MD5 | 74c9cabd66a1b60fd7bca4ea219e94f3 |
| SHA1 | 86c672059f44f5cc92521247dddf3d93e52bc4f5 |
| SHA256 | ba2908cf1b78ab8a9b9b145e22289753876232747d67119e180bba711eff8818 |
| SHA512 | e77392e1725484d325b335405e029ce9f98b859306df37cd6251eac019d675aa307667da76b547734fe2da79f59a8222751b2d7b684ddb79602d4609b696fa68 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
| MD5 | 74e63895c3c5899aff6cbe13c1042c7a |
| SHA1 | 454ab90bfe89218090e9654dd02376b64e34952f |
| SHA256 | 17fbc64db3e08e023e25a30d1373747d49d0b930ab68f54650768b477ace42d3 |
| SHA512 | 2021093deaba5783f3a97da591e36eea03fc744b4cfe99d6cf8d5ce8e11fede6331ada8a6fb02ac0536b68e8d6ce7403803c9f78751a0f4428f0a6fc7e50177b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
| MD5 | 74e63895c3c5899aff6cbe13c1042c7a |
| SHA1 | 454ab90bfe89218090e9654dd02376b64e34952f |
| SHA256 | 17fbc64db3e08e023e25a30d1373747d49d0b930ab68f54650768b477ace42d3 |
| SHA512 | 2021093deaba5783f3a97da591e36eea03fc744b4cfe99d6cf8d5ce8e11fede6331ada8a6fb02ac0536b68e8d6ce7403803c9f78751a0f4428f0a6fc7e50177b |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
| MD5 | 74e63895c3c5899aff6cbe13c1042c7a |
| SHA1 | 454ab90bfe89218090e9654dd02376b64e34952f |
| SHA256 | 17fbc64db3e08e023e25a30d1373747d49d0b930ab68f54650768b477ace42d3 |
| SHA512 | 2021093deaba5783f3a97da591e36eea03fc744b4cfe99d6cf8d5ce8e11fede6331ada8a6fb02ac0536b68e8d6ce7403803c9f78751a0f4428f0a6fc7e50177b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
| MD5 | 74e63895c3c5899aff6cbe13c1042c7a |
| SHA1 | 454ab90bfe89218090e9654dd02376b64e34952f |
| SHA256 | 17fbc64db3e08e023e25a30d1373747d49d0b930ab68f54650768b477ace42d3 |
| SHA512 | 2021093deaba5783f3a97da591e36eea03fc744b4cfe99d6cf8d5ce8e11fede6331ada8a6fb02ac0536b68e8d6ce7403803c9f78751a0f4428f0a6fc7e50177b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
memory/2660-53-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2660-55-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2660-57-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2660-59-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2660-61-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2660-62-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2660-64-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2660-66-0x0000000000400000-0x000000000040A000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 21:25
Reported
2023-10-10 22:35
Platform
win10v2004-20230915-en
Max time kernel
158s
Max time network
177s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6699828.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5135472.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\ba72dd23776813767bf4ba2a34da6a8093cc84e9e72dbfc6bcdaa0e10448549f_JC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1568 set thread context of 3136 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 920 set thread context of 3812 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1361455.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3272 set thread context of 1380 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7510666.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\ba72dd23776813767bf4ba2a34da6a8093cc84e9e72dbfc6bcdaa0e10448549f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ba72dd23776813767bf4ba2a34da6a8093cc84e9e72dbfc6bcdaa0e10448549f_JC.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1568 -ip 1568
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 592
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1361455.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1361455.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 920 -ip 920
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 604
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3812 -ip 3812
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7510666.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7510666.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3272 -ip 3272
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6699828.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6699828.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5135472.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5135472.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1923015.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1923015.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.202.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.113.22.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.20.238.8.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 9.173.189.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
| MD5 | 03586b615982144df265f92344b8e375 |
| SHA1 | 95debdfbe04ad3a349a197bf5f0b8c5e37e39495 |
| SHA256 | a315de4ea1f0deafe05b172376297ff149a6d0b8985e1244df7fb38fcfb67ac8 |
| SHA512 | 2f98841a524f9679e2361a109dd9e710f6e4eb9049fab943106a79e4e09d83f70f64407bfa5903d4533702c59a36e85e2cbac274cda1565878ea98db5c70cb2b |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2369736.exe
| MD5 | 03586b615982144df265f92344b8e375 |
| SHA1 | 95debdfbe04ad3a349a197bf5f0b8c5e37e39495 |
| SHA256 | a315de4ea1f0deafe05b172376297ff149a6d0b8985e1244df7fb38fcfb67ac8 |
| SHA512 | 2f98841a524f9679e2361a109dd9e710f6e4eb9049fab943106a79e4e09d83f70f64407bfa5903d4533702c59a36e85e2cbac274cda1565878ea98db5c70cb2b |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
| MD5 | cf269ffe474df2ec293635e61ec55439 |
| SHA1 | 72b5d98b27fd177e7f314d9518c8868a910e7462 |
| SHA256 | 20a2873ca6f427688a7259ba0d5bf30e26a1787bbc87f2b77f167647d2a4dce8 |
| SHA512 | 8731827c9cfa074271fa3d6d1e06fd7f09c1821e782c9d10bf7040226e5c23d8ec4341209687915f5142916c3ee7c502fd67046371f2877570cf5ec18ad2be4c |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6038175.exe
| MD5 | cf269ffe474df2ec293635e61ec55439 |
| SHA1 | 72b5d98b27fd177e7f314d9518c8868a910e7462 |
| SHA256 | 20a2873ca6f427688a7259ba0d5bf30e26a1787bbc87f2b77f167647d2a4dce8 |
| SHA512 | 8731827c9cfa074271fa3d6d1e06fd7f09c1821e782c9d10bf7040226e5c23d8ec4341209687915f5142916c3ee7c502fd67046371f2877570cf5ec18ad2be4c |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
| MD5 | 74c9cabd66a1b60fd7bca4ea219e94f3 |
| SHA1 | 86c672059f44f5cc92521247dddf3d93e52bc4f5 |
| SHA256 | ba2908cf1b78ab8a9b9b145e22289753876232747d67119e180bba711eff8818 |
| SHA512 | e77392e1725484d325b335405e029ce9f98b859306df37cd6251eac019d675aa307667da76b547734fe2da79f59a8222751b2d7b684ddb79602d4609b696fa68 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8579371.exe
| MD5 | 74c9cabd66a1b60fd7bca4ea219e94f3 |
| SHA1 | 86c672059f44f5cc92521247dddf3d93e52bc4f5 |
| SHA256 | ba2908cf1b78ab8a9b9b145e22289753876232747d67119e180bba711eff8818 |
| SHA512 | e77392e1725484d325b335405e029ce9f98b859306df37cd6251eac019d675aa307667da76b547734fe2da79f59a8222751b2d7b684ddb79602d4609b696fa68 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
| MD5 | 74e63895c3c5899aff6cbe13c1042c7a |
| SHA1 | 454ab90bfe89218090e9654dd02376b64e34952f |
| SHA256 | 17fbc64db3e08e023e25a30d1373747d49d0b930ab68f54650768b477ace42d3 |
| SHA512 | 2021093deaba5783f3a97da591e36eea03fc744b4cfe99d6cf8d5ce8e11fede6331ada8a6fb02ac0536b68e8d6ce7403803c9f78751a0f4428f0a6fc7e50177b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6343484.exe
| MD5 | 74e63895c3c5899aff6cbe13c1042c7a |
| SHA1 | 454ab90bfe89218090e9654dd02376b64e34952f |
| SHA256 | 17fbc64db3e08e023e25a30d1373747d49d0b930ab68f54650768b477ace42d3 |
| SHA512 | 2021093deaba5783f3a97da591e36eea03fc744b4cfe99d6cf8d5ce8e11fede6331ada8a6fb02ac0536b68e8d6ce7403803c9f78751a0f4428f0a6fc7e50177b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8292645.exe
| MD5 | cca6d2adb254d7e2135c8fa0bbe08654 |
| SHA1 | 11977635b000ea441eb4074cab8c91966da7d257 |
| SHA256 | 889ea75958f783b7f07227f8e59c3c215590c1d296da96b40327137e3b8e00f6 |
| SHA512 | 29d02be04b862ddc599caa5fb5a64351224a7ec02fcbbdeef040aba77394729a79793afc6f7d3653e8085bafdf76875eb07cee6a9de3ed491bce454d8cd01c4b |
memory/3136-35-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3136-36-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/3136-37-0x0000000074590000-0x0000000074D40000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1361455.exe
| MD5 | 7c0e5a98bf5cfe59746c757306f12b46 |
| SHA1 | 5a2bff69dc1d666e68ffc58ecfd27c343e72ad65 |
| SHA256 | 7dcf5d1686afcebfb18bdd19605d93cbf10380bd85d3b17c7cad20b7fc1b983e |
| SHA512 | 15cd4bf2e4b8380b7a9129f9e15df0b68497d7e20c27f486d6395193e7b74aa18fe3440abd0f562592dceb5fd45bedde2183fc7145a535586beb858763defb74 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1361455.exe
| MD5 | 7c0e5a98bf5cfe59746c757306f12b46 |
| SHA1 | 5a2bff69dc1d666e68ffc58ecfd27c343e72ad65 |
| SHA256 | 7dcf5d1686afcebfb18bdd19605d93cbf10380bd85d3b17c7cad20b7fc1b983e |
| SHA512 | 15cd4bf2e4b8380b7a9129f9e15df0b68497d7e20c27f486d6395193e7b74aa18fe3440abd0f562592dceb5fd45bedde2183fc7145a535586beb858763defb74 |
memory/3812-41-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3812-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3812-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3812-45-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7510666.exe
| MD5 | d5be74c875f1516a47910299fc1eed37 |
| SHA1 | bdbf9f516b5c13224e983fb518f4415d64ca0b53 |
| SHA256 | 1467e69d97b795890bb259ae8f742a0a51e2f4afe93ecb9973286105fb52cc23 |
| SHA512 | 1ff355c0aa663b539e97372f855170314d0e3e1cc75a525a79f8703067e523fabc34a15486c7e2e58e899bae68b140190e196f4fba5698b6cccdc3a28e2708f7 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7510666.exe
| MD5 | d5be74c875f1516a47910299fc1eed37 |
| SHA1 | bdbf9f516b5c13224e983fb518f4415d64ca0b53 |
| SHA256 | 1467e69d97b795890bb259ae8f742a0a51e2f4afe93ecb9973286105fb52cc23 |
| SHA512 | 1ff355c0aa663b539e97372f855170314d0e3e1cc75a525a79f8703067e523fabc34a15486c7e2e58e899bae68b140190e196f4fba5698b6cccdc3a28e2708f7 |
memory/1380-49-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1380-50-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/1380-51-0x0000000003370000-0x0000000003376000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6699828.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6699828.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/3136-65-0x0000000074590000-0x0000000074D40000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5135472.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5135472.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/1380-78-0x0000000005F90000-0x00000000065A8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1923015.exe
| MD5 | 74e7881d6a302769814b8612eeebb7a1 |
| SHA1 | ed168786798be53b82c69a1178479e06a33ffa83 |
| SHA256 | ba5120aa0f5e63589ea5755009a3f65d66222f30dc5755019ca32eb4e20d10fd |
| SHA512 | ba15f05d30af108416448f84793dafb936dbbbf02c170eb2f56fcc21b6367c6b265ac8e2f92984f69979c4ec9315104843d52593a3e86c5dd64791baa96e1ffc |
memory/1380-81-0x0000000005A80000-0x0000000005B8A000-memory.dmp
memory/1380-83-0x0000000005960000-0x0000000005970000-memory.dmp
memory/1380-82-0x0000000005910000-0x0000000005922000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1923015.exe
| MD5 | 74e7881d6a302769814b8612eeebb7a1 |
| SHA1 | ed168786798be53b82c69a1178479e06a33ffa83 |
| SHA256 | ba5120aa0f5e63589ea5755009a3f65d66222f30dc5755019ca32eb4e20d10fd |
| SHA512 | ba15f05d30af108416448f84793dafb936dbbbf02c170eb2f56fcc21b6367c6b265ac8e2f92984f69979c4ec9315104843d52593a3e86c5dd64791baa96e1ffc |
memory/1380-85-0x00000000059B0000-0x00000000059EC000-memory.dmp
memory/1380-86-0x00000000059F0000-0x0000000005A3C000-memory.dmp
memory/1380-87-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/1380-88-0x0000000005960000-0x0000000005970000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |