Analysis Overview
SHA256
9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef
Threat Level: Known bad
The file 9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef was found to be: Known bad.
Malicious Activity Summary
Modifies Windows Defender Real-time Protection settings
RedLine
Mystic
Detect Mystic stealer payload
Detects Healer an antivirus disabler dropper
Healer
Amadey
Checks computer location settings
Windows security modification
Loads dropped DLL
Executes dropped EXE
Adds Run key to start application
Suspicious use of SetThreadContext
Launches sc.exe
Unsigned PE
Enumerates physical storage devices
Program crash
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:30
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:30
Reported
2023-10-10 20:44
Platform
win7-20230831-en
Max time kernel
118s
Max time network
133s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2536 set thread context of 608 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe
"C:\Users\Admin\AppData\Local\Temp\9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 36
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
| MD5 | cf78bb859eb7402436773905e9c9ab64 |
| SHA1 | ec0477f4bd6135d3adad579676d3da1352d08749 |
| SHA256 | d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7 |
| SHA512 | 713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
| MD5 | cf78bb859eb7402436773905e9c9ab64 |
| SHA1 | ec0477f4bd6135d3adad579676d3da1352d08749 |
| SHA256 | d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7 |
| SHA512 | 713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
| MD5 | cf78bb859eb7402436773905e9c9ab64 |
| SHA1 | ec0477f4bd6135d3adad579676d3da1352d08749 |
| SHA256 | d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7 |
| SHA512 | 713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
| MD5 | cf78bb859eb7402436773905e9c9ab64 |
| SHA1 | ec0477f4bd6135d3adad579676d3da1352d08749 |
| SHA256 | d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7 |
| SHA512 | 713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
| MD5 | 9c28d58e630fc7f0aeb0f86700f5b7a1 |
| SHA1 | 338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32 |
| SHA256 | 8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640 |
| SHA512 | 5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
| MD5 | 9c28d58e630fc7f0aeb0f86700f5b7a1 |
| SHA1 | 338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32 |
| SHA256 | 8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640 |
| SHA512 | 5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
| MD5 | 9c28d58e630fc7f0aeb0f86700f5b7a1 |
| SHA1 | 338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32 |
| SHA256 | 8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640 |
| SHA512 | 5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
| MD5 | 9c28d58e630fc7f0aeb0f86700f5b7a1 |
| SHA1 | 338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32 |
| SHA256 | 8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640 |
| SHA512 | 5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
| MD5 | 1232e0a2893200a30d5a310ce5d6759b |
| SHA1 | 843713a2c787072a2d151724f05fd41a9d96a682 |
| SHA256 | 72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67 |
| SHA512 | cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
| MD5 | 1232e0a2893200a30d5a310ce5d6759b |
| SHA1 | 843713a2c787072a2d151724f05fd41a9d96a682 |
| SHA256 | 72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67 |
| SHA512 | cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
| MD5 | 1232e0a2893200a30d5a310ce5d6759b |
| SHA1 | 843713a2c787072a2d151724f05fd41a9d96a682 |
| SHA256 | 72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67 |
| SHA512 | cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
| MD5 | 1232e0a2893200a30d5a310ce5d6759b |
| SHA1 | 843713a2c787072a2d151724f05fd41a9d96a682 |
| SHA256 | 72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67 |
| SHA512 | cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
| MD5 | dbb19d6be338b03f010609faf9e6d951 |
| SHA1 | eda9cf1504a028ba1bbd6b0460982c3d7489dc93 |
| SHA256 | 942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c |
| SHA512 | 205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
| MD5 | dbb19d6be338b03f010609faf9e6d951 |
| SHA1 | eda9cf1504a028ba1bbd6b0460982c3d7489dc93 |
| SHA256 | 942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c |
| SHA512 | 205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
| MD5 | dbb19d6be338b03f010609faf9e6d951 |
| SHA1 | eda9cf1504a028ba1bbd6b0460982c3d7489dc93 |
| SHA256 | 942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c |
| SHA512 | 205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
| MD5 | dbb19d6be338b03f010609faf9e6d951 |
| SHA1 | eda9cf1504a028ba1bbd6b0460982c3d7489dc93 |
| SHA256 | 942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c |
| SHA512 | 205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
| MD5 | 02b15c1d5c917784ec62fc6425cadb21 |
| SHA1 | c9030ad0a162972aeaa17ce1bcd8e6b072b8f9d6 |
| SHA256 | 15754831b61a26a12c804fb322bc80c8311502a50776d2b981da4ab3efb421cd |
| SHA512 | 3af4881b2ed07f29a63a15fe9964d396c5b37424a93a0ee5b6e5a7673efe984f7b957dc6940958eae00f3e930fcfbe2c200be66d8e2f20574ecbc31b01b30e70 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
| MD5 | 02b15c1d5c917784ec62fc6425cadb21 |
| SHA1 | c9030ad0a162972aeaa17ce1bcd8e6b072b8f9d6 |
| SHA256 | 15754831b61a26a12c804fb322bc80c8311502a50776d2b981da4ab3efb421cd |
| SHA512 | 3af4881b2ed07f29a63a15fe9964d396c5b37424a93a0ee5b6e5a7673efe984f7b957dc6940958eae00f3e930fcfbe2c200be66d8e2f20574ecbc31b01b30e70 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
| MD5 | 02b15c1d5c917784ec62fc6425cadb21 |
| SHA1 | c9030ad0a162972aeaa17ce1bcd8e6b072b8f9d6 |
| SHA256 | 15754831b61a26a12c804fb322bc80c8311502a50776d2b981da4ab3efb421cd |
| SHA512 | 3af4881b2ed07f29a63a15fe9964d396c5b37424a93a0ee5b6e5a7673efe984f7b957dc6940958eae00f3e930fcfbe2c200be66d8e2f20574ecbc31b01b30e70 |
memory/2772-48-0x0000000000DE0000-0x0000000000DEA000-memory.dmp
memory/2772-49-0x000007FEF5960000-0x000007FEF634C000-memory.dmp
memory/2772-50-0x000007FEF5960000-0x000007FEF634C000-memory.dmp
memory/2772-51-0x000007FEF5960000-0x000007FEF634C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
memory/608-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/608-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/608-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/608-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/608-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/608-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/608-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/608-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/608-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/608-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:30
Reported
2023-10-10 20:44
Platform
win10v2004-20230915-en
Max time kernel
140s
Max time network
167s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8197520.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8414823.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3120 set thread context of 2848 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3832 set thread context of 3668 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2033520.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe
"C:\Users\Admin\AppData\Local\Temp\9ff78ac20bae7384d58fb9f03c6bca8971d95f385c48306aacbc89cef8ff6cef.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3120 -ip 3120
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2848 -ip 2848
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2033520.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2033520.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3832 -ip 3832
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 160
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8197520.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8197520.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8414823.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8414823.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7525347.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7525347.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.3.248.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.1.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 2.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
| MD5 | cf78bb859eb7402436773905e9c9ab64 |
| SHA1 | ec0477f4bd6135d3adad579676d3da1352d08749 |
| SHA256 | d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7 |
| SHA512 | 713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2259105.exe
| MD5 | cf78bb859eb7402436773905e9c9ab64 |
| SHA1 | ec0477f4bd6135d3adad579676d3da1352d08749 |
| SHA256 | d65b24d3a7e8953676d95086b0c0fee8f14a9df5d59ad8c6753e8d37b69e27d7 |
| SHA512 | 713bc4f8b9102d6f07bcea537ce1c5f3b6e6c683972b024e537ac64533553b158b578b4179f6697ba2c8cde779e839761972a34f9c2957ec897607dd88dabaec |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
| MD5 | 9c28d58e630fc7f0aeb0f86700f5b7a1 |
| SHA1 | 338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32 |
| SHA256 | 8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640 |
| SHA512 | 5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1965502.exe
| MD5 | 9c28d58e630fc7f0aeb0f86700f5b7a1 |
| SHA1 | 338d2e7fedc0fb5f00cda5cd21ed846c2a26ca32 |
| SHA256 | 8bff09352978ffa0641b51b68f0ffac686bf44de866a1fe418e161fce5481640 |
| SHA512 | 5053b850d654f3426e8a5e15c504e9cb8ad9391a3d0825bf58ff21c839cb0e0d66ef4b8c7fba29a4083963a2cfdcc5b558cdf2081f6de37aed5710f6fdda5fcb |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
| MD5 | 1232e0a2893200a30d5a310ce5d6759b |
| SHA1 | 843713a2c787072a2d151724f05fd41a9d96a682 |
| SHA256 | 72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67 |
| SHA512 | cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6741345.exe
| MD5 | 1232e0a2893200a30d5a310ce5d6759b |
| SHA1 | 843713a2c787072a2d151724f05fd41a9d96a682 |
| SHA256 | 72350dca79d591fe1b756f7b01b3064e3dc72075b5858a6e268b5c4ad6012a67 |
| SHA512 | cb313653bda9e313c7fcc2a377e4321e2b4919bb2c2e366ad033a4d69a67ae2e0a810a5956a6d52d33579dcec8efb27f3610b2a9221e3a1174ff408519a35b67 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
| MD5 | dbb19d6be338b03f010609faf9e6d951 |
| SHA1 | eda9cf1504a028ba1bbd6b0460982c3d7489dc93 |
| SHA256 | 942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c |
| SHA512 | 205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2504765.exe
| MD5 | dbb19d6be338b03f010609faf9e6d951 |
| SHA1 | eda9cf1504a028ba1bbd6b0460982c3d7489dc93 |
| SHA256 | 942d7e5ec8ea8c15050e32c36cf4f99f24ffaf951340185967f1ce9a62352c6c |
| SHA512 | 205d486deaa24b7f7f4a93d7707c10259a3bc7eab99e4bb785a49d4f381673e9a5df3ec609685b373dcea44dca39549893941f8a8497c55ba2a9e173418f91a1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
| MD5 | 02b15c1d5c917784ec62fc6425cadb21 |
| SHA1 | c9030ad0a162972aeaa17ce1bcd8e6b072b8f9d6 |
| SHA256 | 15754831b61a26a12c804fb322bc80c8311502a50776d2b981da4ab3efb421cd |
| SHA512 | 3af4881b2ed07f29a63a15fe9964d396c5b37424a93a0ee5b6e5a7673efe984f7b957dc6940958eae00f3e930fcfbe2c200be66d8e2f20574ecbc31b01b30e70 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4293181.exe
| MD5 | 02b15c1d5c917784ec62fc6425cadb21 |
| SHA1 | c9030ad0a162972aeaa17ce1bcd8e6b072b8f9d6 |
| SHA256 | 15754831b61a26a12c804fb322bc80c8311502a50776d2b981da4ab3efb421cd |
| SHA512 | 3af4881b2ed07f29a63a15fe9964d396c5b37424a93a0ee5b6e5a7673efe984f7b957dc6940958eae00f3e930fcfbe2c200be66d8e2f20574ecbc31b01b30e70 |
memory/1588-35-0x0000000000E10000-0x0000000000E1A000-memory.dmp
memory/1588-36-0x00007FFF220E0000-0x00007FFF22BA1000-memory.dmp
memory/1588-38-0x00007FFF220E0000-0x00007FFF22BA1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1639843.exe
| MD5 | 41d4e7737cd2b21e5408f7a84ae105a0 |
| SHA1 | a7f8142bf2572f427e7d8d4c092a90df5bc2202d |
| SHA256 | 819e873408a4d2fb707152e25fdff515c6701062c990d9df25bd5f820ecb90d5 |
| SHA512 | 330c3a12b432dea9f891b698f7d465610b7e4e2b928ce3d79a89c446ce2588da9d5bfc84bf83b1c0f7bf213cbea63adc5f5e54cd51798271b4fb7dc75ffc3d6e |
memory/2848-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2848-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2848-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2848-46-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2033520.exe
| MD5 | 371eb0a52bcf34e7bbf4ad713b31676a |
| SHA1 | 9ca831670164246b04a7434d620d2c4f775a9679 |
| SHA256 | 2357554bdbde4112068149a0d467e58508e8896221add0bf4f4b720072afa8da |
| SHA512 | 0f7dac7155ed8c06b5611a1b75df5926b54aee2a068ad37a2f529cbb4276cee2b88c2aa63c6f8cafba4a4c817fe0131eafdd9f1bc8a583368fad2e8678dcf899 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2033520.exe
| MD5 | 371eb0a52bcf34e7bbf4ad713b31676a |
| SHA1 | 9ca831670164246b04a7434d620d2c4f775a9679 |
| SHA256 | 2357554bdbde4112068149a0d467e58508e8896221add0bf4f4b720072afa8da |
| SHA512 | 0f7dac7155ed8c06b5611a1b75df5926b54aee2a068ad37a2f529cbb4276cee2b88c2aa63c6f8cafba4a4c817fe0131eafdd9f1bc8a583368fad2e8678dcf899 |
memory/3668-50-0x0000000000400000-0x0000000000430000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8197520.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8197520.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/3668-56-0x0000000073990000-0x0000000074140000-memory.dmp
memory/3668-57-0x00000000028F0000-0x00000000028F6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8414823.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8414823.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7525347.exe
| MD5 | 3cc3f03d810bf47a90a7af6d6c83b710 |
| SHA1 | 70b8b13d1efc738eff3c3aed82afb026475cd926 |
| SHA256 | b11f3f11ef5c053b69e5a4453c4a568e8fc73a4c3fc9ada0273456c0e434e94d |
| SHA512 | 8e9efd3a06740d8e6aaccf2a9c9e7ef31daa7989072b509d51e16e0e45b293656deaa6d8d2914feeeffaa102c94e5555dcdbfaa699693c6ed6672c74d2ecbe76 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7525347.exe
| MD5 | 3cc3f03d810bf47a90a7af6d6c83b710 |
| SHA1 | 70b8b13d1efc738eff3c3aed82afb026475cd926 |
| SHA256 | b11f3f11ef5c053b69e5a4453c4a568e8fc73a4c3fc9ada0273456c0e434e94d |
| SHA512 | 8e9efd3a06740d8e6aaccf2a9c9e7ef31daa7989072b509d51e16e0e45b293656deaa6d8d2914feeeffaa102c94e5555dcdbfaa699693c6ed6672c74d2ecbe76 |
memory/3668-80-0x000000000AAC0000-0x000000000B0D8000-memory.dmp
memory/3668-81-0x000000000A600000-0x000000000A70A000-memory.dmp
memory/3668-83-0x000000000A530000-0x000000000A542000-memory.dmp
memory/3668-82-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/3668-84-0x000000000A590000-0x000000000A5CC000-memory.dmp
memory/3668-85-0x000000000A710000-0x000000000A75C000-memory.dmp
memory/3668-86-0x0000000073990000-0x0000000074140000-memory.dmp
memory/3668-87-0x00000000050D0000-0x00000000050E0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |