healer | 9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe
Size

994KB
MD5

119a485dfc1d68d6115a57ce496bacdc
SHA1

003a46d5dd31ceb102981e3db9065817b3720329
SHA256

9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef
SHA512

f4f47cd292f4440fc6407a3a35d00c5533353a31a3fe9edfedc26c07c62ced410bb0c4037e29df424a0a25b7b6e06c57ef75ae3cf30efd348bba136af8ba7638
SSDEEP

24576:eyzoe1z2De9r3FhZ9dObPbSx8T1ZPYNve94LClEIG:tzojDedVRQXSxyZYxY4L3I

Score

10^/10

healer mystic dropper evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/608-64-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/608-65-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/608-66-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/608-68-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/608-70-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/608-72-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe	healer
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe	healer
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe	healer
behavioral1/memory/2772-48-0x0000000000DE0000-0x0000000000DEA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

q4293181.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q4293181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q4293181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q4293181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q4293181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q4293181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q4293181.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Executes dropped EXE 6 IoCs

Processes:

z2259105.exez1965502.exez6741345.exez2504765.exeq4293181.exer1639843.exe

pid process

2824 z2259105.exe
2116 z1965502.exe
2816 z6741345.exe
2620 z2504765.exe
2772 q4293181.exe
2536 r1639843.exe

pid	process
2824	z2259105.exe
2116	z1965502.exe
2816	z6741345.exe
2620	z2504765.exe
2772	q4293181.exe
2536	r1639843.exe

Loads dropped DLL 16 IoCs

Processes:

9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exez2259105.exez1965502.exez6741345.exez2504765.exer1639843.exeWerFault.exe

pid	process
1700	9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe
2824	z2259105.exe
2824	z2259105.exe
2116	z1965502.exe
2116	z1965502.exe
2816	z6741345.exe
2816	z6741345.exe
2620	z2504765.exe
2620	z2504765.exe
2620	z2504765.exe
2620	z2504765.exe
2536	r1639843.exe
532	WerFault.exe
532	WerFault.exe
532	WerFault.exe
532	WerFault.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

q4293181.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	q4293181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q4293181.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

z2259105.exez1965502.exez6741345.exez2504765.exe9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2259105.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z1965502.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6741345.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z2504765.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

r1639843.exe

description pid process target process

PID 2536 set thread context of 608 2536 r1639843.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

532 2536 WerFault.exe r1639843.exe
1436 608 WerFault.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

q4293181.exe

pid process

2772 q4293181.exe
2772 q4293181.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

q4293181.exe

description pid process

Token: SeDebugPrivilege 2772 q4293181.exe

description	pid	process	target process
PID 2536 set thread context of 608	2536	r1639843.exe	AppLaunch.exe

pid	pid_target	process	target process
532	2536	WerFault.exe	r1639843.exe
1436	608	WerFault.exe	AppLaunch.exe

pid	process
2772	q4293181.exe
2772	q4293181.exe

description	pid	process
Token: SeDebugPrivilege	2772	q4293181.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exez2259105.exez1965502.exez6741345.exez2504765.exer1639843.exeAppLaunch.exe

description	pid	process	target process
PID 1700 wrote to memory of 2824	1700	9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe	z2259105.exe
PID 1700 wrote to memory of 2824	1700	9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe	z2259105.exe
PID 1700 wrote to memory of 2824	1700	9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe	z2259105.exe
PID 1700 wrote to memory of 2824	1700	9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe	z2259105.exe
PID 1700 wrote to memory of 2824	1700	9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe	z2259105.exe
PID 1700 wrote to memory of 2824	1700	9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe	z2259105.exe
PID 1700 wrote to memory of 2824	1700	9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe	z2259105.exe
PID 2824 wrote to memory of 2116	2824	z2259105.exe	z1965502.exe
PID 2824 wrote to memory of 2116	2824	z2259105.exe	z1965502.exe
PID 2824 wrote to memory of 2116	2824	z2259105.exe	z1965502.exe
PID 2824 wrote to memory of 2116	2824	z2259105.exe	z1965502.exe
PID 2824 wrote to memory of 2116	2824	z2259105.exe	z1965502.exe
PID 2824 wrote to memory of 2116	2824	z2259105.exe	z1965502.exe
PID 2824 wrote to memory of 2116	2824	z2259105.exe	z1965502.exe
PID 2116 wrote to memory of 2816	2116	z1965502.exe	z6741345.exe
PID 2116 wrote to memory of 2816	2116	z1965502.exe	z6741345.exe
PID 2116 wrote to memory of 2816	2116	z1965502.exe	z6741345.exe
PID 2116 wrote to memory of 2816	2116	z1965502.exe	z6741345.exe
PID 2116 wrote to memory of 2816	2116	z1965502.exe	z6741345.exe
PID 2116 wrote to memory of 2816	2116	z1965502.exe	z6741345.exe
PID 2116 wrote to memory of 2816	2116	z1965502.exe	z6741345.exe
PID 2816 wrote to memory of 2620	2816	z6741345.exe	z2504765.exe
PID 2816 wrote to memory of 2620	2816	z6741345.exe	z2504765.exe
PID 2816 wrote to memory of 2620	2816	z6741345.exe	z2504765.exe
PID 2816 wrote to memory of 2620	2816	z6741345.exe	z2504765.exe
PID 2816 wrote to memory of 2620	2816	z6741345.exe	z2504765.exe
PID 2816 wrote to memory of 2620	2816	z6741345.exe	z2504765.exe
PID 2816 wrote to memory of 2620	2816	z6741345.exe	z2504765.exe
PID 2620 wrote to memory of 2772	2620	z2504765.exe	q4293181.exe
PID 2620 wrote to memory of 2772	2620	z2504765.exe	q4293181.exe
PID 2620 wrote to memory of 2772	2620	z2504765.exe	q4293181.exe
PID 2620 wrote to memory of 2772	2620	z2504765.exe	q4293181.exe
PID 2620 wrote to memory of 2772	2620	z2504765.exe	q4293181.exe
PID 2620 wrote to memory of 2772	2620	z2504765.exe	q4293181.exe
PID 2620 wrote to memory of 2772	2620	z2504765.exe	q4293181.exe
PID 2620 wrote to memory of 2536	2620	z2504765.exe	r1639843.exe
PID 2620 wrote to memory of 2536	2620	z2504765.exe	r1639843.exe
PID 2620 wrote to memory of 2536	2620	z2504765.exe	r1639843.exe
PID 2620 wrote to memory of 2536	2620	z2504765.exe	r1639843.exe
PID 2620 wrote to memory of 2536	2620	z2504765.exe	r1639843.exe
PID 2620 wrote to memory of 2536	2620	z2504765.exe	r1639843.exe
PID 2620 wrote to memory of 2536	2620	z2504765.exe	r1639843.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 608	2536	r1639843.exe	AppLaunch.exe
PID 2536 wrote to memory of 532	2536	r1639843.exe	WerFault.exe
PID 2536 wrote to memory of 532	2536	r1639843.exe	WerFault.exe
PID 2536 wrote to memory of 532	2536	r1639843.exe	WerFault.exe
PID 2536 wrote to memory of 532	2536	r1639843.exe	WerFault.exe
PID 2536 wrote to memory of 532	2536	r1639843.exe	WerFault.exe
PID 2536 wrote to memory of 532	2536	r1639843.exe	WerFault.exe
PID 2536 wrote to memory of 532	2536	r1639843.exe	WerFault.exe
PID 608 wrote to memory of 1436	608	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe
"C:\Users\Admin\AppData\Local\Temp\9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2824

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2816

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2620

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Suspicious use of WriteProcessMemory
PID:608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 268
8⤵
- Program crash
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 36
7⤵
- Loads dropped DLL
- Program crash
PID:532

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
Filesize
892KB

MD5
cf78bb859eb7402436773905e9c9ab64

SHA1
ec0477f4bd6135d3adad579676d3da1352d08749

SHA256
d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7

SHA512
713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
Filesize
892KB

MD5
cf78bb859eb7402436773905e9c9ab64

SHA1
ec0477f4bd6135d3adad579676d3da1352d08749

SHA256
d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7

SHA512
713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
Filesize
709KB

MD5
9c28d58e630fc7f0aeb0f86700f5b7a1

SHA1
338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32

SHA256
8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640

SHA512
5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
Filesize
709KB

MD5
9c28d58e630fc7f0aeb0f86700f5b7a1

SHA1
338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32

SHA256
8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640

SHA512
5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
Filesize
526KB

MD5
1232e0a2893200a30d5a310ce5d6759b

SHA1
843713a2c787072a2d151724f05fd41a9d96a682

SHA256
72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67

SHA512
cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
Filesize
526KB

MD5
1232e0a2893200a30d5a310ce5d6759b

SHA1
843713a2c787072a2d151724f05fd41a9d96a682

SHA256
72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67

SHA512
cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
Filesize
296KB

MD5
dbb19d6be338b03f010609faf9e6d951

SHA1
eda9cf1504a028ba1bbd6b0460982c3d7489dc93

SHA256
942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c

SHA512
205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
Filesize
296KB

MD5
dbb19d6be338b03f010609faf9e6d951

SHA1
eda9cf1504a028ba1bbd6b0460982c3d7489dc93

SHA256
942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c

SHA512
205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
Filesize
11KB

MD5
02b15c1d5c917784ec62fc6425cadb21

SHA1
c9030ad0a162972aeaa17ce1bcd8e6b072b8f9d6

SHA256
15754831b61a26a12c804fb322bc80c8311502a50776d2b981da4ab3efb421cd

SHA512
3af4881b2ed07f29a63a15fe9964d396c5b37424a93a0ee5b6e5a7673efe984f7b957dc6940958eae00f3e930fcfbe2c200be66d8e2f20574ecbc31b01b30e70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
Filesize
11KB

MD5
02b15c1d5c917784ec62fc6425cadb21

SHA1
c9030ad0a162972aeaa17ce1bcd8e6b072b8f9d6

SHA256
15754831b61a26a12c804fb322bc80c8311502a50776d2b981da4ab3efb421cd

SHA512
3af4881b2ed07f29a63a15fe9964d396c5b37424a93a0ee5b6e5a7673efe984f7b957dc6940958eae00f3e930fcfbe2c200be66d8e2f20574ecbc31b01b30e70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
Filesize
892KB

MD5
cf78bb859eb7402436773905e9c9ab64

SHA1
ec0477f4bd6135d3adad579676d3da1352d08749

SHA256
d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7

SHA512
713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
Filesize
892KB

MD5
cf78bb859eb7402436773905e9c9ab64

SHA1
ec0477f4bd6135d3adad579676d3da1352d08749

SHA256
d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7

SHA512
713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
Filesize
709KB

MD5
9c28d58e630fc7f0aeb0f86700f5b7a1

SHA1
338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32

SHA256
8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640

SHA512
5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
Filesize
709KB

MD5
9c28d58e630fc7f0aeb0f86700f5b7a1

SHA1
338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32

SHA256
8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640

SHA512
5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
Filesize
526KB

MD5
1232e0a2893200a30d5a310ce5d6759b

SHA1
843713a2c787072a2d151724f05fd41a9d96a682

SHA256
72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67

SHA512
cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
Filesize
526KB

MD5
1232e0a2893200a30d5a310ce5d6759b

SHA1
843713a2c787072a2d151724f05fd41a9d96a682

SHA256
72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67

SHA512
cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
Filesize
296KB

MD5
dbb19d6be338b03f010609faf9e6d951

SHA1
eda9cf1504a028ba1bbd6b0460982c3d7489dc93

SHA256
942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c

SHA512
205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
Filesize
296KB

MD5
dbb19d6be338b03f010609faf9e6d951

SHA1
eda9cf1504a028ba1bbd6b0460982c3d7489dc93

SHA256
942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c

SHA512
205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
Filesize
11KB

MD5
02b15c1d5c917784ec62fc6425cadb21

SHA1
c9030ad0a162972aeaa17ce1bcd8e6b072b8f9d6

SHA256
15754831b61a26a12c804fb322bc80c8311502a50776d2b981da4ab3efb421cd

SHA512
3af4881b2ed07f29a63a15fe9964d396c5b37424a93a0ee5b6e5a7673efe984f7b957dc6940958eae00f3e930fcfbe2c200be66d8e2f20574ecbc31b01b30e70

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
Filesize
276KB

MD5
41d4e7737cd2b21e5408f7a84ae105a0

SHA1
a7f8142bf2572f427e7d8d4c092a90df5bc2202d

SHA256
819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5

SHA512
330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e

Download Submit
memory/608-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/608-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/608-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/608-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/608-65-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/608-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/608-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/608-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/608-70-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/608-72-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2772-51-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-50-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-49-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-48-0x0000000000DE0000-0x0000000000DEA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads