Analysis Overview
SHA256
f9eaee9d430ac99f45dc070e3638aa97c1ff48d9309ea1c25b752b056db59cfd
Threat Level: Known bad
The file f9eaee9d430ac99f45dc070e3638aa97c1ff48d9309ea1c25b752b056db59cfd was found to be: Known bad.
Malicious Activity Summary
Healer
Modifies Windows Defender Real-time Protection settings
RedLine
Mystic
Amadey
Detects Healer an antivirus disabler dropper
Detect Mystic stealer payload
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Windows security modification
Adds Run key to start application
Suspicious use of SetThreadContext
Program crash
Unsigned PE
Enumerates physical storage devices
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:31
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:30
Reported
2023-10-10 20:45
Platform
win7-20230831-en
Max time kernel
118s
Max time network
123s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\f9eaee9d430ac99f45dc070e3638aa97c1ff48d9309ea1c25b752b056db59cfd.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2800 set thread context of 2576 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\f9eaee9d430ac99f45dc070e3638aa97c1ff48d9309ea1c25b752b056db59cfd.exe
"C:\Users\Admin\AppData\Local\Temp\f9eaee9d430ac99f45dc070e3638aa97c1ff48d9309ea1c25b752b056db59cfd.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 36
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
| MD5 | e71672017894c4bfaaaa812e9ab3c40d |
| SHA1 | 1aad9ec327b19359a690157353fe2f6b71a14125 |
| SHA256 | 8a126ca5accaa1c6a0aea6788e15f388512a99e0402de57c31de106bc9b08359 |
| SHA512 | 92b23eca42a27c921e1aaa3717b7a505fe452ed178f634701283cb1df5ad982289cf84ccc833d671f493adf31c85ffc5054da5be8c37cf74638d5a8f0a198ea0 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
| MD5 | e71672017894c4bfaaaa812e9ab3c40d |
| SHA1 | 1aad9ec327b19359a690157353fe2f6b71a14125 |
| SHA256 | 8a126ca5accaa1c6a0aea6788e15f388512a99e0402de57c31de106bc9b08359 |
| SHA512 | 92b23eca42a27c921e1aaa3717b7a505fe452ed178f634701283cb1df5ad982289cf84ccc833d671f493adf31c85ffc5054da5be8c37cf74638d5a8f0a198ea0 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
| MD5 | e71672017894c4bfaaaa812e9ab3c40d |
| SHA1 | 1aad9ec327b19359a690157353fe2f6b71a14125 |
| SHA256 | 8a126ca5accaa1c6a0aea6788e15f388512a99e0402de57c31de106bc9b08359 |
| SHA512 | 92b23eca42a27c921e1aaa3717b7a505fe452ed178f634701283cb1df5ad982289cf84ccc833d671f493adf31c85ffc5054da5be8c37cf74638d5a8f0a198ea0 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
| MD5 | e71672017894c4bfaaaa812e9ab3c40d |
| SHA1 | 1aad9ec327b19359a690157353fe2f6b71a14125 |
| SHA256 | 8a126ca5accaa1c6a0aea6788e15f388512a99e0402de57c31de106bc9b08359 |
| SHA512 | 92b23eca42a27c921e1aaa3717b7a505fe452ed178f634701283cb1df5ad982289cf84ccc833d671f493adf31c85ffc5054da5be8c37cf74638d5a8f0a198ea0 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
| MD5 | 82e20fa150ef3df6d112ab9f453f8c99 |
| SHA1 | 74676a55ed0bc202efb1b1a064d7a540b7c60328 |
| SHA256 | cd7374f4bac2b651508a7805a34b167a2a3bdde4274d6b0eb1b58ffd4d3186a7 |
| SHA512 | 4366a4c002a7179c3f1768225689e99cae6ff84d2834ad707ebfcdb77885f5789c001a619b3f089c896418c4de161582a7bbfb31345aeef143f75aaceed0fd3f |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
| MD5 | 82e20fa150ef3df6d112ab9f453f8c99 |
| SHA1 | 74676a55ed0bc202efb1b1a064d7a540b7c60328 |
| SHA256 | cd7374f4bac2b651508a7805a34b167a2a3bdde4274d6b0eb1b58ffd4d3186a7 |
| SHA512 | 4366a4c002a7179c3f1768225689e99cae6ff84d2834ad707ebfcdb77885f5789c001a619b3f089c896418c4de161582a7bbfb31345aeef143f75aaceed0fd3f |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
| MD5 | 82e20fa150ef3df6d112ab9f453f8c99 |
| SHA1 | 74676a55ed0bc202efb1b1a064d7a540b7c60328 |
| SHA256 | cd7374f4bac2b651508a7805a34b167a2a3bdde4274d6b0eb1b58ffd4d3186a7 |
| SHA512 | 4366a4c002a7179c3f1768225689e99cae6ff84d2834ad707ebfcdb77885f5789c001a619b3f089c896418c4de161582a7bbfb31345aeef143f75aaceed0fd3f |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
| MD5 | 82e20fa150ef3df6d112ab9f453f8c99 |
| SHA1 | 74676a55ed0bc202efb1b1a064d7a540b7c60328 |
| SHA256 | cd7374f4bac2b651508a7805a34b167a2a3bdde4274d6b0eb1b58ffd4d3186a7 |
| SHA512 | 4366a4c002a7179c3f1768225689e99cae6ff84d2834ad707ebfcdb77885f5789c001a619b3f089c896418c4de161582a7bbfb31345aeef143f75aaceed0fd3f |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
| MD5 | ab999c9cca0d1448597c5ff7ebd88bf9 |
| SHA1 | f0d12ddc8bb1b755d70052c990046ef1204fb712 |
| SHA256 | 53029fb6f4e564b2eb53f656b82d81c239a7f9a0e0748c8b8134497ba9817232 |
| SHA512 | 38519abf327e80c00cfe9f6dc07b075a18dfdb1d960ec6e78374e6c912b84aebbc135fa1cf915f824a0376164eda13e943ca666857aefeb202b85e974a913c3f |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
| MD5 | ab999c9cca0d1448597c5ff7ebd88bf9 |
| SHA1 | f0d12ddc8bb1b755d70052c990046ef1204fb712 |
| SHA256 | 53029fb6f4e564b2eb53f656b82d81c239a7f9a0e0748c8b8134497ba9817232 |
| SHA512 | 38519abf327e80c00cfe9f6dc07b075a18dfdb1d960ec6e78374e6c912b84aebbc135fa1cf915f824a0376164eda13e943ca666857aefeb202b85e974a913c3f |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
| MD5 | ab999c9cca0d1448597c5ff7ebd88bf9 |
| SHA1 | f0d12ddc8bb1b755d70052c990046ef1204fb712 |
| SHA256 | 53029fb6f4e564b2eb53f656b82d81c239a7f9a0e0748c8b8134497ba9817232 |
| SHA512 | 38519abf327e80c00cfe9f6dc07b075a18dfdb1d960ec6e78374e6c912b84aebbc135fa1cf915f824a0376164eda13e943ca666857aefeb202b85e974a913c3f |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
| MD5 | ab999c9cca0d1448597c5ff7ebd88bf9 |
| SHA1 | f0d12ddc8bb1b755d70052c990046ef1204fb712 |
| SHA256 | 53029fb6f4e564b2eb53f656b82d81c239a7f9a0e0748c8b8134497ba9817232 |
| SHA512 | 38519abf327e80c00cfe9f6dc07b075a18dfdb1d960ec6e78374e6c912b84aebbc135fa1cf915f824a0376164eda13e943ca666857aefeb202b85e974a913c3f |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
| MD5 | b04b91edaf31f755487e95eaa688c6e6 |
| SHA1 | a6492b7e542ff8fa655496b99d67fdc457975119 |
| SHA256 | e947f32ae642d870e4b513d0982e88d59e9f08b02cc593e19157c932cc4b6a2c |
| SHA512 | e99c18458be3bd5eeddc1fbd96022eb514e28f4d06e1b16e7320acb901ea747f798c792f2b0dd8a927c830c5c0b4578ac369d2e2400367630c84891130f32d4d |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
| MD5 | b04b91edaf31f755487e95eaa688c6e6 |
| SHA1 | a6492b7e542ff8fa655496b99d67fdc457975119 |
| SHA256 | e947f32ae642d870e4b513d0982e88d59e9f08b02cc593e19157c932cc4b6a2c |
| SHA512 | e99c18458be3bd5eeddc1fbd96022eb514e28f4d06e1b16e7320acb901ea747f798c792f2b0dd8a927c830c5c0b4578ac369d2e2400367630c84891130f32d4d |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
| MD5 | b04b91edaf31f755487e95eaa688c6e6 |
| SHA1 | a6492b7e542ff8fa655496b99d67fdc457975119 |
| SHA256 | e947f32ae642d870e4b513d0982e88d59e9f08b02cc593e19157c932cc4b6a2c |
| SHA512 | e99c18458be3bd5eeddc1fbd96022eb514e28f4d06e1b16e7320acb901ea747f798c792f2b0dd8a927c830c5c0b4578ac369d2e2400367630c84891130f32d4d |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
| MD5 | b04b91edaf31f755487e95eaa688c6e6 |
| SHA1 | a6492b7e542ff8fa655496b99d67fdc457975119 |
| SHA256 | e947f32ae642d870e4b513d0982e88d59e9f08b02cc593e19157c932cc4b6a2c |
| SHA512 | e99c18458be3bd5eeddc1fbd96022eb514e28f4d06e1b16e7320acb901ea747f798c792f2b0dd8a927c830c5c0b4578ac369d2e2400367630c84891130f32d4d |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe
| MD5 | 4a56bea3b8c1256f2e4b86d9c05d888c |
| SHA1 | b374c9c87070c51ad2648e8a3fa49de8314b57f6 |
| SHA256 | bae44dec8bd26a464557f339406a6d6219b0a28f9f1b0b5c0c90cf59eada81d9 |
| SHA512 | 557ed27d722e7317a13c7f3f92264833ac7f081c7fadc1bd7b7d94b965dde41a9d12610f640520b329415c4a6589b0823d89e69f9416526f890886f8d4f326f1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe
| MD5 | 4a56bea3b8c1256f2e4b86d9c05d888c |
| SHA1 | b374c9c87070c51ad2648e8a3fa49de8314b57f6 |
| SHA256 | bae44dec8bd26a464557f339406a6d6219b0a28f9f1b0b5c0c90cf59eada81d9 |
| SHA512 | 557ed27d722e7317a13c7f3f92264833ac7f081c7fadc1bd7b7d94b965dde41a9d12610f640520b329415c4a6589b0823d89e69f9416526f890886f8d4f326f1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe
| MD5 | 4a56bea3b8c1256f2e4b86d9c05d888c |
| SHA1 | b374c9c87070c51ad2648e8a3fa49de8314b57f6 |
| SHA256 | bae44dec8bd26a464557f339406a6d6219b0a28f9f1b0b5c0c90cf59eada81d9 |
| SHA512 | 557ed27d722e7317a13c7f3f92264833ac7f081c7fadc1bd7b7d94b965dde41a9d12610f640520b329415c4a6589b0823d89e69f9416526f890886f8d4f326f1 |
memory/2772-48-0x0000000000BD0000-0x0000000000BDA000-memory.dmp
memory/2772-49-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp
memory/2772-50-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp
memory/2772-51-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
memory/2576-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2576-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:30
Reported
2023-10-10 20:45
Platform
win10v2004-20230915-en
Max time kernel
142s
Max time network
152s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4522728.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1716009.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\f9eaee9d430ac99f45dc070e3638aa97c1ff48d9309ea1c25b752b056db59cfd.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3168 set thread context of 1944 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3624 set thread context of 2084 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1405610.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\f9eaee9d430ac99f45dc070e3638aa97c1ff48d9309ea1c25b752b056db59cfd.exe
"C:\Users\Admin\AppData\Local\Temp\f9eaee9d430ac99f45dc070e3638aa97c1ff48d9309ea1c25b752b056db59cfd.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3168 -ip 3168
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1944 -ip 1944
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 580
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1405610.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1405610.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3624 -ip 3624
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4522728.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4522728.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1716009.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1716009.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7755293.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7755293.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.177.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.1.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 152.141.79.40.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
| MD5 | e71672017894c4bfaaaa812e9ab3c40d |
| SHA1 | 1aad9ec327b19359a690157353fe2f6b71a14125 |
| SHA256 | 8a126ca5accaa1c6a0aea6788e15f388512a99e0402de57c31de106bc9b08359 |
| SHA512 | 92b23eca42a27c921e1aaa3717b7a505fe452ed178f634701283cb1df5ad982289cf84ccc833d671f493adf31c85ffc5054da5be8c37cf74638d5a8f0a198ea0 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0113943.exe
| MD5 | e71672017894c4bfaaaa812e9ab3c40d |
| SHA1 | 1aad9ec327b19359a690157353fe2f6b71a14125 |
| SHA256 | 8a126ca5accaa1c6a0aea6788e15f388512a99e0402de57c31de106bc9b08359 |
| SHA512 | 92b23eca42a27c921e1aaa3717b7a505fe452ed178f634701283cb1df5ad982289cf84ccc833d671f493adf31c85ffc5054da5be8c37cf74638d5a8f0a198ea0 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
| MD5 | 82e20fa150ef3df6d112ab9f453f8c99 |
| SHA1 | 74676a55ed0bc202efb1b1a064d7a540b7c60328 |
| SHA256 | cd7374f4bac2b651508a7805a34b167a2a3bdde4274d6b0eb1b58ffd4d3186a7 |
| SHA512 | 4366a4c002a7179c3f1768225689e99cae6ff84d2834ad707ebfcdb77885f5789c001a619b3f089c896418c4de161582a7bbfb31345aeef143f75aaceed0fd3f |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5784870.exe
| MD5 | 82e20fa150ef3df6d112ab9f453f8c99 |
| SHA1 | 74676a55ed0bc202efb1b1a064d7a540b7c60328 |
| SHA256 | cd7374f4bac2b651508a7805a34b167a2a3bdde4274d6b0eb1b58ffd4d3186a7 |
| SHA512 | 4366a4c002a7179c3f1768225689e99cae6ff84d2834ad707ebfcdb77885f5789c001a619b3f089c896418c4de161582a7bbfb31345aeef143f75aaceed0fd3f |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
| MD5 | ab999c9cca0d1448597c5ff7ebd88bf9 |
| SHA1 | f0d12ddc8bb1b755d70052c990046ef1204fb712 |
| SHA256 | 53029fb6f4e564b2eb53f656b82d81c239a7f9a0e0748c8b8134497ba9817232 |
| SHA512 | 38519abf327e80c00cfe9f6dc07b075a18dfdb1d960ec6e78374e6c912b84aebbc135fa1cf915f824a0376164eda13e943ca666857aefeb202b85e974a913c3f |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6483160.exe
| MD5 | ab999c9cca0d1448597c5ff7ebd88bf9 |
| SHA1 | f0d12ddc8bb1b755d70052c990046ef1204fb712 |
| SHA256 | 53029fb6f4e564b2eb53f656b82d81c239a7f9a0e0748c8b8134497ba9817232 |
| SHA512 | 38519abf327e80c00cfe9f6dc07b075a18dfdb1d960ec6e78374e6c912b84aebbc135fa1cf915f824a0376164eda13e943ca666857aefeb202b85e974a913c3f |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
| MD5 | b04b91edaf31f755487e95eaa688c6e6 |
| SHA1 | a6492b7e542ff8fa655496b99d67fdc457975119 |
| SHA256 | e947f32ae642d870e4b513d0982e88d59e9f08b02cc593e19157c932cc4b6a2c |
| SHA512 | e99c18458be3bd5eeddc1fbd96022eb514e28f4d06e1b16e7320acb901ea747f798c792f2b0dd8a927c830c5c0b4578ac369d2e2400367630c84891130f32d4d |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1339842.exe
| MD5 | b04b91edaf31f755487e95eaa688c6e6 |
| SHA1 | a6492b7e542ff8fa655496b99d67fdc457975119 |
| SHA256 | e947f32ae642d870e4b513d0982e88d59e9f08b02cc593e19157c932cc4b6a2c |
| SHA512 | e99c18458be3bd5eeddc1fbd96022eb514e28f4d06e1b16e7320acb901ea747f798c792f2b0dd8a927c830c5c0b4578ac369d2e2400367630c84891130f32d4d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe
| MD5 | 4a56bea3b8c1256f2e4b86d9c05d888c |
| SHA1 | b374c9c87070c51ad2648e8a3fa49de8314b57f6 |
| SHA256 | bae44dec8bd26a464557f339406a6d6219b0a28f9f1b0b5c0c90cf59eada81d9 |
| SHA512 | 557ed27d722e7317a13c7f3f92264833ac7f081c7fadc1bd7b7d94b965dde41a9d12610f640520b329415c4a6589b0823d89e69f9416526f890886f8d4f326f1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5190116.exe
| MD5 | 4a56bea3b8c1256f2e4b86d9c05d888c |
| SHA1 | b374c9c87070c51ad2648e8a3fa49de8314b57f6 |
| SHA256 | bae44dec8bd26a464557f339406a6d6219b0a28f9f1b0b5c0c90cf59eada81d9 |
| SHA512 | 557ed27d722e7317a13c7f3f92264833ac7f081c7fadc1bd7b7d94b965dde41a9d12610f640520b329415c4a6589b0823d89e69f9416526f890886f8d4f326f1 |
memory/1112-35-0x0000000000560000-0x000000000056A000-memory.dmp
memory/1112-36-0x00007FFB50F90000-0x00007FFB51A51000-memory.dmp
memory/1112-38-0x00007FFB50F90000-0x00007FFB51A51000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2727394.exe
| MD5 | 61779402f24137d46d35687738be3cf4 |
| SHA1 | 7d748dab6e97f5cb5af15b2335236d1137c8943a |
| SHA256 | 29c646d18a359950a821043c310ea4feb600bf25036f71493f1054b3109c917d |
| SHA512 | 07bdaaa4c81c330214926aa30cde8eb411293a7ff699fd62317b4d38582a5989bf90c146c6f36041f865c472363dadc1797f73f3db667b0d20d44cdd637afac4 |
memory/1944-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1944-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1944-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1944-46-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1405610.exe
| MD5 | 6215d8f476d3d5088dead09f7e2798d6 |
| SHA1 | c52ad866d24b5e1d8dda96e9d0d6b5f218caaada |
| SHA256 | 660fb2449099b4adb24666b75ca585c2ed9aa04a9822cb0bc69281c056ea9dd5 |
| SHA512 | 2161fc1cde1c1415c7b5130f77a8d1e42bbc42bc9a182b576e134d2fdd9b1331198545488774e65c36f952d069c2b2cc5b24d3219be6dc815f0814a24eb5b9e9 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1405610.exe
| MD5 | 6215d8f476d3d5088dead09f7e2798d6 |
| SHA1 | c52ad866d24b5e1d8dda96e9d0d6b5f218caaada |
| SHA256 | 660fb2449099b4adb24666b75ca585c2ed9aa04a9822cb0bc69281c056ea9dd5 |
| SHA512 | 2161fc1cde1c1415c7b5130f77a8d1e42bbc42bc9a182b576e134d2fdd9b1331198545488774e65c36f952d069c2b2cc5b24d3219be6dc815f0814a24eb5b9e9 |
memory/2084-50-0x0000000000400000-0x0000000000430000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4522728.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4522728.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2084-55-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/2084-54-0x00000000056D0000-0x00000000056D6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2084-62-0x0000000005D60000-0x0000000006378000-memory.dmp
memory/2084-63-0x0000000005850000-0x000000000595A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2084-68-0x0000000005730000-0x0000000005740000-memory.dmp
memory/2084-67-0x0000000005770000-0x0000000005782000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1716009.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1716009.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2084-74-0x00000000057D0000-0x000000000580C000-memory.dmp
memory/2084-79-0x0000000005960000-0x00000000059AC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7755293.exe
| MD5 | 83f118d1cbc9a69319f4ef1b03bdd952 |
| SHA1 | 8c9f59b762b8a830044e57d6cf74704215aedc7c |
| SHA256 | a387f49c8c0dc80d10f29b3711373c6774c40db3fa2194c808aa49302a13c982 |
| SHA512 | 4030d3d5b9879182fe0f3060167c637894312fd2b1b63b601bb40703a5cf4ffa195e49653b57a785df19d1b077436b03f371257955a11ddc3ab1b95431d44ff4 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7755293.exe
| MD5 | 83f118d1cbc9a69319f4ef1b03bdd952 |
| SHA1 | 8c9f59b762b8a830044e57d6cf74704215aedc7c |
| SHA256 | a387f49c8c0dc80d10f29b3711373c6774c40db3fa2194c808aa49302a13c982 |
| SHA512 | 4030d3d5b9879182fe0f3060167c637894312fd2b1b63b601bb40703a5cf4ffa195e49653b57a785df19d1b077436b03f371257955a11ddc3ab1b95431d44ff4 |
memory/2084-86-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/2084-87-0x0000000005730000-0x0000000005740000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |