Analysis Overview
SHA256
b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831
Threat Level: Known bad
The file b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831 was found to be: Known bad.
Malicious Activity Summary
RedLine
Healer
Detect Mystic stealer payload
Detects Healer an antivirus disabler dropper
Amadey
Mystic
Modifies Windows Defender Real-time Protection settings
Windows security modification
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
Program crash
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:37
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:37
Reported
2023-10-10 20:57
Platform
win7-20230831-en
Max time kernel
121s
Max time network
127s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1588 set thread context of 2652 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe
"C:\Users\Admin\AppData\Local\Temp\b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 36
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 268
Network
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
| MD5 | b44e8e8a22a36bece095d63f685ed522 |
| SHA1 | eec7093252685e67bad5a89320b6b38256f43983 |
| SHA256 | 8a63a4c2ba77d53a91df48802ebfc149635a04bb947620e4bbaf8f11f5aad81f |
| SHA512 | 3823a292b5e5337b76e64fcee4c01fed4c3d1d9d939f775a529a1f2e0dcd0b98fd5a6192bf17ac06a477092b2c30c0aee3188fa046475f7dfd55d68d184068eb |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
| MD5 | b44e8e8a22a36bece095d63f685ed522 |
| SHA1 | eec7093252685e67bad5a89320b6b38256f43983 |
| SHA256 | 8a63a4c2ba77d53a91df48802ebfc149635a04bb947620e4bbaf8f11f5aad81f |
| SHA512 | 3823a292b5e5337b76e64fcee4c01fed4c3d1d9d939f775a529a1f2e0dcd0b98fd5a6192bf17ac06a477092b2c30c0aee3188fa046475f7dfd55d68d184068eb |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
| MD5 | b44e8e8a22a36bece095d63f685ed522 |
| SHA1 | eec7093252685e67bad5a89320b6b38256f43983 |
| SHA256 | 8a63a4c2ba77d53a91df48802ebfc149635a04bb947620e4bbaf8f11f5aad81f |
| SHA512 | 3823a292b5e5337b76e64fcee4c01fed4c3d1d9d939f775a529a1f2e0dcd0b98fd5a6192bf17ac06a477092b2c30c0aee3188fa046475f7dfd55d68d184068eb |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
| MD5 | b44e8e8a22a36bece095d63f685ed522 |
| SHA1 | eec7093252685e67bad5a89320b6b38256f43983 |
| SHA256 | 8a63a4c2ba77d53a91df48802ebfc149635a04bb947620e4bbaf8f11f5aad81f |
| SHA512 | 3823a292b5e5337b76e64fcee4c01fed4c3d1d9d939f775a529a1f2e0dcd0b98fd5a6192bf17ac06a477092b2c30c0aee3188fa046475f7dfd55d68d184068eb |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
| MD5 | 671806588977b4c45f3a1b7b8ae4c1cb |
| SHA1 | 9bfb48bdfec31407c44da1cb89697189dff3b133 |
| SHA256 | adb6d9eb413c899de055717195c860e59a67d43b41c988db20c09d4cfac85ae2 |
| SHA512 | 1786b655ec4c0e5ea1bc612a0f2fb8dbb4fc0cfbc94a52ab2e016dbd94cfd1bb917313c7abd4d8e4de2369d991232d596dc1dd15d53b06155e96c404087c6574 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
| MD5 | 671806588977b4c45f3a1b7b8ae4c1cb |
| SHA1 | 9bfb48bdfec31407c44da1cb89697189dff3b133 |
| SHA256 | adb6d9eb413c899de055717195c860e59a67d43b41c988db20c09d4cfac85ae2 |
| SHA512 | 1786b655ec4c0e5ea1bc612a0f2fb8dbb4fc0cfbc94a52ab2e016dbd94cfd1bb917313c7abd4d8e4de2369d991232d596dc1dd15d53b06155e96c404087c6574 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
| MD5 | 671806588977b4c45f3a1b7b8ae4c1cb |
| SHA1 | 9bfb48bdfec31407c44da1cb89697189dff3b133 |
| SHA256 | adb6d9eb413c899de055717195c860e59a67d43b41c988db20c09d4cfac85ae2 |
| SHA512 | 1786b655ec4c0e5ea1bc612a0f2fb8dbb4fc0cfbc94a52ab2e016dbd94cfd1bb917313c7abd4d8e4de2369d991232d596dc1dd15d53b06155e96c404087c6574 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
| MD5 | 671806588977b4c45f3a1b7b8ae4c1cb |
| SHA1 | 9bfb48bdfec31407c44da1cb89697189dff3b133 |
| SHA256 | adb6d9eb413c899de055717195c860e59a67d43b41c988db20c09d4cfac85ae2 |
| SHA512 | 1786b655ec4c0e5ea1bc612a0f2fb8dbb4fc0cfbc94a52ab2e016dbd94cfd1bb917313c7abd4d8e4de2369d991232d596dc1dd15d53b06155e96c404087c6574 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
| MD5 | 5095330c04096b405292495d89fc4fdc |
| SHA1 | 76b8eb409a28047e28b873f03d02c4faf745372f |
| SHA256 | d1158363d8da489ac85aa0d563278782f0abe8d3c739d95b7bfe76919b5f0d58 |
| SHA512 | ec1087231304d0726903746a9e769061298b18b62486118a597c414b7c3e25b4251d739f387459d78b437809b66d85588d5b686add8c97d18787eb67ff3b367f |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
| MD5 | 5095330c04096b405292495d89fc4fdc |
| SHA1 | 76b8eb409a28047e28b873f03d02c4faf745372f |
| SHA256 | d1158363d8da489ac85aa0d563278782f0abe8d3c739d95b7bfe76919b5f0d58 |
| SHA512 | ec1087231304d0726903746a9e769061298b18b62486118a597c414b7c3e25b4251d739f387459d78b437809b66d85588d5b686add8c97d18787eb67ff3b367f |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
| MD5 | 5095330c04096b405292495d89fc4fdc |
| SHA1 | 76b8eb409a28047e28b873f03d02c4faf745372f |
| SHA256 | d1158363d8da489ac85aa0d563278782f0abe8d3c739d95b7bfe76919b5f0d58 |
| SHA512 | ec1087231304d0726903746a9e769061298b18b62486118a597c414b7c3e25b4251d739f387459d78b437809b66d85588d5b686add8c97d18787eb67ff3b367f |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
| MD5 | 5095330c04096b405292495d89fc4fdc |
| SHA1 | 76b8eb409a28047e28b873f03d02c4faf745372f |
| SHA256 | d1158363d8da489ac85aa0d563278782f0abe8d3c739d95b7bfe76919b5f0d58 |
| SHA512 | ec1087231304d0726903746a9e769061298b18b62486118a597c414b7c3e25b4251d739f387459d78b437809b66d85588d5b686add8c97d18787eb67ff3b367f |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
| MD5 | b7002ea224a5aac024e460c3a531b955 |
| SHA1 | 93776672d236e94886781f0d1e065dfa0b52f18e |
| SHA256 | 478d44fd0682024c2837af8d270b2a8da39debb12acf582b8ead5f55e9c44cb4 |
| SHA512 | 545eff0346c65c47d2d08858bb3172007e7dff6204bb414cf976cdbcc010356ae9c59774cd34dffa12a49026a3647c6b870547e0ba6b745daa10598300f307e1 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
| MD5 | b7002ea224a5aac024e460c3a531b955 |
| SHA1 | 93776672d236e94886781f0d1e065dfa0b52f18e |
| SHA256 | 478d44fd0682024c2837af8d270b2a8da39debb12acf582b8ead5f55e9c44cb4 |
| SHA512 | 545eff0346c65c47d2d08858bb3172007e7dff6204bb414cf976cdbcc010356ae9c59774cd34dffa12a49026a3647c6b870547e0ba6b745daa10598300f307e1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
| MD5 | ef6b98c54fa02e1487259cac061bd3d3 |
| SHA1 | a713b069ea66666daa4ee9bbff397b0c5ff85abf |
| SHA256 | d7156b868dedefbdb54325f2684c49caad031838b4af01f544712bbd77d21b80 |
| SHA512 | 544600a0f639e4ed0c3d31c1365ffa55efe51a3a909472c463b4cd145ba9379da5871c87470f6a3987f2bf732245a423736f9512dd5f7ff7357132fe077ffe9b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
| MD5 | ef6b98c54fa02e1487259cac061bd3d3 |
| SHA1 | a713b069ea66666daa4ee9bbff397b0c5ff85abf |
| SHA256 | d7156b868dedefbdb54325f2684c49caad031838b4af01f544712bbd77d21b80 |
| SHA512 | 544600a0f639e4ed0c3d31c1365ffa55efe51a3a909472c463b4cd145ba9379da5871c87470f6a3987f2bf732245a423736f9512dd5f7ff7357132fe077ffe9b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
| MD5 | ef6b98c54fa02e1487259cac061bd3d3 |
| SHA1 | a713b069ea66666daa4ee9bbff397b0c5ff85abf |
| SHA256 | d7156b868dedefbdb54325f2684c49caad031838b4af01f544712bbd77d21b80 |
| SHA512 | 544600a0f639e4ed0c3d31c1365ffa55efe51a3a909472c463b4cd145ba9379da5871c87470f6a3987f2bf732245a423736f9512dd5f7ff7357132fe077ffe9b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
| MD5 | b7002ea224a5aac024e460c3a531b955 |
| SHA1 | 93776672d236e94886781f0d1e065dfa0b52f18e |
| SHA256 | 478d44fd0682024c2837af8d270b2a8da39debb12acf582b8ead5f55e9c44cb4 |
| SHA512 | 545eff0346c65c47d2d08858bb3172007e7dff6204bb414cf976cdbcc010356ae9c59774cd34dffa12a49026a3647c6b870547e0ba6b745daa10598300f307e1 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
| MD5 | b7002ea224a5aac024e460c3a531b955 |
| SHA1 | 93776672d236e94886781f0d1e065dfa0b52f18e |
| SHA256 | 478d44fd0682024c2837af8d270b2a8da39debb12acf582b8ead5f55e9c44cb4 |
| SHA512 | 545eff0346c65c47d2d08858bb3172007e7dff6204bb414cf976cdbcc010356ae9c59774cd34dffa12a49026a3647c6b870547e0ba6b745daa10598300f307e1 |
memory/2600-48-0x0000000001080000-0x000000000108A000-memory.dmp
memory/2600-49-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
memory/2600-59-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
memory/2652-60-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2652-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2652-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2652-71-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2652-69-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2652-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2652-66-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
memory/2652-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2652-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2652-62-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:37
Reported
2023-10-10 20:57
Platform
win10v2004-20230915-en
Max time kernel
165s
Max time network
191s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7049655.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5910025.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3900 set thread context of 1168 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4692 set thread context of 2636 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7231625.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe
"C:\Users\Admin\AppData\Local\Temp\b1aa717b718fc1fcabc5283bb1f42c24a65dad34d241cbc63769d4a278a4d831.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1168 -ip 1168
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3900 -ip 3900
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 152
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7231625.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7231625.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4692 -ip 4692
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7049655.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7049655.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5910025.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5910025.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5050465.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5050465.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.211.247.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 240.81.21.72.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 89.65.42.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
| MD5 | b44e8e8a22a36bece095d63f685ed522 |
| SHA1 | eec7093252685e67bad5a89320b6b38256f43983 |
| SHA256 | 8a63a4c2ba77d53a91df48802ebfc149635a04bb947620e4bbaf8f11f5aad81f |
| SHA512 | 3823a292b5e5337b76e64fcee4c01fed4c3d1d9d939f775a529a1f2e0dcd0b98fd5a6192bf17ac06a477092b2c30c0aee3188fa046475f7dfd55d68d184068eb |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9463321.exe
| MD5 | b44e8e8a22a36bece095d63f685ed522 |
| SHA1 | eec7093252685e67bad5a89320b6b38256f43983 |
| SHA256 | 8a63a4c2ba77d53a91df48802ebfc149635a04bb947620e4bbaf8f11f5aad81f |
| SHA512 | 3823a292b5e5337b76e64fcee4c01fed4c3d1d9d939f775a529a1f2e0dcd0b98fd5a6192bf17ac06a477092b2c30c0aee3188fa046475f7dfd55d68d184068eb |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
| MD5 | 671806588977b4c45f3a1b7b8ae4c1cb |
| SHA1 | 9bfb48bdfec31407c44da1cb89697189dff3b133 |
| SHA256 | adb6d9eb413c899de055717195c860e59a67d43b41c988db20c09d4cfac85ae2 |
| SHA512 | 1786b655ec4c0e5ea1bc612a0f2fb8dbb4fc0cfbc94a52ab2e016dbd94cfd1bb917313c7abd4d8e4de2369d991232d596dc1dd15d53b06155e96c404087c6574 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3438468.exe
| MD5 | 671806588977b4c45f3a1b7b8ae4c1cb |
| SHA1 | 9bfb48bdfec31407c44da1cb89697189dff3b133 |
| SHA256 | adb6d9eb413c899de055717195c860e59a67d43b41c988db20c09d4cfac85ae2 |
| SHA512 | 1786b655ec4c0e5ea1bc612a0f2fb8dbb4fc0cfbc94a52ab2e016dbd94cfd1bb917313c7abd4d8e4de2369d991232d596dc1dd15d53b06155e96c404087c6574 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
| MD5 | 5095330c04096b405292495d89fc4fdc |
| SHA1 | 76b8eb409a28047e28b873f03d02c4faf745372f |
| SHA256 | d1158363d8da489ac85aa0d563278782f0abe8d3c739d95b7bfe76919b5f0d58 |
| SHA512 | ec1087231304d0726903746a9e769061298b18b62486118a597c414b7c3e25b4251d739f387459d78b437809b66d85588d5b686add8c97d18787eb67ff3b367f |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6922972.exe
| MD5 | 5095330c04096b405292495d89fc4fdc |
| SHA1 | 76b8eb409a28047e28b873f03d02c4faf745372f |
| SHA256 | d1158363d8da489ac85aa0d563278782f0abe8d3c739d95b7bfe76919b5f0d58 |
| SHA512 | ec1087231304d0726903746a9e769061298b18b62486118a597c414b7c3e25b4251d739f387459d78b437809b66d85588d5b686add8c97d18787eb67ff3b367f |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
| MD5 | b7002ea224a5aac024e460c3a531b955 |
| SHA1 | 93776672d236e94886781f0d1e065dfa0b52f18e |
| SHA256 | 478d44fd0682024c2837af8d270b2a8da39debb12acf582b8ead5f55e9c44cb4 |
| SHA512 | 545eff0346c65c47d2d08858bb3172007e7dff6204bb414cf976cdbcc010356ae9c59774cd34dffa12a49026a3647c6b870547e0ba6b745daa10598300f307e1 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2271893.exe
| MD5 | b7002ea224a5aac024e460c3a531b955 |
| SHA1 | 93776672d236e94886781f0d1e065dfa0b52f18e |
| SHA256 | 478d44fd0682024c2837af8d270b2a8da39debb12acf582b8ead5f55e9c44cb4 |
| SHA512 | 545eff0346c65c47d2d08858bb3172007e7dff6204bb414cf976cdbcc010356ae9c59774cd34dffa12a49026a3647c6b870547e0ba6b745daa10598300f307e1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
| MD5 | ef6b98c54fa02e1487259cac061bd3d3 |
| SHA1 | a713b069ea66666daa4ee9bbff397b0c5ff85abf |
| SHA256 | d7156b868dedefbdb54325f2684c49caad031838b4af01f544712bbd77d21b80 |
| SHA512 | 544600a0f639e4ed0c3d31c1365ffa55efe51a3a909472c463b4cd145ba9379da5871c87470f6a3987f2bf732245a423736f9512dd5f7ff7357132fe077ffe9b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9392501.exe
| MD5 | ef6b98c54fa02e1487259cac061bd3d3 |
| SHA1 | a713b069ea66666daa4ee9bbff397b0c5ff85abf |
| SHA256 | d7156b868dedefbdb54325f2684c49caad031838b4af01f544712bbd77d21b80 |
| SHA512 | 544600a0f639e4ed0c3d31c1365ffa55efe51a3a909472c463b4cd145ba9379da5871c87470f6a3987f2bf732245a423736f9512dd5f7ff7357132fe077ffe9b |
memory/1856-35-0x0000000000670000-0x000000000067A000-memory.dmp
memory/1856-36-0x00007FFF54F50000-0x00007FFF55A11000-memory.dmp
memory/1856-37-0x00007FFF54F50000-0x00007FFF55A11000-memory.dmp
memory/1856-39-0x00007FFF54F50000-0x00007FFF55A11000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4967468.exe
| MD5 | af57904eb712edc1c6f07c637e57d21c |
| SHA1 | 42fc08f3eb438355f635b2f68d3d073e8d57aabc |
| SHA256 | 191100707408b649c9040fae4b52e838393eaa4937a3317eee3a7faa70e19194 |
| SHA512 | 4adaef1b5e35637ce58ce06eff8669df028fe057b036c89dfb5b3bc59f71c2b8483b31242856ca1c3ec7ae867d458243df16b99a595e4513ad30da41f45c1c9f |
memory/1168-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1168-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1168-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1168-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7231625.exe
| MD5 | e5f756b4463e686e516745938cee5471 |
| SHA1 | e4260f9cdbf022f06f72f3f6622fee1bb4f27ac9 |
| SHA256 | 940047db4b8f2378cece8705ce91670e7874471d00e955f8b32c1bc906140f95 |
| SHA512 | 0dfcde7f202ffec664b96c2c34b3edc6246e8177de503a59ec277a6f58ad6c4df0a628bce33024c548b0f364c67035021e801f56f01835e37f8cd3e668e7f7fd |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7231625.exe
| MD5 | e5f756b4463e686e516745938cee5471 |
| SHA1 | e4260f9cdbf022f06f72f3f6622fee1bb4f27ac9 |
| SHA256 | 940047db4b8f2378cece8705ce91670e7874471d00e955f8b32c1bc906140f95 |
| SHA512 | 0dfcde7f202ffec664b96c2c34b3edc6246e8177de503a59ec277a6f58ad6c4df0a628bce33024c548b0f364c67035021e801f56f01835e37f8cd3e668e7f7fd |
memory/2636-51-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2636-52-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/2636-53-0x0000000002ED0000-0x0000000002ED6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7049655.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7049655.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2636-66-0x0000000005B40000-0x0000000006158000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2636-67-0x0000000005670000-0x000000000577A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5910025.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2636-71-0x00000000055A0000-0x00000000055B2000-memory.dmp
memory/2636-74-0x0000000005510000-0x0000000005520000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5910025.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5050465.exe
| MD5 | 08c02d42f68faacaafb8db74320b0d6e |
| SHA1 | 00a66c18bf971538ae169123a8c1ec44d1ac4b0b |
| SHA256 | e03fef8223938892069970b94586e1fb3240538ee688f9c28aaae2e10f9ffe2a |
| SHA512 | b73f73f1bd672b9b9cdd39a04b6b12662086de84d22e3b347c48974a334bf36cd8d746929ac7a9f050297068829202e1c1e8582e702c5e23b61492baaa3684d8 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5050465.exe
| MD5 | 08c02d42f68faacaafb8db74320b0d6e |
| SHA1 | 00a66c18bf971538ae169123a8c1ec44d1ac4b0b |
| SHA256 | e03fef8223938892069970b94586e1fb3240538ee688f9c28aaae2e10f9ffe2a |
| SHA512 | b73f73f1bd672b9b9cdd39a04b6b12662086de84d22e3b347c48974a334bf36cd8d746929ac7a9f050297068829202e1c1e8582e702c5e23b61492baaa3684d8 |
memory/2636-85-0x0000000005600000-0x000000000563C000-memory.dmp
memory/2636-86-0x0000000005780000-0x00000000057CC000-memory.dmp
memory/2636-87-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/2636-88-0x0000000005510000-0x0000000005520000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |