Analysis Overview
SHA256
b7880b2102a4d508865de72713df901dd4fc4863407ffdc65105ee180551de6c
Threat Level: Known bad
The file b7880b2102a4d508865de72713df901dd4fc4863407ffdc65105ee180551de6c was found to be: Known bad.
Malicious Activity Summary
Amadey
Healer
RedLine
Detects Healer an antivirus disabler dropper
Mystic
Detect Mystic stealer payload
Modifies Windows Defender Real-time Protection settings
Windows security modification
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Launches sc.exe
Program crash
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:37
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:37
Reported
2023-10-10 20:57
Platform
win7-20230831-en
Max time kernel
120s
Max time network
124s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\b7880b2102a4d508865de72713df901dd4fc4863407ffdc65105ee180551de6c.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2748 set thread context of 2640 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b7880b2102a4d508865de72713df901dd4fc4863407ffdc65105ee180551de6c.exe
"C:\Users\Admin\AppData\Local\Temp\b7880b2102a4d508865de72713df901dd4fc4863407ffdc65105ee180551de6c.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 36
Network
| Country | Destination | Domain | Proto |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
| MD5 | 7f60b15a0b51fb295317f095c01bdcf0 |
| SHA1 | b81f50ab18bd0db7ae8ce7271ab3e14208c037ea |
| SHA256 | d5f6388826fe1aa5415a72666f8da002bdf7edd2d4f3d52cd8b2ef2c7dddfd2a |
| SHA512 | bde0dc9d7204a9dead65eef1fd40019d6895f43241c89973f1834e254a63ccc053c8ecbea4b8b2c4734e014a2dca9656cb1ae29636a43857e6acc8ceead8c3b9 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
| MD5 | 7f60b15a0b51fb295317f095c01bdcf0 |
| SHA1 | b81f50ab18bd0db7ae8ce7271ab3e14208c037ea |
| SHA256 | d5f6388826fe1aa5415a72666f8da002bdf7edd2d4f3d52cd8b2ef2c7dddfd2a |
| SHA512 | bde0dc9d7204a9dead65eef1fd40019d6895f43241c89973f1834e254a63ccc053c8ecbea4b8b2c4734e014a2dca9656cb1ae29636a43857e6acc8ceead8c3b9 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
| MD5 | 7f60b15a0b51fb295317f095c01bdcf0 |
| SHA1 | b81f50ab18bd0db7ae8ce7271ab3e14208c037ea |
| SHA256 | d5f6388826fe1aa5415a72666f8da002bdf7edd2d4f3d52cd8b2ef2c7dddfd2a |
| SHA512 | bde0dc9d7204a9dead65eef1fd40019d6895f43241c89973f1834e254a63ccc053c8ecbea4b8b2c4734e014a2dca9656cb1ae29636a43857e6acc8ceead8c3b9 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
| MD5 | 7f60b15a0b51fb295317f095c01bdcf0 |
| SHA1 | b81f50ab18bd0db7ae8ce7271ab3e14208c037ea |
| SHA256 | d5f6388826fe1aa5415a72666f8da002bdf7edd2d4f3d52cd8b2ef2c7dddfd2a |
| SHA512 | bde0dc9d7204a9dead65eef1fd40019d6895f43241c89973f1834e254a63ccc053c8ecbea4b8b2c4734e014a2dca9656cb1ae29636a43857e6acc8ceead8c3b9 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
| MD5 | 4087ce9d75470e8937183d44e3145384 |
| SHA1 | c621192d9bf4ffe583ed4a12cd97fa6c905b67e0 |
| SHA256 | 8687eecaa460e7f9ba759ef99ecc96b954c319c278180c871860d397a1e2ca0f |
| SHA512 | 4d0d1d8ee51271579ed6b700cf9a421e26f0ce64a805dc042d3f0bebfb5d2497cf96d92865db013769af72a31d27b33046627e6055702542029789b2570a8542 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
| MD5 | 4087ce9d75470e8937183d44e3145384 |
| SHA1 | c621192d9bf4ffe583ed4a12cd97fa6c905b67e0 |
| SHA256 | 8687eecaa460e7f9ba759ef99ecc96b954c319c278180c871860d397a1e2ca0f |
| SHA512 | 4d0d1d8ee51271579ed6b700cf9a421e26f0ce64a805dc042d3f0bebfb5d2497cf96d92865db013769af72a31d27b33046627e6055702542029789b2570a8542 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
| MD5 | 4087ce9d75470e8937183d44e3145384 |
| SHA1 | c621192d9bf4ffe583ed4a12cd97fa6c905b67e0 |
| SHA256 | 8687eecaa460e7f9ba759ef99ecc96b954c319c278180c871860d397a1e2ca0f |
| SHA512 | 4d0d1d8ee51271579ed6b700cf9a421e26f0ce64a805dc042d3f0bebfb5d2497cf96d92865db013769af72a31d27b33046627e6055702542029789b2570a8542 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
| MD5 | 4087ce9d75470e8937183d44e3145384 |
| SHA1 | c621192d9bf4ffe583ed4a12cd97fa6c905b67e0 |
| SHA256 | 8687eecaa460e7f9ba759ef99ecc96b954c319c278180c871860d397a1e2ca0f |
| SHA512 | 4d0d1d8ee51271579ed6b700cf9a421e26f0ce64a805dc042d3f0bebfb5d2497cf96d92865db013769af72a31d27b33046627e6055702542029789b2570a8542 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
| MD5 | 5244858c8272b33567dde367e451b548 |
| SHA1 | d4a53a60f64936d78e2c81d181aa1c81d5c7cbac |
| SHA256 | 8fccb95fc4ed9d7a83d1bd27e4b4957a3458df9bc0636d8694192bcea4a2ce84 |
| SHA512 | da81da420b74b81fd07c815103c9dba5a1b3c6d1a13b72c60bf19a0e2ebdff25b69ecdca98a185fdf27741e1a0b9f199cb4a907873a0f47606cce217e7089ae3 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
| MD5 | 5244858c8272b33567dde367e451b548 |
| SHA1 | d4a53a60f64936d78e2c81d181aa1c81d5c7cbac |
| SHA256 | 8fccb95fc4ed9d7a83d1bd27e4b4957a3458df9bc0636d8694192bcea4a2ce84 |
| SHA512 | da81da420b74b81fd07c815103c9dba5a1b3c6d1a13b72c60bf19a0e2ebdff25b69ecdca98a185fdf27741e1a0b9f199cb4a907873a0f47606cce217e7089ae3 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
| MD5 | 5244858c8272b33567dde367e451b548 |
| SHA1 | d4a53a60f64936d78e2c81d181aa1c81d5c7cbac |
| SHA256 | 8fccb95fc4ed9d7a83d1bd27e4b4957a3458df9bc0636d8694192bcea4a2ce84 |
| SHA512 | da81da420b74b81fd07c815103c9dba5a1b3c6d1a13b72c60bf19a0e2ebdff25b69ecdca98a185fdf27741e1a0b9f199cb4a907873a0f47606cce217e7089ae3 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
| MD5 | 5244858c8272b33567dde367e451b548 |
| SHA1 | d4a53a60f64936d78e2c81d181aa1c81d5c7cbac |
| SHA256 | 8fccb95fc4ed9d7a83d1bd27e4b4957a3458df9bc0636d8694192bcea4a2ce84 |
| SHA512 | da81da420b74b81fd07c815103c9dba5a1b3c6d1a13b72c60bf19a0e2ebdff25b69ecdca98a185fdf27741e1a0b9f199cb4a907873a0f47606cce217e7089ae3 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
| MD5 | 4a7be71473748734e14f26c6163243dd |
| SHA1 | cb81b1ec7eb9aab1a13cdcfedac9200ca11f15f3 |
| SHA256 | abc086096be5a3f95d9e5b2df740a126f91f8c5b84a6943107e60841d3617b17 |
| SHA512 | 213bcee1720b6b195c8e39d6848b471ea324d8d2da02ce38f5ea12b3b6b0d52cdd9111d2436dd3279ff2017267a67c408363c0d842801acedaf9458b3469235b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
| MD5 | 4a7be71473748734e14f26c6163243dd |
| SHA1 | cb81b1ec7eb9aab1a13cdcfedac9200ca11f15f3 |
| SHA256 | abc086096be5a3f95d9e5b2df740a126f91f8c5b84a6943107e60841d3617b17 |
| SHA512 | 213bcee1720b6b195c8e39d6848b471ea324d8d2da02ce38f5ea12b3b6b0d52cdd9111d2436dd3279ff2017267a67c408363c0d842801acedaf9458b3469235b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
| MD5 | 4a7be71473748734e14f26c6163243dd |
| SHA1 | cb81b1ec7eb9aab1a13cdcfedac9200ca11f15f3 |
| SHA256 | abc086096be5a3f95d9e5b2df740a126f91f8c5b84a6943107e60841d3617b17 |
| SHA512 | 213bcee1720b6b195c8e39d6848b471ea324d8d2da02ce38f5ea12b3b6b0d52cdd9111d2436dd3279ff2017267a67c408363c0d842801acedaf9458b3469235b |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
| MD5 | 4a7be71473748734e14f26c6163243dd |
| SHA1 | cb81b1ec7eb9aab1a13cdcfedac9200ca11f15f3 |
| SHA256 | abc086096be5a3f95d9e5b2df740a126f91f8c5b84a6943107e60841d3617b17 |
| SHA512 | 213bcee1720b6b195c8e39d6848b471ea324d8d2da02ce38f5ea12b3b6b0d52cdd9111d2436dd3279ff2017267a67c408363c0d842801acedaf9458b3469235b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe
| MD5 | 926401d28f2d419dd13ae4176ec862f7 |
| SHA1 | fb7637099ab685a43294536062ea62e28f915d25 |
| SHA256 | 2af10a84aa25d352e2e2c6903062c5edcdb79c12a76f8794a1e26c8713e62bbf |
| SHA512 | ad9bed0a4436af434503c55e5c51ead97de81db3bab912beb4f183b2de15b2977caf3710a5e04f456611130a965ace76c4388ca1073c71cd67d0becc04d275d8 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe
| MD5 | 926401d28f2d419dd13ae4176ec862f7 |
| SHA1 | fb7637099ab685a43294536062ea62e28f915d25 |
| SHA256 | 2af10a84aa25d352e2e2c6903062c5edcdb79c12a76f8794a1e26c8713e62bbf |
| SHA512 | ad9bed0a4436af434503c55e5c51ead97de81db3bab912beb4f183b2de15b2977caf3710a5e04f456611130a965ace76c4388ca1073c71cd67d0becc04d275d8 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe
| MD5 | 926401d28f2d419dd13ae4176ec862f7 |
| SHA1 | fb7637099ab685a43294536062ea62e28f915d25 |
| SHA256 | 2af10a84aa25d352e2e2c6903062c5edcdb79c12a76f8794a1e26c8713e62bbf |
| SHA512 | ad9bed0a4436af434503c55e5c51ead97de81db3bab912beb4f183b2de15b2977caf3710a5e04f456611130a965ace76c4388ca1073c71cd67d0becc04d275d8 |
memory/2732-48-0x0000000000B00000-0x0000000000B0A000-memory.dmp
memory/2732-49-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp
memory/2732-50-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp
memory/2732-51-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
memory/2640-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2640-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2640-69-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2640-73-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2640-71-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2640-74-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2640-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2640-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2640-76-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2640-78-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2640-79-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
memory/2640-84-0x0000000000400000-0x0000000000428000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:37
Reported
2023-10-10 20:58
Platform
win10v2004-20230915-en
Max time kernel
143s
Max time network
157s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7822771.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4521700.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\b7880b2102a4d508865de72713df901dd4fc4863407ffdc65105ee180551de6c.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3440 set thread context of 2984 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4964 set thread context of 2920 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7928764.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b7880b2102a4d508865de72713df901dd4fc4863407ffdc65105ee180551de6c.exe
"C:\Users\Admin\AppData\Local\Temp\b7880b2102a4d508865de72713df901dd4fc4863407ffdc65105ee180551de6c.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3440 -ip 3440
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2984 -ip 2984
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 148
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7928764.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7928764.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4964 -ip 4964
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 212
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7822771.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7822771.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4521700.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4521700.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4998414.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4998414.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 108.211.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.208.253.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.120.234.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 126.178.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 23.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
| MD5 | 7f60b15a0b51fb295317f095c01bdcf0 |
| SHA1 | b81f50ab18bd0db7ae8ce7271ab3e14208c037ea |
| SHA256 | d5f6388826fe1aa5415a72666f8da002bdf7edd2d4f3d52cd8b2ef2c7dddfd2a |
| SHA512 | bde0dc9d7204a9dead65eef1fd40019d6895f43241c89973f1834e254a63ccc053c8ecbea4b8b2c4734e014a2dca9656cb1ae29636a43857e6acc8ceead8c3b9 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0824912.exe
| MD5 | 7f60b15a0b51fb295317f095c01bdcf0 |
| SHA1 | b81f50ab18bd0db7ae8ce7271ab3e14208c037ea |
| SHA256 | d5f6388826fe1aa5415a72666f8da002bdf7edd2d4f3d52cd8b2ef2c7dddfd2a |
| SHA512 | bde0dc9d7204a9dead65eef1fd40019d6895f43241c89973f1834e254a63ccc053c8ecbea4b8b2c4734e014a2dca9656cb1ae29636a43857e6acc8ceead8c3b9 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
| MD5 | 4087ce9d75470e8937183d44e3145384 |
| SHA1 | c621192d9bf4ffe583ed4a12cd97fa6c905b67e0 |
| SHA256 | 8687eecaa460e7f9ba759ef99ecc96b954c319c278180c871860d397a1e2ca0f |
| SHA512 | 4d0d1d8ee51271579ed6b700cf9a421e26f0ce64a805dc042d3f0bebfb5d2497cf96d92865db013769af72a31d27b33046627e6055702542029789b2570a8542 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9284548.exe
| MD5 | 4087ce9d75470e8937183d44e3145384 |
| SHA1 | c621192d9bf4ffe583ed4a12cd97fa6c905b67e0 |
| SHA256 | 8687eecaa460e7f9ba759ef99ecc96b954c319c278180c871860d397a1e2ca0f |
| SHA512 | 4d0d1d8ee51271579ed6b700cf9a421e26f0ce64a805dc042d3f0bebfb5d2497cf96d92865db013769af72a31d27b33046627e6055702542029789b2570a8542 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
| MD5 | 5244858c8272b33567dde367e451b548 |
| SHA1 | d4a53a60f64936d78e2c81d181aa1c81d5c7cbac |
| SHA256 | 8fccb95fc4ed9d7a83d1bd27e4b4957a3458df9bc0636d8694192bcea4a2ce84 |
| SHA512 | da81da420b74b81fd07c815103c9dba5a1b3c6d1a13b72c60bf19a0e2ebdff25b69ecdca98a185fdf27741e1a0b9f199cb4a907873a0f47606cce217e7089ae3 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5808548.exe
| MD5 | 5244858c8272b33567dde367e451b548 |
| SHA1 | d4a53a60f64936d78e2c81d181aa1c81d5c7cbac |
| SHA256 | 8fccb95fc4ed9d7a83d1bd27e4b4957a3458df9bc0636d8694192bcea4a2ce84 |
| SHA512 | da81da420b74b81fd07c815103c9dba5a1b3c6d1a13b72c60bf19a0e2ebdff25b69ecdca98a185fdf27741e1a0b9f199cb4a907873a0f47606cce217e7089ae3 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
| MD5 | 4a7be71473748734e14f26c6163243dd |
| SHA1 | cb81b1ec7eb9aab1a13cdcfedac9200ca11f15f3 |
| SHA256 | abc086096be5a3f95d9e5b2df740a126f91f8c5b84a6943107e60841d3617b17 |
| SHA512 | 213bcee1720b6b195c8e39d6848b471ea324d8d2da02ce38f5ea12b3b6b0d52cdd9111d2436dd3279ff2017267a67c408363c0d842801acedaf9458b3469235b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5425025.exe
| MD5 | 4a7be71473748734e14f26c6163243dd |
| SHA1 | cb81b1ec7eb9aab1a13cdcfedac9200ca11f15f3 |
| SHA256 | abc086096be5a3f95d9e5b2df740a126f91f8c5b84a6943107e60841d3617b17 |
| SHA512 | 213bcee1720b6b195c8e39d6848b471ea324d8d2da02ce38f5ea12b3b6b0d52cdd9111d2436dd3279ff2017267a67c408363c0d842801acedaf9458b3469235b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe
| MD5 | 926401d28f2d419dd13ae4176ec862f7 |
| SHA1 | fb7637099ab685a43294536062ea62e28f915d25 |
| SHA256 | 2af10a84aa25d352e2e2c6903062c5edcdb79c12a76f8794a1e26c8713e62bbf |
| SHA512 | ad9bed0a4436af434503c55e5c51ead97de81db3bab912beb4f183b2de15b2977caf3710a5e04f456611130a965ace76c4388ca1073c71cd67d0becc04d275d8 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5841126.exe
| MD5 | 926401d28f2d419dd13ae4176ec862f7 |
| SHA1 | fb7637099ab685a43294536062ea62e28f915d25 |
| SHA256 | 2af10a84aa25d352e2e2c6903062c5edcdb79c12a76f8794a1e26c8713e62bbf |
| SHA512 | ad9bed0a4436af434503c55e5c51ead97de81db3bab912beb4f183b2de15b2977caf3710a5e04f456611130a965ace76c4388ca1073c71cd67d0becc04d275d8 |
memory/4436-35-0x0000000000F30000-0x0000000000F3A000-memory.dmp
memory/4436-36-0x00007FFB78280000-0x00007FFB78D41000-memory.dmp
memory/4436-37-0x00007FFB78280000-0x00007FFB78D41000-memory.dmp
memory/4436-39-0x00007FFB78280000-0x00007FFB78D41000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2504102.exe
| MD5 | 911f0c548f884b7d732aafbe4f893d3e |
| SHA1 | 2e83d3c51eef161ec4ab5148befb375d1c141b3d |
| SHA256 | 44aacd891b1eb9fac0e76e03a71efbf4abea4bcef17307daf7098973e0769f7b |
| SHA512 | 120aebeed5e3a8c2bf546c1107e32534ba6f14fc4906b8c793da0d5059b6c339d8e3956aabe5a11258e09b749dfa5aaaa9e05021b35e71b7c307519177d6be2f |
memory/2984-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2984-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2984-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2984-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7928764.exe
| MD5 | 6289214f8b7bdcd033c4f3f4ff166fcc |
| SHA1 | 7fb4d79d4f0cf6e89a03d7ad41633d152de4d77a |
| SHA256 | 927c86597b4c47278406fdc2b7a61c6ee9322abf113a82285fc66de1339b0d64 |
| SHA512 | b77206bb7df513c3c15198596342141f3b688aad6e8e3dc2502aefa9af99766ba9a6154f4edaab26fc14564cd40f493fb186d01f44d54fb07bd66bfb96268908 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7928764.exe
| MD5 | 6289214f8b7bdcd033c4f3f4ff166fcc |
| SHA1 | 7fb4d79d4f0cf6e89a03d7ad41633d152de4d77a |
| SHA256 | 927c86597b4c47278406fdc2b7a61c6ee9322abf113a82285fc66de1339b0d64 |
| SHA512 | b77206bb7df513c3c15198596342141f3b688aad6e8e3dc2502aefa9af99766ba9a6154f4edaab26fc14564cd40f493fb186d01f44d54fb07bd66bfb96268908 |
memory/2920-51-0x0000000000400000-0x0000000000430000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7822771.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7822771.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2920-57-0x00000000743A0000-0x0000000074B50000-memory.dmp
memory/2920-58-0x0000000002390000-0x0000000002396000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4521700.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4521700.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2920-71-0x00000000050E0000-0x00000000056F8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2920-78-0x0000000004BD0000-0x0000000004CDA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2920-81-0x0000000004AB0000-0x0000000004AC0000-memory.dmp
memory/2920-80-0x0000000004A70000-0x0000000004A82000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4998414.exe
| MD5 | d8dcd96bd2fdae6a6cd2db0596945afc |
| SHA1 | 64007dff986a95481a1b680249768ba33443a69f |
| SHA256 | d94049558f1bc119c2a1224672f2b450ba7703118c0b31c9230bec66008ca50c |
| SHA512 | bf186c3ccbba09c07c94324e8d826df94f724c49a4daa704bfffca2014232c6af732649ec11e7c121943bdb58ba5e0c4544f8e6ecc8dda9cbaf21f090e6bab13 |
memory/2920-84-0x0000000004B00000-0x0000000004B3C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4998414.exe
| MD5 | d8dcd96bd2fdae6a6cd2db0596945afc |
| SHA1 | 64007dff986a95481a1b680249768ba33443a69f |
| SHA256 | d94049558f1bc119c2a1224672f2b450ba7703118c0b31c9230bec66008ca50c |
| SHA512 | bf186c3ccbba09c07c94324e8d826df94f724c49a4daa704bfffca2014232c6af732649ec11e7c121943bdb58ba5e0c4544f8e6ecc8dda9cbaf21f090e6bab13 |
memory/2920-86-0x0000000004B40000-0x0000000004B8C000-memory.dmp
memory/2920-87-0x00000000743A0000-0x0000000074B50000-memory.dmp
memory/2920-88-0x0000000004AB0000-0x0000000004AC0000-memory.dmp
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |