amadey | b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831

Analysis

max time kernel
165s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe
Size

993KB
MD5

8a5cb01b9610e67b874ee53be01ab60a
SHA1

0085416876c77248ba682404496fc35a5a03812c
SHA256

b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831
SHA512

826b1447acbd16df76ee955f8bcf7acaa2e9cf926d811dc0992d6adc80acb15f9a6585d48aa1bfaf7b7222cbeea28b8f7606feda02933199349eccd6d4244184
SSDEEP

12288:qMr6y903yytSlHnt2KRr9TnhwufmnIGnxTV+k1HvclSe8joy1CXpXpGieJVd7Xfl:kySx6phhlmnfxT11HkMe8jovpc75Lz

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/1168-43-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1168-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1168-45-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1168-47-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231e7-33.dat	healer
behavioral2/files/0x00070000000231e7-34.dat	healer
behavioral2/memory/1856-35-0x0000000000670000-0x000000000067A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q9392501.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q9392501.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q9392501.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q9392501.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q9392501.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q9392501.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	t7049655.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	u5910025.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 14 IoCs

pid	Process
1224	z9463321.exe
964	z3438468.exe
4124	z6922972.exe
1584	z2271893.exe
1856	q9392501.exe
3900	r4967468.exe
4692	s7231625.exe
3596	t7049655.exe
4568	explothe.exe
3392	u5910025.exe
3020	legota.exe
1112	w5050465.exe
2568	explothe.exe
4536	legota.exe

Loads dropped DLL 2 IoCs

pid	Process
3608	rundll32.exe
1020	rundll32.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q9392501.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z3438468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6922972.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z2271893.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z9463321.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3900 set thread context of 1168	3900	r4967468.exe	97
PID 4692 set thread context of 2636	4692	s7231625.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4620	3900	WerFault.exe	95
2504	1168	WerFault.exe	97
1132	4692	WerFault.exe	104

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3236	schtasks.exe
4948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1856	q9392501.exe
1856	q9392501.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	q9392501.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1224	3404	b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe	88
PID 3404 wrote to memory of 1224	3404	b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe	88
PID 3404 wrote to memory of 1224	3404	b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe	88
PID 1224 wrote to memory of 964	1224	z9463321.exe	89
PID 1224 wrote to memory of 964	1224	z9463321.exe	89
PID 1224 wrote to memory of 964	1224	z9463321.exe	89
PID 964 wrote to memory of 4124	964	z3438468.exe	90
PID 964 wrote to memory of 4124	964	z3438468.exe	90
PID 964 wrote to memory of 4124	964	z3438468.exe	90
PID 4124 wrote to memory of 1584	4124	z6922972.exe	91
PID 4124 wrote to memory of 1584	4124	z6922972.exe	91
PID 4124 wrote to memory of 1584	4124	z6922972.exe	91
PID 1584 wrote to memory of 1856	1584	z2271893.exe	92
PID 1584 wrote to memory of 1856	1584	z2271893.exe	92
PID 1584 wrote to memory of 3900	1584	z2271893.exe	95
PID 1584 wrote to memory of 3900	1584	z2271893.exe	95
PID 1584 wrote to memory of 3900	1584	z2271893.exe	95
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 3900 wrote to memory of 1168	3900	r4967468.exe	97
PID 4124 wrote to memory of 4692	4124	z6922972.exe	104
PID 4124 wrote to memory of 4692	4124	z6922972.exe	104
PID 4124 wrote to memory of 4692	4124	z6922972.exe	104
PID 4692 wrote to memory of 2636	4692	s7231625.exe	106
PID 4692 wrote to memory of 2636	4692	s7231625.exe	106
PID 4692 wrote to memory of 2636	4692	s7231625.exe	106
PID 4692 wrote to memory of 2636	4692	s7231625.exe	106
PID 4692 wrote to memory of 2636	4692	s7231625.exe	106
PID 4692 wrote to memory of 2636	4692	s7231625.exe	106
PID 4692 wrote to memory of 2636	4692	s7231625.exe	106
PID 4692 wrote to memory of 2636	4692	s7231625.exe	106
PID 964 wrote to memory of 3596	964	z3438468.exe	109
PID 964 wrote to memory of 3596	964	z3438468.exe	109
PID 964 wrote to memory of 3596	964	z3438468.exe	109
PID 3596 wrote to memory of 4568	3596	t7049655.exe	110
PID 3596 wrote to memory of 4568	3596	t7049655.exe	110
PID 3596 wrote to memory of 4568	3596	t7049655.exe	110
PID 1224 wrote to memory of 3392	1224	z9463321.exe	111
PID 1224 wrote to memory of 3392	1224	z9463321.exe	111
PID 1224 wrote to memory of 3392	1224	z9463321.exe	111
PID 3392 wrote to memory of 3020	3392	u5910025.exe	113
PID 3392 wrote to memory of 3020	3392	u5910025.exe	113
PID 3392 wrote to memory of 3020	3392	u5910025.exe	113
PID 3404 wrote to memory of 1112	3404	b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe	114
PID 3404 wrote to memory of 1112	3404	b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe	114
PID 3404 wrote to memory of 1112	3404	b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe	114
PID 3020 wrote to memory of 4948	3020	legota.exe	116
PID 3020 wrote to memory of 4948	3020	legota.exe	116
PID 3020 wrote to memory of 4948	3020	legota.exe	116
PID 4568 wrote to memory of 3236	4568	explothe.exe	112
PID 4568 wrote to memory of 3236	4568	explothe.exe	112
PID 4568 wrote to memory of 3236	4568	explothe.exe	112
PID 3020 wrote to memory of 4020	3020	legota.exe	119
PID 3020 wrote to memory of 4020	3020	legota.exe	119
PID 3020 wrote to memory of 4020	3020	legota.exe	119
PID 4568 wrote to memory of 380	4568	explothe.exe	120
PID 4568 wrote to memory of 380	4568	explothe.exe	120

C:\Users\Admin\AppData\Local\Temp\b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe
"C:\Users\Admin\AppData\Local\Temp\b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 540
        8⤵
        Program crash
        
        PID:2504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 152
        7⤵
        Program crash
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7231625.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7231625.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4692
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 152
        6⤵
        Program crash
        
        PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7049655.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7049655.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3236
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        7⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        7⤵
        
        PID:384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:2640
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:3608
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5910025.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5910025.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4948
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:4020
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3976
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:3736
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:2860
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:2648
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3928
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:5012
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:1020
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5050465.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5050465.exe
  2⤵
  - Executes dropped EXE
  PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1168 -ip 1168
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3900 -ip 3900
1⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4692 -ip 4692
1⤵
PID:836

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5050465.exe

Filesize
23KB

MD5
08c02d42f68faacaafb8db74320b0d6e

SHA1
00a66c18bf971538ae169123a8c1ec44d1ac4b0b

SHA256
e03fef8223938892069970b94586e1fb3240538ee688f9c28aaae2e10f9ffe2a

SHA512
b73f73f1bd672b9b9cdd39a04b6b12662086de84d22e3b347c48974a334bf36cd8d746929ac7a9f050297068829202e1c1e8582e702c5e23b61492baaa3684d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5050465.exe

Filesize
23KB

MD5
08c02d42f68faacaafb8db74320b0d6e

SHA1
00a66c18bf971538ae169123a8c1ec44d1ac4b0b

SHA256
e03fef8223938892069970b94586e1fb3240538ee688f9c28aaae2e10f9ffe2a

SHA512
b73f73f1bd672b9b9cdd39a04b6b12662086de84d22e3b347c48974a334bf36cd8d746929ac7a9f050297068829202e1c1e8582e702c5e23b61492baaa3684d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe

Filesize
892KB

MD5
b44e8e8a22a36bece095d63f685ed522

SHA1
eec7093252685e67bad5a89320b6b38256f43983

SHA256
8a63a4c2ba77d53a91df48802ebfc149635a04bb947620e4bbaf8f11f5aad81f

SHA512
3823a292b5e5337b76e64fcee4c01fed4c3d1d9d939f775a529a1f2e0dcd0b98fd5a6192bf17ac06a477092b2c30c0aee3188fa046475f7dfd55d68d184068eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe

Filesize
892KB

MD5
b44e8e8a22a36bece095d63f685ed522

SHA1
eec7093252685e67bad5a89320b6b38256f43983

SHA256
8a63a4c2ba77d53a91df48802ebfc149635a04bb947620e4bbaf8f11f5aad81f

SHA512
3823a292b5e5337b76e64fcee4c01fed4c3d1d9d939f775a529a1f2e0dcd0b98fd5a6192bf17ac06a477092b2c30c0aee3188fa046475f7dfd55d68d184068eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5910025.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5910025.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe

Filesize
709KB

MD5
671806588977b4c45f3a1b7b8ae4c1cb

SHA1
9bfb48bdfec31407c44da1cb89697189dff3b133

SHA256
adb6d9eb413c899de055717195c860e59a67d43b41c988db20c09d4cfac85ae2

SHA512
1786b655ec4c0e5ea1bc612a0f2fb8dbb4fc0cfbc94a52ab2e016dbd94cfd1bb917313c7abd4d8e4de2369d991232d596dc1dd15d53b06155e96c404087c6574

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe

Filesize
709KB

MD5
671806588977b4c45f3a1b7b8ae4c1cb

SHA1
9bfb48bdfec31407c44da1cb89697189dff3b133

SHA256
adb6d9eb413c899de055717195c860e59a67d43b41c988db20c09d4cfac85ae2

SHA512
1786b655ec4c0e5ea1bc612a0f2fb8dbb4fc0cfbc94a52ab2e016dbd94cfd1bb917313c7abd4d8e4de2369d991232d596dc1dd15d53b06155e96c404087c6574

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7049655.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7049655.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe

Filesize
526KB

MD5
5095330c04096b405292495d89fc4fdc

SHA1
76b8eb409a28047e28b873f03d02c4faf745372f

SHA256
d1158363d8da489ac85aa0d563278782f0abe8d3c739d95b7bfe76919b5f0d58

SHA512
ec1087231304d0726903746a9e769061298b18b62486118a597c414b7c3e25b4251d739f387459d78b437809b66d85588d5b686add8c97d18787eb67ff3b367f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe

Filesize
526KB

MD5
5095330c04096b405292495d89fc4fdc

SHA1
76b8eb409a28047e28b873f03d02c4faf745372f

SHA256
d1158363d8da489ac85aa0d563278782f0abe8d3c739d95b7bfe76919b5f0d58

SHA512
ec1087231304d0726903746a9e769061298b18b62486118a597c414b7c3e25b4251d739f387459d78b437809b66d85588d5b686add8c97d18787eb67ff3b367f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7231625.exe

Filesize
310KB

MD5
e5f756b4463e686e516745938cee5471

SHA1
e4260f9cdbf022f06f72f3f6622fee1bb4f27ac9

SHA256
940047db4b8f2378cece8705ce91670e7874471d00e955f8b32c1bc906140f95

SHA512
0dfcde7f202ffec664b96c2c34b3edc6246e8177de503a59ec277a6f58ad6c4df0a628bce33024c548b0f364c67035021e801f56f01835e37f8cd3e668e7f7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7231625.exe

Filesize
310KB

MD5
e5f756b4463e686e516745938cee5471

SHA1
e4260f9cdbf022f06f72f3f6622fee1bb4f27ac9

SHA256
940047db4b8f2378cece8705ce91670e7874471d00e955f8b32c1bc906140f95

SHA512
0dfcde7f202ffec664b96c2c34b3edc6246e8177de503a59ec277a6f58ad6c4df0a628bce33024c548b0f364c67035021e801f56f01835e37f8cd3e668e7f7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe

Filesize
295KB

MD5
b7002ea224a5aac024e460c3a531b955

SHA1
93776672d236e94886781f0d1e065dfa0b52f18e

SHA256
478d44fd0682024c2837af8d270b2a8da39debb12acf582b8ead5f55e9c44cb4

SHA512
545eff0346c65c47d2d08858bb3172007e7dff6204bb414cf976cdbcc010356ae9c59774cd34dffa12a49026a3647c6b870547e0ba6b745daa10598300f307e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe

Filesize
295KB

MD5
b7002ea224a5aac024e460c3a531b955

SHA1
93776672d236e94886781f0d1e065dfa0b52f18e

SHA256
478d44fd0682024c2837af8d270b2a8da39debb12acf582b8ead5f55e9c44cb4

SHA512
545eff0346c65c47d2d08858bb3172007e7dff6204bb414cf976cdbcc010356ae9c59774cd34dffa12a49026a3647c6b870547e0ba6b745daa10598300f307e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe

Filesize
11KB

MD5
ef6b98c54fa02e1487259cac061bd3d3

SHA1
a713b069ea66666daa4ee9bbff397b0c5ff85abf

SHA256
d7156b868dedefbdb54325f2684c49caad031838b4af01f544712bbd77d21b80

SHA512
544600a0f639e4ed0c3d31c1365ffa55efe51a3a909472c463b4cd145ba9379da5871c87470f6a3987f2bf732245a423736f9512dd5f7ff7357132fe077ffe9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe

Filesize
11KB

MD5
ef6b98c54fa02e1487259cac061bd3d3

SHA1
a713b069ea66666daa4ee9bbff397b0c5ff85abf

SHA256
d7156b868dedefbdb54325f2684c49caad031838b4af01f544712bbd77d21b80

SHA512
544600a0f639e4ed0c3d31c1365ffa55efe51a3a909472c463b4cd145ba9379da5871c87470f6a3987f2bf732245a423736f9512dd5f7ff7357132fe077ffe9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe

Filesize
276KB

MD5
af57904eb712edc1c6f07c637e57d21c

SHA1
42fc08f3eb438355f635b2f68d3d073e8d57aabc

SHA256
191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194

SHA512
4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe

Filesize
276KB

MD5
af57904eb712edc1c6f07c637e57d21c

SHA1
42fc08f3eb438355f635b2f68d3d073e8d57aabc

SHA256
191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194

SHA512
4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
a5b509a3fb95cc3c8d89cd39fc2a30fb

SHA1
5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c

SHA256
5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529

SHA512
3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/1168-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1168-47-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1168-45-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1168-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1856-37-0x00007FFF54F50000-0x00007FFF55A11000-memory.dmp

Filesize
10.8MB

Download
memory/1856-36-0x00007FFF54F50000-0x00007FFF55A11000-memory.dmp

Filesize
10.8MB

Download
memory/1856-39-0x00007FFF54F50000-0x00007FFF55A11000-memory.dmp

Filesize
10.8MB

Download
memory/1856-35-0x0000000000670000-0x000000000067A000-memory.dmp

Filesize
40KB

Download
memory/2636-74-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/2636-88-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/2636-87-0x00000000734A0000-0x0000000073C50000-memory.dmp

Filesize
7.7MB

Download
memory/2636-86-0x0000000005780000-0x00000000057CC000-memory.dmp

Filesize
304KB

Download
memory/2636-85-0x0000000005600000-0x000000000563C000-memory.dmp

Filesize
240KB

Download
memory/2636-71-0x00000000055A0000-0x00000000055B2000-memory.dmp

Filesize
72KB

Download
memory/2636-67-0x0000000005670000-0x000000000577A000-memory.dmp

Filesize
1.0MB

Download
memory/2636-66-0x0000000005B40000-0x0000000006158000-memory.dmp

Filesize
6.1MB

Download
memory/2636-53-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

Filesize
24KB

Download
memory/2636-52-0x00000000734A0000-0x0000000073C50000-memory.dmp

Filesize
7.7MB

Download
memory/2636-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download