Analysis Overview
SHA256
e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb
Threat Level: Known bad
The file e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb was found to be: Known bad.
Malicious Activity Summary
Detects Healer an antivirus disabler dropper
Modifies Windows Defender Real-time Protection settings
Mystic
Amadey
Detect Mystic stealer payload
Healer
RedLine
Loads dropped DLL
Executes dropped EXE
Windows security modification
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Program crash
Unsigned PE
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:30
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:30
Reported
2023-10-10 20:44
Platform
win7-20230831-en
Max time kernel
118s
Max time network
125s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2516 set thread context of 2424 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb.exe
"C:\Users\Admin\AppData\Local\Temp\e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 36
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 268
Network
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
| MD5 | abb15fc52c135af48dc5c67e743c5341 |
| SHA1 | 7f1c79e9bfeccd39bbff672ca57bd56b2785fcc0 |
| SHA256 | 32744c34670b0338d73546ceb59949d6b6dbe96b3baa599197c470d725939457 |
| SHA512 | af09a8f06ff26947afe06c7848c37f281f8c72953839baf9c3ed8197648b117b194d9e81519fe13510d4f0cfd798ee4a4ce963bed7ec2d739a38a8717d8fdbec |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
| MD5 | abb15fc52c135af48dc5c67e743c5341 |
| SHA1 | 7f1c79e9bfeccd39bbff672ca57bd56b2785fcc0 |
| SHA256 | 32744c34670b0338d73546ceb59949d6b6dbe96b3baa599197c470d725939457 |
| SHA512 | af09a8f06ff26947afe06c7848c37f281f8c72953839baf9c3ed8197648b117b194d9e81519fe13510d4f0cfd798ee4a4ce963bed7ec2d739a38a8717d8fdbec |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
| MD5 | abb15fc52c135af48dc5c67e743c5341 |
| SHA1 | 7f1c79e9bfeccd39bbff672ca57bd56b2785fcc0 |
| SHA256 | 32744c34670b0338d73546ceb59949d6b6dbe96b3baa599197c470d725939457 |
| SHA512 | af09a8f06ff26947afe06c7848c37f281f8c72953839baf9c3ed8197648b117b194d9e81519fe13510d4f0cfd798ee4a4ce963bed7ec2d739a38a8717d8fdbec |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
| MD5 | abb15fc52c135af48dc5c67e743c5341 |
| SHA1 | 7f1c79e9bfeccd39bbff672ca57bd56b2785fcc0 |
| SHA256 | 32744c34670b0338d73546ceb59949d6b6dbe96b3baa599197c470d725939457 |
| SHA512 | af09a8f06ff26947afe06c7848c37f281f8c72953839baf9c3ed8197648b117b194d9e81519fe13510d4f0cfd798ee4a4ce963bed7ec2d739a38a8717d8fdbec |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
| MD5 | 5fc2fa53fc8323052371c99f84a3ec9f |
| SHA1 | ffcc4f49bebf03d99b9dfcb46fc4402eef4e03b0 |
| SHA256 | df2d928b489f20c36733dceddb01ab2d2d168ca84b34d6ddc8679ff8861f87b6 |
| SHA512 | 5c234fd06fb9dce79ab178201bd81a1dcb7c05ef750b0a371abddd6164faa10740d8e862587db04ebab33b2da06ff6175bc2e5cd66cff696940b7ee987dc181e |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
| MD5 | 5fc2fa53fc8323052371c99f84a3ec9f |
| SHA1 | ffcc4f49bebf03d99b9dfcb46fc4402eef4e03b0 |
| SHA256 | df2d928b489f20c36733dceddb01ab2d2d168ca84b34d6ddc8679ff8861f87b6 |
| SHA512 | 5c234fd06fb9dce79ab178201bd81a1dcb7c05ef750b0a371abddd6164faa10740d8e862587db04ebab33b2da06ff6175bc2e5cd66cff696940b7ee987dc181e |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
| MD5 | 5fc2fa53fc8323052371c99f84a3ec9f |
| SHA1 | ffcc4f49bebf03d99b9dfcb46fc4402eef4e03b0 |
| SHA256 | df2d928b489f20c36733dceddb01ab2d2d168ca84b34d6ddc8679ff8861f87b6 |
| SHA512 | 5c234fd06fb9dce79ab178201bd81a1dcb7c05ef750b0a371abddd6164faa10740d8e862587db04ebab33b2da06ff6175bc2e5cd66cff696940b7ee987dc181e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
| MD5 | 5fc2fa53fc8323052371c99f84a3ec9f |
| SHA1 | ffcc4f49bebf03d99b9dfcb46fc4402eef4e03b0 |
| SHA256 | df2d928b489f20c36733dceddb01ab2d2d168ca84b34d6ddc8679ff8861f87b6 |
| SHA512 | 5c234fd06fb9dce79ab178201bd81a1dcb7c05ef750b0a371abddd6164faa10740d8e862587db04ebab33b2da06ff6175bc2e5cd66cff696940b7ee987dc181e |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
| MD5 | 8b3f7c84fb69b7a5fd606ca4364f1557 |
| SHA1 | a9bd46fc9fc4a79de786227944fe84a3aef87f2d |
| SHA256 | ae889d276d7b27bdabc2f6d5cd9c9c2b532b33f9417688bfe4a2328d41de79fc |
| SHA512 | d4cd7294829d3fa14d4f67128c8afa54cdeccfca8263c213caa0a145f5cf1e3d33760dfceba6fc29dbed3812862359e73fc5214c3011cf0e1bf7c674a03694d8 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
| MD5 | 8b3f7c84fb69b7a5fd606ca4364f1557 |
| SHA1 | a9bd46fc9fc4a79de786227944fe84a3aef87f2d |
| SHA256 | ae889d276d7b27bdabc2f6d5cd9c9c2b532b33f9417688bfe4a2328d41de79fc |
| SHA512 | d4cd7294829d3fa14d4f67128c8afa54cdeccfca8263c213caa0a145f5cf1e3d33760dfceba6fc29dbed3812862359e73fc5214c3011cf0e1bf7c674a03694d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
| MD5 | 8b3f7c84fb69b7a5fd606ca4364f1557 |
| SHA1 | a9bd46fc9fc4a79de786227944fe84a3aef87f2d |
| SHA256 | ae889d276d7b27bdabc2f6d5cd9c9c2b532b33f9417688bfe4a2328d41de79fc |
| SHA512 | d4cd7294829d3fa14d4f67128c8afa54cdeccfca8263c213caa0a145f5cf1e3d33760dfceba6fc29dbed3812862359e73fc5214c3011cf0e1bf7c674a03694d8 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
| MD5 | 4ad70df21f293b05f4b4d38a23df1531 |
| SHA1 | 00bf3d55f2ca474e79e9790dea1c844cbd3d29ce |
| SHA256 | da122936654fadc2ab058e2ee24e6b223a046f7d2ee4ea616be38ef5235ab0ee |
| SHA512 | 1fc0bd62509233a318657654821059096fd63a7f56548c62ea622e1984f9e9403abcecc9b0efa932cba6b6b79e316d11bb94757c9dd7f5d0a5cd873d464c3b7d |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
| MD5 | 4ad70df21f293b05f4b4d38a23df1531 |
| SHA1 | 00bf3d55f2ca474e79e9790dea1c844cbd3d29ce |
| SHA256 | da122936654fadc2ab058e2ee24e6b223a046f7d2ee4ea616be38ef5235ab0ee |
| SHA512 | 1fc0bd62509233a318657654821059096fd63a7f56548c62ea622e1984f9e9403abcecc9b0efa932cba6b6b79e316d11bb94757c9dd7f5d0a5cd873d464c3b7d |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
| MD5 | 4ad70df21f293b05f4b4d38a23df1531 |
| SHA1 | 00bf3d55f2ca474e79e9790dea1c844cbd3d29ce |
| SHA256 | da122936654fadc2ab058e2ee24e6b223a046f7d2ee4ea616be38ef5235ab0ee |
| SHA512 | 1fc0bd62509233a318657654821059096fd63a7f56548c62ea622e1984f9e9403abcecc9b0efa932cba6b6b79e316d11bb94757c9dd7f5d0a5cd873d464c3b7d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe
| MD5 | 46b6b202f5d09ecb5d316a4becb1ea12 |
| SHA1 | 7336cad615db5bbb34f62ef5e028c3f38ac2af3c |
| SHA256 | b10c874c59321a0d2534bb2adbe6a4d8f9eccc64056b7b74c2eb7b50944bec4c |
| SHA512 | 919e8aecafe75424cc4182452ab557ca08cc8e8b1bec14876a5b3183da4bb752fc3b5e308040e2c50f5797ba9e9a0e5b1d4222426285df13b2a9d891adc7e93b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe
| MD5 | 46b6b202f5d09ecb5d316a4becb1ea12 |
| SHA1 | 7336cad615db5bbb34f62ef5e028c3f38ac2af3c |
| SHA256 | b10c874c59321a0d2534bb2adbe6a4d8f9eccc64056b7b74c2eb7b50944bec4c |
| SHA512 | 919e8aecafe75424cc4182452ab557ca08cc8e8b1bec14876a5b3183da4bb752fc3b5e308040e2c50f5797ba9e9a0e5b1d4222426285df13b2a9d891adc7e93b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe
| MD5 | 46b6b202f5d09ecb5d316a4becb1ea12 |
| SHA1 | 7336cad615db5bbb34f62ef5e028c3f38ac2af3c |
| SHA256 | b10c874c59321a0d2534bb2adbe6a4d8f9eccc64056b7b74c2eb7b50944bec4c |
| SHA512 | 919e8aecafe75424cc4182452ab557ca08cc8e8b1bec14876a5b3183da4bb752fc3b5e308040e2c50f5797ba9e9a0e5b1d4222426285df13b2a9d891adc7e93b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
| MD5 | 4ad70df21f293b05f4b4d38a23df1531 |
| SHA1 | 00bf3d55f2ca474e79e9790dea1c844cbd3d29ce |
| SHA256 | da122936654fadc2ab058e2ee24e6b223a046f7d2ee4ea616be38ef5235ab0ee |
| SHA512 | 1fc0bd62509233a318657654821059096fd63a7f56548c62ea622e1984f9e9403abcecc9b0efa932cba6b6b79e316d11bb94757c9dd7f5d0a5cd873d464c3b7d |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
| MD5 | 8b3f7c84fb69b7a5fd606ca4364f1557 |
| SHA1 | a9bd46fc9fc4a79de786227944fe84a3aef87f2d |
| SHA256 | ae889d276d7b27bdabc2f6d5cd9c9c2b532b33f9417688bfe4a2328d41de79fc |
| SHA512 | d4cd7294829d3fa14d4f67128c8afa54cdeccfca8263c213caa0a145f5cf1e3d33760dfceba6fc29dbed3812862359e73fc5214c3011cf0e1bf7c674a03694d8 |
memory/2484-48-0x0000000000E10000-0x0000000000E1A000-memory.dmp
memory/2484-49-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp
memory/2484-50-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp
memory/2484-51-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
memory/2424-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2424-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2424-72-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2424-70-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
memory/2424-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2424-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2424-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2424-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2424-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2424-61-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:30
Reported
2023-10-10 20:44
Platform
win10v2004-20230915-en
Max time kernel
139s
Max time network
152s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2158989.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0614131.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1488 set thread context of 2920 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4692 set thread context of 2364 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3228381.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb.exe
"C:\Users\Admin\AppData\Local\Temp\e12b0298c400aeaba40cd0c5086303188cbc5773334d51f8d3da01f05fa44fbb.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1488 -ip 1488
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2920 -ip 2920
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 196
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3228381.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3228381.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4692 -ip 4692
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 580
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0614131.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0614131.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8809073.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8809073.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2158989.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2158989.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.201.86.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 224.162.46.104.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
| MD5 | abb15fc52c135af48dc5c67e743c5341 |
| SHA1 | 7f1c79e9bfeccd39bbff672ca57bd56b2785fcc0 |
| SHA256 | 32744c34670b0338d73546ceb59949d6b6dbe96b3baa599197c470d725939457 |
| SHA512 | af09a8f06ff26947afe06c7848c37f281f8c72953839baf9c3ed8197648b117b194d9e81519fe13510d4f0cfd798ee4a4ce963bed7ec2d739a38a8717d8fdbec |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7708764.exe
| MD5 | abb15fc52c135af48dc5c67e743c5341 |
| SHA1 | 7f1c79e9bfeccd39bbff672ca57bd56b2785fcc0 |
| SHA256 | 32744c34670b0338d73546ceb59949d6b6dbe96b3baa599197c470d725939457 |
| SHA512 | af09a8f06ff26947afe06c7848c37f281f8c72953839baf9c3ed8197648b117b194d9e81519fe13510d4f0cfd798ee4a4ce963bed7ec2d739a38a8717d8fdbec |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
| MD5 | 5fc2fa53fc8323052371c99f84a3ec9f |
| SHA1 | ffcc4f49bebf03d99b9dfcb46fc4402eef4e03b0 |
| SHA256 | df2d928b489f20c36733dceddb01ab2d2d168ca84b34d6ddc8679ff8861f87b6 |
| SHA512 | 5c234fd06fb9dce79ab178201bd81a1dcb7c05ef750b0a371abddd6164faa10740d8e862587db04ebab33b2da06ff6175bc2e5cd66cff696940b7ee987dc181e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8990320.exe
| MD5 | 5fc2fa53fc8323052371c99f84a3ec9f |
| SHA1 | ffcc4f49bebf03d99b9dfcb46fc4402eef4e03b0 |
| SHA256 | df2d928b489f20c36733dceddb01ab2d2d168ca84b34d6ddc8679ff8861f87b6 |
| SHA512 | 5c234fd06fb9dce79ab178201bd81a1dcb7c05ef750b0a371abddd6164faa10740d8e862587db04ebab33b2da06ff6175bc2e5cd66cff696940b7ee987dc181e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
| MD5 | 8b3f7c84fb69b7a5fd606ca4364f1557 |
| SHA1 | a9bd46fc9fc4a79de786227944fe84a3aef87f2d |
| SHA256 | ae889d276d7b27bdabc2f6d5cd9c9c2b532b33f9417688bfe4a2328d41de79fc |
| SHA512 | d4cd7294829d3fa14d4f67128c8afa54cdeccfca8263c213caa0a145f5cf1e3d33760dfceba6fc29dbed3812862359e73fc5214c3011cf0e1bf7c674a03694d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8955626.exe
| MD5 | 8b3f7c84fb69b7a5fd606ca4364f1557 |
| SHA1 | a9bd46fc9fc4a79de786227944fe84a3aef87f2d |
| SHA256 | ae889d276d7b27bdabc2f6d5cd9c9c2b532b33f9417688bfe4a2328d41de79fc |
| SHA512 | d4cd7294829d3fa14d4f67128c8afa54cdeccfca8263c213caa0a145f5cf1e3d33760dfceba6fc29dbed3812862359e73fc5214c3011cf0e1bf7c674a03694d8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
| MD5 | 4ad70df21f293b05f4b4d38a23df1531 |
| SHA1 | 00bf3d55f2ca474e79e9790dea1c844cbd3d29ce |
| SHA256 | da122936654fadc2ab058e2ee24e6b223a046f7d2ee4ea616be38ef5235ab0ee |
| SHA512 | 1fc0bd62509233a318657654821059096fd63a7f56548c62ea622e1984f9e9403abcecc9b0efa932cba6b6b79e316d11bb94757c9dd7f5d0a5cd873d464c3b7d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe
| MD5 | 46b6b202f5d09ecb5d316a4becb1ea12 |
| SHA1 | 7336cad615db5bbb34f62ef5e028c3f38ac2af3c |
| SHA256 | b10c874c59321a0d2534bb2adbe6a4d8f9eccc64056b7b74c2eb7b50944bec4c |
| SHA512 | 919e8aecafe75424cc4182452ab557ca08cc8e8b1bec14876a5b3183da4bb752fc3b5e308040e2c50f5797ba9e9a0e5b1d4222426285df13b2a9d891adc7e93b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6503163.exe
| MD5 | 46b6b202f5d09ecb5d316a4becb1ea12 |
| SHA1 | 7336cad615db5bbb34f62ef5e028c3f38ac2af3c |
| SHA256 | b10c874c59321a0d2534bb2adbe6a4d8f9eccc64056b7b74c2eb7b50944bec4c |
| SHA512 | 919e8aecafe75424cc4182452ab557ca08cc8e8b1bec14876a5b3183da4bb752fc3b5e308040e2c50f5797ba9e9a0e5b1d4222426285df13b2a9d891adc7e93b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8540147.exe
| MD5 | 4ad70df21f293b05f4b4d38a23df1531 |
| SHA1 | 00bf3d55f2ca474e79e9790dea1c844cbd3d29ce |
| SHA256 | da122936654fadc2ab058e2ee24e6b223a046f7d2ee4ea616be38ef5235ab0ee |
| SHA512 | 1fc0bd62509233a318657654821059096fd63a7f56548c62ea622e1984f9e9403abcecc9b0efa932cba6b6b79e316d11bb94757c9dd7f5d0a5cd873d464c3b7d |
memory/3708-35-0x00000000005C0000-0x00000000005CA000-memory.dmp
memory/3708-36-0x00007FFD62550000-0x00007FFD63011000-memory.dmp
memory/3708-38-0x00007FFD62550000-0x00007FFD63011000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2929865.exe
| MD5 | 068f00cd70936e791a7fb3a75620b58a |
| SHA1 | 5dd84558f580201309418e3476d69d1361f6ac3f |
| SHA256 | 881777ba037364fd8f44b92e994ccf0da89ec4b46481f27b8d12967f0fe976eb |
| SHA512 | 21676e14af88b87d59618f12c646ed73d68e3f393ed293d1761430db330cabc02806b1bf3887a70f07c12e52fa24ec792d09b4f4d91845a67d451612339ea553 |
memory/2920-46-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2920-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2920-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2920-42-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3228381.exe
| MD5 | 14cbd6b9b24a42f5a7072e47c4054e1c |
| SHA1 | 1bec89e429628fc41aff4e5f94c35abef4545eb2 |
| SHA256 | 22d2a0d36d8b59df03f8bfd568082fba6ba23fe12d00575ba0b52cf77a640b30 |
| SHA512 | f66a4ad559a61f4ff0fd227f812dc57a9528ab0a4efe9a815ecbc390c8fc7a4be46cdd17c97f3e90f29a06f5c4c9e24f826ab38bb2de69683a2c921a43cab917 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3228381.exe
| MD5 | 14cbd6b9b24a42f5a7072e47c4054e1c |
| SHA1 | 1bec89e429628fc41aff4e5f94c35abef4545eb2 |
| SHA256 | 22d2a0d36d8b59df03f8bfd568082fba6ba23fe12d00575ba0b52cf77a640b30 |
| SHA512 | f66a4ad559a61f4ff0fd227f812dc57a9528ab0a4efe9a815ecbc390c8fc7a4be46cdd17c97f3e90f29a06f5c4c9e24f826ab38bb2de69683a2c921a43cab917 |
memory/2364-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2364-51-0x0000000074090000-0x0000000074840000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0614131.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0614131.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2364-52-0x00000000012F0000-0x00000000012F6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2158989.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2364-71-0x0000000005300000-0x000000000540A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2364-81-0x0000000005250000-0x000000000528C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8809073.exe
| MD5 | 81b378fd27231d47878b3971fba2603f |
| SHA1 | d2ad0b4c2d3f69d32d02d905aec2373299677662 |
| SHA256 | d24f24a45f00161471b774e7ac6c0efe80f7c51d6257a4fe4d23ebb2ad4bd0e3 |
| SHA512 | be21cd748d53b6ebfada6abb988ed2736da4eefb67127b2795b2daca9d3ba94f8cc8bde8a0f5eb99a89dbe293084cb8739659ac9a0c5b02ec2f3378b735bf54a |
memory/2364-85-0x00000000052A0000-0x00000000052EC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8809073.exe
| MD5 | 81b378fd27231d47878b3971fba2603f |
| SHA1 | d2ad0b4c2d3f69d32d02d905aec2373299677662 |
| SHA256 | d24f24a45f00161471b774e7ac6c0efe80f7c51d6257a4fe4d23ebb2ad4bd0e3 |
| SHA512 | be21cd748d53b6ebfada6abb988ed2736da4eefb67127b2795b2daca9d3ba94f8cc8bde8a0f5eb99a89dbe293084cb8739659ac9a0c5b02ec2f3378b735bf54a |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2364-73-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/2364-72-0x00000000051F0000-0x0000000005202000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2158989.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2364-65-0x0000000005810000-0x0000000005E28000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2364-86-0x0000000074090000-0x0000000074840000-memory.dmp
memory/2364-87-0x0000000002C00000-0x0000000002C10000-memory.dmp
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |