Analysis Overview
SHA256
0d67e6d67fc220523d19114711357d5fc1fdd20ca6e27aad627c835c3b79b863
Threat Level: Known bad
The file 0d67e6d67fc220523d19114711357d5fc1fdd20ca6e27aad627c835c3b79b863 was found to be: Known bad.
Malicious Activity Summary
Detects Healer an antivirus disabler dropper
Mystic
Modifies Windows Defender Real-time Protection settings
RedLine
Detect Mystic stealer payload
Amadey
Healer
Windows security modification
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:33
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:33
Reported
2023-10-10 20:49
Platform
win7-20230831-en
Max time kernel
118s
Max time network
122s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\0d67e6d67fc220523d19114711357d5fc1fdd20ca6e27aad627c835c3b79b863.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2528 set thread context of 2356 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0d67e6d67fc220523d19114711357d5fc1fdd20ca6e27aad627c835c3b79b863.exe
"C:\Users\Admin\AppData\Local\Temp\0d67e6d67fc220523d19114711357d5fc1fdd20ca6e27aad627c835c3b79b863.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 276
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
| MD5 | 831a51e660311f4512d1dc14ac0a4680 |
| SHA1 | db6a9e1357932477d7f18cd0add23acaf9fb4b9b |
| SHA256 | b01f892a7ea94f3531147e09dc5de052922da85e6428d0915e0c225fe16d5fe2 |
| SHA512 | a5634bb34349608817eb4fb2476c62284de4f5a4c3290cb8009d740adb486d02f5ca34337618f19e57af978d7604df4df8c7428727d0ae2495ca0a397226c5bf |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
| MD5 | 831a51e660311f4512d1dc14ac0a4680 |
| SHA1 | db6a9e1357932477d7f18cd0add23acaf9fb4b9b |
| SHA256 | b01f892a7ea94f3531147e09dc5de052922da85e6428d0915e0c225fe16d5fe2 |
| SHA512 | a5634bb34349608817eb4fb2476c62284de4f5a4c3290cb8009d740adb486d02f5ca34337618f19e57af978d7604df4df8c7428727d0ae2495ca0a397226c5bf |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
| MD5 | 831a51e660311f4512d1dc14ac0a4680 |
| SHA1 | db6a9e1357932477d7f18cd0add23acaf9fb4b9b |
| SHA256 | b01f892a7ea94f3531147e09dc5de052922da85e6428d0915e0c225fe16d5fe2 |
| SHA512 | a5634bb34349608817eb4fb2476c62284de4f5a4c3290cb8009d740adb486d02f5ca34337618f19e57af978d7604df4df8c7428727d0ae2495ca0a397226c5bf |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
| MD5 | 831a51e660311f4512d1dc14ac0a4680 |
| SHA1 | db6a9e1357932477d7f18cd0add23acaf9fb4b9b |
| SHA256 | b01f892a7ea94f3531147e09dc5de052922da85e6428d0915e0c225fe16d5fe2 |
| SHA512 | a5634bb34349608817eb4fb2476c62284de4f5a4c3290cb8009d740adb486d02f5ca34337618f19e57af978d7604df4df8c7428727d0ae2495ca0a397226c5bf |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
| MD5 | d1162127d6f81b2ce643f52852ebe71b |
| SHA1 | 5165062ac984fcf9e12fc56ba1fd6aeb42c12c9a |
| SHA256 | 1c864c5d1d9f54d62f5a1e9e68f9caffa6d9cf16aeb96bd73722470b156590a3 |
| SHA512 | 2197237017432859c8aebfd16d9ad120233a678e6dad6217a805890fa5de8e1d121bfed340fe85d9e255a32839bb67582fff1600a5c76a2cd52938d5fe1c18a7 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
| MD5 | d1162127d6f81b2ce643f52852ebe71b |
| SHA1 | 5165062ac984fcf9e12fc56ba1fd6aeb42c12c9a |
| SHA256 | 1c864c5d1d9f54d62f5a1e9e68f9caffa6d9cf16aeb96bd73722470b156590a3 |
| SHA512 | 2197237017432859c8aebfd16d9ad120233a678e6dad6217a805890fa5de8e1d121bfed340fe85d9e255a32839bb67582fff1600a5c76a2cd52938d5fe1c18a7 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
| MD5 | d1162127d6f81b2ce643f52852ebe71b |
| SHA1 | 5165062ac984fcf9e12fc56ba1fd6aeb42c12c9a |
| SHA256 | 1c864c5d1d9f54d62f5a1e9e68f9caffa6d9cf16aeb96bd73722470b156590a3 |
| SHA512 | 2197237017432859c8aebfd16d9ad120233a678e6dad6217a805890fa5de8e1d121bfed340fe85d9e255a32839bb67582fff1600a5c76a2cd52938d5fe1c18a7 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
| MD5 | d1162127d6f81b2ce643f52852ebe71b |
| SHA1 | 5165062ac984fcf9e12fc56ba1fd6aeb42c12c9a |
| SHA256 | 1c864c5d1d9f54d62f5a1e9e68f9caffa6d9cf16aeb96bd73722470b156590a3 |
| SHA512 | 2197237017432859c8aebfd16d9ad120233a678e6dad6217a805890fa5de8e1d121bfed340fe85d9e255a32839bb67582fff1600a5c76a2cd52938d5fe1c18a7 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
| MD5 | 36d53a75a63ab2165ab48603e748712f |
| SHA1 | 863f2aa944c34868c7878c3fb64c8e5b2a3920be |
| SHA256 | bf7c9ebd253b18213d7575eaaf6cd6f820e43d72c5777b2093dea90e75c8430f |
| SHA512 | 3d4001c29c3bace475a6467149a6679767db601d78a61501eba676f502798c11edb9c8dec3ecc70cb32c435d1d256415d5ad05a495ba5081dd236fee6ae00aed |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
| MD5 | 36d53a75a63ab2165ab48603e748712f |
| SHA1 | 863f2aa944c34868c7878c3fb64c8e5b2a3920be |
| SHA256 | bf7c9ebd253b18213d7575eaaf6cd6f820e43d72c5777b2093dea90e75c8430f |
| SHA512 | 3d4001c29c3bace475a6467149a6679767db601d78a61501eba676f502798c11edb9c8dec3ecc70cb32c435d1d256415d5ad05a495ba5081dd236fee6ae00aed |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
| MD5 | 36d53a75a63ab2165ab48603e748712f |
| SHA1 | 863f2aa944c34868c7878c3fb64c8e5b2a3920be |
| SHA256 | bf7c9ebd253b18213d7575eaaf6cd6f820e43d72c5777b2093dea90e75c8430f |
| SHA512 | 3d4001c29c3bace475a6467149a6679767db601d78a61501eba676f502798c11edb9c8dec3ecc70cb32c435d1d256415d5ad05a495ba5081dd236fee6ae00aed |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
| MD5 | 36d53a75a63ab2165ab48603e748712f |
| SHA1 | 863f2aa944c34868c7878c3fb64c8e5b2a3920be |
| SHA256 | bf7c9ebd253b18213d7575eaaf6cd6f820e43d72c5777b2093dea90e75c8430f |
| SHA512 | 3d4001c29c3bace475a6467149a6679767db601d78a61501eba676f502798c11edb9c8dec3ecc70cb32c435d1d256415d5ad05a495ba5081dd236fee6ae00aed |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
| MD5 | 0d09e6e0312f6ae55ffbc9de2299375e |
| SHA1 | 5a958a8e919da901fd4b78dd07d4c3e39625067a |
| SHA256 | d6e3a65284c01e1cbaee782e7780a1c864b978ee5598bcc8c279ced1e8a78e3e |
| SHA512 | e40c65eb054f9847a0442b044a71bfec4bba04363a5662945dbbbef753b88a125dcfb32363ed733c64ce8a0b7ac486032fe6b2006531180359e9486d4d4f5c27 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
| MD5 | 0d09e6e0312f6ae55ffbc9de2299375e |
| SHA1 | 5a958a8e919da901fd4b78dd07d4c3e39625067a |
| SHA256 | d6e3a65284c01e1cbaee782e7780a1c864b978ee5598bcc8c279ced1e8a78e3e |
| SHA512 | e40c65eb054f9847a0442b044a71bfec4bba04363a5662945dbbbef753b88a125dcfb32363ed733c64ce8a0b7ac486032fe6b2006531180359e9486d4d4f5c27 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
| MD5 | 0d09e6e0312f6ae55ffbc9de2299375e |
| SHA1 | 5a958a8e919da901fd4b78dd07d4c3e39625067a |
| SHA256 | d6e3a65284c01e1cbaee782e7780a1c864b978ee5598bcc8c279ced1e8a78e3e |
| SHA512 | e40c65eb054f9847a0442b044a71bfec4bba04363a5662945dbbbef753b88a125dcfb32363ed733c64ce8a0b7ac486032fe6b2006531180359e9486d4d4f5c27 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
| MD5 | 0d09e6e0312f6ae55ffbc9de2299375e |
| SHA1 | 5a958a8e919da901fd4b78dd07d4c3e39625067a |
| SHA256 | d6e3a65284c01e1cbaee782e7780a1c864b978ee5598bcc8c279ced1e8a78e3e |
| SHA512 | e40c65eb054f9847a0442b044a71bfec4bba04363a5662945dbbbef753b88a125dcfb32363ed733c64ce8a0b7ac486032fe6b2006531180359e9486d4d4f5c27 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe
| MD5 | 04e0291e7375ab4d75e1f27ebb29c325 |
| SHA1 | d9a645fb94b5a43a835ddd88b3f741a311e383f8 |
| SHA256 | b6df3fd706c1066082087ca0c9fb699f83042b1714a31d1e4121e3768ed6d6ab |
| SHA512 | f3a3c67b529a4b1ffb7191ff6012b6b67181463a8317610f2c32fa4fd176c2d52111e04acf93986896b4ef440085385b14b023a1f442b04f16d3e3fdfc25503e |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe
| MD5 | 04e0291e7375ab4d75e1f27ebb29c325 |
| SHA1 | d9a645fb94b5a43a835ddd88b3f741a311e383f8 |
| SHA256 | b6df3fd706c1066082087ca0c9fb699f83042b1714a31d1e4121e3768ed6d6ab |
| SHA512 | f3a3c67b529a4b1ffb7191ff6012b6b67181463a8317610f2c32fa4fd176c2d52111e04acf93986896b4ef440085385b14b023a1f442b04f16d3e3fdfc25503e |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe
| MD5 | 04e0291e7375ab4d75e1f27ebb29c325 |
| SHA1 | d9a645fb94b5a43a835ddd88b3f741a311e383f8 |
| SHA256 | b6df3fd706c1066082087ca0c9fb699f83042b1714a31d1e4121e3768ed6d6ab |
| SHA512 | f3a3c67b529a4b1ffb7191ff6012b6b67181463a8317610f2c32fa4fd176c2d52111e04acf93986896b4ef440085385b14b023a1f442b04f16d3e3fdfc25503e |
memory/3008-48-0x0000000000230000-0x000000000023A000-memory.dmp
memory/3008-49-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp
memory/3008-50-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp
memory/3008-51-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
memory/2356-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2356-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2356-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2356-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2356-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2356-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2356-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2356-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2356-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2356-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:33
Reported
2023-10-10 20:49
Platform
win10v2004-20230915-en
Max time kernel
148s
Max time network
156s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5960514.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8781549.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\0d67e6d67fc220523d19114711357d5fc1fdd20ca6e27aad627c835c3b79b863.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3712 set thread context of 1008 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3724 set thread context of 2516 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0429383.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0d67e6d67fc220523d19114711357d5fc1fdd20ca6e27aad627c835c3b79b863.exe
"C:\Users\Admin\AppData\Local\Temp\0d67e6d67fc220523d19114711357d5fc1fdd20ca6e27aad627c835c3b79b863.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3712 -ip 3712
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 1008 -ip 1008
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 156
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0429383.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0429383.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3724 -ip 3724
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 580
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5960514.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5960514.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8781549.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8781549.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7759870.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7759870.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.177.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 71.121.18.2.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
| MD5 | 831a51e660311f4512d1dc14ac0a4680 |
| SHA1 | db6a9e1357932477d7f18cd0add23acaf9fb4b9b |
| SHA256 | b01f892a7ea94f3531147e09dc5de052922da85e6428d0915e0c225fe16d5fe2 |
| SHA512 | a5634bb34349608817eb4fb2476c62284de4f5a4c3290cb8009d740adb486d02f5ca34337618f19e57af978d7604df4df8c7428727d0ae2495ca0a397226c5bf |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3365153.exe
| MD5 | 831a51e660311f4512d1dc14ac0a4680 |
| SHA1 | db6a9e1357932477d7f18cd0add23acaf9fb4b9b |
| SHA256 | b01f892a7ea94f3531147e09dc5de052922da85e6428d0915e0c225fe16d5fe2 |
| SHA512 | a5634bb34349608817eb4fb2476c62284de4f5a4c3290cb8009d740adb486d02f5ca34337618f19e57af978d7604df4df8c7428727d0ae2495ca0a397226c5bf |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
| MD5 | d1162127d6f81b2ce643f52852ebe71b |
| SHA1 | 5165062ac984fcf9e12fc56ba1fd6aeb42c12c9a |
| SHA256 | 1c864c5d1d9f54d62f5a1e9e68f9caffa6d9cf16aeb96bd73722470b156590a3 |
| SHA512 | 2197237017432859c8aebfd16d9ad120233a678e6dad6217a805890fa5de8e1d121bfed340fe85d9e255a32839bb67582fff1600a5c76a2cd52938d5fe1c18a7 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0823923.exe
| MD5 | d1162127d6f81b2ce643f52852ebe71b |
| SHA1 | 5165062ac984fcf9e12fc56ba1fd6aeb42c12c9a |
| SHA256 | 1c864c5d1d9f54d62f5a1e9e68f9caffa6d9cf16aeb96bd73722470b156590a3 |
| SHA512 | 2197237017432859c8aebfd16d9ad120233a678e6dad6217a805890fa5de8e1d121bfed340fe85d9e255a32839bb67582fff1600a5c76a2cd52938d5fe1c18a7 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
| MD5 | 36d53a75a63ab2165ab48603e748712f |
| SHA1 | 863f2aa944c34868c7878c3fb64c8e5b2a3920be |
| SHA256 | bf7c9ebd253b18213d7575eaaf6cd6f820e43d72c5777b2093dea90e75c8430f |
| SHA512 | 3d4001c29c3bace475a6467149a6679767db601d78a61501eba676f502798c11edb9c8dec3ecc70cb32c435d1d256415d5ad05a495ba5081dd236fee6ae00aed |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0304237.exe
| MD5 | 36d53a75a63ab2165ab48603e748712f |
| SHA1 | 863f2aa944c34868c7878c3fb64c8e5b2a3920be |
| SHA256 | bf7c9ebd253b18213d7575eaaf6cd6f820e43d72c5777b2093dea90e75c8430f |
| SHA512 | 3d4001c29c3bace475a6467149a6679767db601d78a61501eba676f502798c11edb9c8dec3ecc70cb32c435d1d256415d5ad05a495ba5081dd236fee6ae00aed |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
| MD5 | 0d09e6e0312f6ae55ffbc9de2299375e |
| SHA1 | 5a958a8e919da901fd4b78dd07d4c3e39625067a |
| SHA256 | d6e3a65284c01e1cbaee782e7780a1c864b978ee5598bcc8c279ced1e8a78e3e |
| SHA512 | e40c65eb054f9847a0442b044a71bfec4bba04363a5662945dbbbef753b88a125dcfb32363ed733c64ce8a0b7ac486032fe6b2006531180359e9486d4d4f5c27 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8104303.exe
| MD5 | 0d09e6e0312f6ae55ffbc9de2299375e |
| SHA1 | 5a958a8e919da901fd4b78dd07d4c3e39625067a |
| SHA256 | d6e3a65284c01e1cbaee782e7780a1c864b978ee5598bcc8c279ced1e8a78e3e |
| SHA512 | e40c65eb054f9847a0442b044a71bfec4bba04363a5662945dbbbef753b88a125dcfb32363ed733c64ce8a0b7ac486032fe6b2006531180359e9486d4d4f5c27 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe
| MD5 | 04e0291e7375ab4d75e1f27ebb29c325 |
| SHA1 | d9a645fb94b5a43a835ddd88b3f741a311e383f8 |
| SHA256 | b6df3fd706c1066082087ca0c9fb699f83042b1714a31d1e4121e3768ed6d6ab |
| SHA512 | f3a3c67b529a4b1ffb7191ff6012b6b67181463a8317610f2c32fa4fd176c2d52111e04acf93986896b4ef440085385b14b023a1f442b04f16d3e3fdfc25503e |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2942807.exe
| MD5 | 04e0291e7375ab4d75e1f27ebb29c325 |
| SHA1 | d9a645fb94b5a43a835ddd88b3f741a311e383f8 |
| SHA256 | b6df3fd706c1066082087ca0c9fb699f83042b1714a31d1e4121e3768ed6d6ab |
| SHA512 | f3a3c67b529a4b1ffb7191ff6012b6b67181463a8317610f2c32fa4fd176c2d52111e04acf93986896b4ef440085385b14b023a1f442b04f16d3e3fdfc25503e |
memory/772-35-0x00000000001D0000-0x00000000001DA000-memory.dmp
memory/772-36-0x00007FFEB45D0000-0x00007FFEB5091000-memory.dmp
memory/772-38-0x00007FFEB45D0000-0x00007FFEB5091000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1117164.exe
| MD5 | 747a902aa033cb5877f9a95ce69ab80e |
| SHA1 | 3caba98cdf25b5111443d02fd48ff2b94b7b47fa |
| SHA256 | cda500e48c36a456ca63d5de08d80af0362fb41847d5d32ed7c29fe2b19402c4 |
| SHA512 | 8a3ebb73fb29692c145c09380030ef8c7727390ca936cf6afd710eccca5ed692f3adc6f3b9418e12c00accc3732aaa8996260c2b7cdb6b348b2e5a1bfb95cf28 |
memory/1008-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1008-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1008-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1008-46-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0429383.exe
| MD5 | a0c8c8492a1117080771740e95970912 |
| SHA1 | 23e12116ca1c732e0b516f6f80007be1ceb7551d |
| SHA256 | da60cdcff4d28f81e9179972cd24006521896ee32ea5907fa132b7b40bd98d6d |
| SHA512 | 1ec9f964acdcaa074502495f9e78020aa16c5338a2ee7b8491cd5a1eaa1db8c4f8c15c2341bfb7a26be853a3d690a9e17886da68fc27c5ed6b1c0a6ad4e22a79 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0429383.exe
| MD5 | a0c8c8492a1117080771740e95970912 |
| SHA1 | 23e12116ca1c732e0b516f6f80007be1ceb7551d |
| SHA256 | da60cdcff4d28f81e9179972cd24006521896ee32ea5907fa132b7b40bd98d6d |
| SHA512 | 1ec9f964acdcaa074502495f9e78020aa16c5338a2ee7b8491cd5a1eaa1db8c4f8c15c2341bfb7a26be853a3d690a9e17886da68fc27c5ed6b1c0a6ad4e22a79 |
memory/2516-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2516-51-0x0000000073C00000-0x00000000743B0000-memory.dmp
memory/2516-52-0x0000000001140000-0x0000000001146000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5960514.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5960514.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2516-58-0x00000000057B0000-0x0000000005DC8000-memory.dmp
memory/2516-59-0x00000000052A0000-0x00000000053AA000-memory.dmp
memory/2516-60-0x0000000002A80000-0x0000000002A92000-memory.dmp
memory/2516-62-0x0000000001130000-0x0000000001140000-memory.dmp
memory/2516-66-0x0000000002B00000-0x0000000002B3C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2516-70-0x0000000005190000-0x00000000051DC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8781549.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8781549.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7759870.exe
| MD5 | 2c740c5cccf9338780e1b8e1f55b22a3 |
| SHA1 | c81394cbd173dfe98490d1fa5d8b1065ef0c7bbb |
| SHA256 | 2461044121f040f81346580310467e3a8e2f8c57ecdc2a867df5b1aa3d0a7544 |
| SHA512 | e5c81f7e70bb69b6e13438d31d73a12fad8b3aa3a7ba18777f74684ec4040b8681c3188e752afaa4a68180605fdb861458a50c46af5f727a060c0d4b2dbe84b1 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7759870.exe
| MD5 | 2c740c5cccf9338780e1b8e1f55b22a3 |
| SHA1 | c81394cbd173dfe98490d1fa5d8b1065ef0c7bbb |
| SHA256 | 2461044121f040f81346580310467e3a8e2f8c57ecdc2a867df5b1aa3d0a7544 |
| SHA512 | e5c81f7e70bb69b6e13438d31d73a12fad8b3aa3a7ba18777f74684ec4040b8681c3188e752afaa4a68180605fdb861458a50c46af5f727a060c0d4b2dbe84b1 |
memory/2516-86-0x0000000073C00000-0x00000000743B0000-memory.dmp
memory/2516-87-0x0000000001130000-0x0000000001140000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |