Analysis Overview
SHA256
13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484
Threat Level: Known bad
The file 13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484 was found to be: Known bad.
Malicious Activity Summary
Detect Mystic stealer payload
RedLine
Healer
Mystic
Amadey
Modifies Windows Defender Real-time Protection settings
Detects Healer an antivirus disabler dropper
Loads dropped DLL
Windows security modification
Checks computer location settings
Executes dropped EXE
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Program crash
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:40
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:40
Reported
2023-10-10 21:04
Platform
win7-20230831-en
Max time kernel
118s
Max time network
122s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2612 set thread context of 2576 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484.exe
"C:\Users\Admin\AppData\Local\Temp\13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 36
Network
| Country | Destination | Domain | Proto |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
| MD5 | a984915e88bde85e9dbc9fbca4fd6a19 |
| SHA1 | 81a6cbddbdb662071c1d419b9a93d13e49e1a9b1 |
| SHA256 | 2d74a8c8a87f12566e36ad65a899f98673b763e6f6bd305f0bec2fd70f69f5ba |
| SHA512 | 4c839743dde5c07fe00231fac432396c173656f46ea4d9022740cdd79e1077f53c49e4360a5ba322e1262c32e4f524a3751187bc149e9c34c1ddcdcf91815ee3 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
| MD5 | a984915e88bde85e9dbc9fbca4fd6a19 |
| SHA1 | 81a6cbddbdb662071c1d419b9a93d13e49e1a9b1 |
| SHA256 | 2d74a8c8a87f12566e36ad65a899f98673b763e6f6bd305f0bec2fd70f69f5ba |
| SHA512 | 4c839743dde5c07fe00231fac432396c173656f46ea4d9022740cdd79e1077f53c49e4360a5ba322e1262c32e4f524a3751187bc149e9c34c1ddcdcf91815ee3 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
| MD5 | a984915e88bde85e9dbc9fbca4fd6a19 |
| SHA1 | 81a6cbddbdb662071c1d419b9a93d13e49e1a9b1 |
| SHA256 | 2d74a8c8a87f12566e36ad65a899f98673b763e6f6bd305f0bec2fd70f69f5ba |
| SHA512 | 4c839743dde5c07fe00231fac432396c173656f46ea4d9022740cdd79e1077f53c49e4360a5ba322e1262c32e4f524a3751187bc149e9c34c1ddcdcf91815ee3 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
| MD5 | a984915e88bde85e9dbc9fbca4fd6a19 |
| SHA1 | 81a6cbddbdb662071c1d419b9a93d13e49e1a9b1 |
| SHA256 | 2d74a8c8a87f12566e36ad65a899f98673b763e6f6bd305f0bec2fd70f69f5ba |
| SHA512 | 4c839743dde5c07fe00231fac432396c173656f46ea4d9022740cdd79e1077f53c49e4360a5ba322e1262c32e4f524a3751187bc149e9c34c1ddcdcf91815ee3 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
| MD5 | 3a310e1b67a1bca891462bcf9902d2be |
| SHA1 | 3b2ebcc85d458fad57ea8d44c2ec857fcebe3c3d |
| SHA256 | 37928abb0aa708362f1e304dd9db4ed8a2776653af701fb535d64fc126640522 |
| SHA512 | ba1d313c601f553c9281852260610ddac18e3d7be92f48efc99655e5255567ed4353d0a0816bbb944472e5c575ecf586ed1bd2319b1dd1662e82aa6b40a168ba |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
| MD5 | 3a310e1b67a1bca891462bcf9902d2be |
| SHA1 | 3b2ebcc85d458fad57ea8d44c2ec857fcebe3c3d |
| SHA256 | 37928abb0aa708362f1e304dd9db4ed8a2776653af701fb535d64fc126640522 |
| SHA512 | ba1d313c601f553c9281852260610ddac18e3d7be92f48efc99655e5255567ed4353d0a0816bbb944472e5c575ecf586ed1bd2319b1dd1662e82aa6b40a168ba |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
| MD5 | 3a310e1b67a1bca891462bcf9902d2be |
| SHA1 | 3b2ebcc85d458fad57ea8d44c2ec857fcebe3c3d |
| SHA256 | 37928abb0aa708362f1e304dd9db4ed8a2776653af701fb535d64fc126640522 |
| SHA512 | ba1d313c601f553c9281852260610ddac18e3d7be92f48efc99655e5255567ed4353d0a0816bbb944472e5c575ecf586ed1bd2319b1dd1662e82aa6b40a168ba |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
| MD5 | 3a310e1b67a1bca891462bcf9902d2be |
| SHA1 | 3b2ebcc85d458fad57ea8d44c2ec857fcebe3c3d |
| SHA256 | 37928abb0aa708362f1e304dd9db4ed8a2776653af701fb535d64fc126640522 |
| SHA512 | ba1d313c601f553c9281852260610ddac18e3d7be92f48efc99655e5255567ed4353d0a0816bbb944472e5c575ecf586ed1bd2319b1dd1662e82aa6b40a168ba |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
| MD5 | 2d92010b8fda72ec3fa8c6959d08cf42 |
| SHA1 | e40e19d084348cb2fa0cd4a6986ac16823167190 |
| SHA256 | 97ae64c4d24454f100c7664a89454adecec50f83eadbce6c991d9efb89b00844 |
| SHA512 | 6f7e90ceb872fc3ff48c21588d9ab0f298884e08047aba3621e16b97889bfbe706e694def77580f5393c57ccb63c98b791365e706f753bbe669f2caad28e79ee |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
| MD5 | 2d92010b8fda72ec3fa8c6959d08cf42 |
| SHA1 | e40e19d084348cb2fa0cd4a6986ac16823167190 |
| SHA256 | 97ae64c4d24454f100c7664a89454adecec50f83eadbce6c991d9efb89b00844 |
| SHA512 | 6f7e90ceb872fc3ff48c21588d9ab0f298884e08047aba3621e16b97889bfbe706e694def77580f5393c57ccb63c98b791365e706f753bbe669f2caad28e79ee |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
| MD5 | 2d92010b8fda72ec3fa8c6959d08cf42 |
| SHA1 | e40e19d084348cb2fa0cd4a6986ac16823167190 |
| SHA256 | 97ae64c4d24454f100c7664a89454adecec50f83eadbce6c991d9efb89b00844 |
| SHA512 | 6f7e90ceb872fc3ff48c21588d9ab0f298884e08047aba3621e16b97889bfbe706e694def77580f5393c57ccb63c98b791365e706f753bbe669f2caad28e79ee |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
| MD5 | 2d92010b8fda72ec3fa8c6959d08cf42 |
| SHA1 | e40e19d084348cb2fa0cd4a6986ac16823167190 |
| SHA256 | 97ae64c4d24454f100c7664a89454adecec50f83eadbce6c991d9efb89b00844 |
| SHA512 | 6f7e90ceb872fc3ff48c21588d9ab0f298884e08047aba3621e16b97889bfbe706e694def77580f5393c57ccb63c98b791365e706f753bbe669f2caad28e79ee |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
| MD5 | 2e5cdedd303f1e7e3fa07c916771154f |
| SHA1 | 891b2102c6f572636a4768d77f08cd3bc8cad23f |
| SHA256 | 4f768f8e34322cd9dcf6b5ab0ab55b8b437fa53e4321b3b528c2d55af602d9fa |
| SHA512 | b74c6937f0082322acc29bfc883322ccc601734f502aa0117ec8f5467618dda34f6e8dde64b42359a7a7b9dad8e5840f6947e11372f832d19d851d39e10fc41a |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
| MD5 | 2e5cdedd303f1e7e3fa07c916771154f |
| SHA1 | 891b2102c6f572636a4768d77f08cd3bc8cad23f |
| SHA256 | 4f768f8e34322cd9dcf6b5ab0ab55b8b437fa53e4321b3b528c2d55af602d9fa |
| SHA512 | b74c6937f0082322acc29bfc883322ccc601734f502aa0117ec8f5467618dda34f6e8dde64b42359a7a7b9dad8e5840f6947e11372f832d19d851d39e10fc41a |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
| MD5 | 2e5cdedd303f1e7e3fa07c916771154f |
| SHA1 | 891b2102c6f572636a4768d77f08cd3bc8cad23f |
| SHA256 | 4f768f8e34322cd9dcf6b5ab0ab55b8b437fa53e4321b3b528c2d55af602d9fa |
| SHA512 | b74c6937f0082322acc29bfc883322ccc601734f502aa0117ec8f5467618dda34f6e8dde64b42359a7a7b9dad8e5840f6947e11372f832d19d851d39e10fc41a |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
| MD5 | 2e5cdedd303f1e7e3fa07c916771154f |
| SHA1 | 891b2102c6f572636a4768d77f08cd3bc8cad23f |
| SHA256 | 4f768f8e34322cd9dcf6b5ab0ab55b8b437fa53e4321b3b528c2d55af602d9fa |
| SHA512 | b74c6937f0082322acc29bfc883322ccc601734f502aa0117ec8f5467618dda34f6e8dde64b42359a7a7b9dad8e5840f6947e11372f832d19d851d39e10fc41a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe
| MD5 | 3f801188b87b3efd69c51f1c93f62561 |
| SHA1 | 94364c72a405693364c2ee1af3ab50a0ad735886 |
| SHA256 | 343fd64400facd46b29f171733ea51d2353aa998de205735d098ffca3d141b9a |
| SHA512 | 7dad5bb07fc165910c8c43705c8f6cebe82ebece16d25913409c254ba43bbdff4892627534591088cc98d8ec1094d78d9dd3cd48598844fa277d5cf72db8778c |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe
| MD5 | 3f801188b87b3efd69c51f1c93f62561 |
| SHA1 | 94364c72a405693364c2ee1af3ab50a0ad735886 |
| SHA256 | 343fd64400facd46b29f171733ea51d2353aa998de205735d098ffca3d141b9a |
| SHA512 | 7dad5bb07fc165910c8c43705c8f6cebe82ebece16d25913409c254ba43bbdff4892627534591088cc98d8ec1094d78d9dd3cd48598844fa277d5cf72db8778c |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe
| MD5 | 3f801188b87b3efd69c51f1c93f62561 |
| SHA1 | 94364c72a405693364c2ee1af3ab50a0ad735886 |
| SHA256 | 343fd64400facd46b29f171733ea51d2353aa998de205735d098ffca3d141b9a |
| SHA512 | 7dad5bb07fc165910c8c43705c8f6cebe82ebece16d25913409c254ba43bbdff4892627534591088cc98d8ec1094d78d9dd3cd48598844fa277d5cf72db8778c |
memory/2532-48-0x0000000000AF0000-0x0000000000AFA000-memory.dmp
memory/2532-49-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp
memory/2532-50-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp
memory/2532-51-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
memory/2576-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-69-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-71-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-74-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-73-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2576-76-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-78-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2576-79-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
memory/2576-84-0x0000000000400000-0x0000000000428000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:40
Reported
2023-10-10 21:04
Platform
win10v2004-20230915-en
Max time kernel
163s
Max time network
184s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9277018.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1795224.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1612 set thread context of 2204 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3032 set thread context of 2176 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3420873.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484.exe
"C:\Users\Admin\AppData\Local\Temp\13469795222a9d5a4f2d4b7a60bd60ccfec9c969c5567365c25533b82be64484.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1612 -ip 1612
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2204 -ip 2204
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 140
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 192
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3420873.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3420873.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3032 -ip 3032
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 156
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9277018.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9277018.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1795224.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1795224.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8742120.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8742120.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.211.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.20.238.8.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.73.42.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
| MD5 | a984915e88bde85e9dbc9fbca4fd6a19 |
| SHA1 | 81a6cbddbdb662071c1d419b9a93d13e49e1a9b1 |
| SHA256 | 2d74a8c8a87f12566e36ad65a899f98673b763e6f6bd305f0bec2fd70f69f5ba |
| SHA512 | 4c839743dde5c07fe00231fac432396c173656f46ea4d9022740cdd79e1077f53c49e4360a5ba322e1262c32e4f524a3751187bc149e9c34c1ddcdcf91815ee3 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7485974.exe
| MD5 | a984915e88bde85e9dbc9fbca4fd6a19 |
| SHA1 | 81a6cbddbdb662071c1d419b9a93d13e49e1a9b1 |
| SHA256 | 2d74a8c8a87f12566e36ad65a899f98673b763e6f6bd305f0bec2fd70f69f5ba |
| SHA512 | 4c839743dde5c07fe00231fac432396c173656f46ea4d9022740cdd79e1077f53c49e4360a5ba322e1262c32e4f524a3751187bc149e9c34c1ddcdcf91815ee3 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
| MD5 | 3a310e1b67a1bca891462bcf9902d2be |
| SHA1 | 3b2ebcc85d458fad57ea8d44c2ec857fcebe3c3d |
| SHA256 | 37928abb0aa708362f1e304dd9db4ed8a2776653af701fb535d64fc126640522 |
| SHA512 | ba1d313c601f553c9281852260610ddac18e3d7be92f48efc99655e5255567ed4353d0a0816bbb944472e5c575ecf586ed1bd2319b1dd1662e82aa6b40a168ba |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3813204.exe
| MD5 | 3a310e1b67a1bca891462bcf9902d2be |
| SHA1 | 3b2ebcc85d458fad57ea8d44c2ec857fcebe3c3d |
| SHA256 | 37928abb0aa708362f1e304dd9db4ed8a2776653af701fb535d64fc126640522 |
| SHA512 | ba1d313c601f553c9281852260610ddac18e3d7be92f48efc99655e5255567ed4353d0a0816bbb944472e5c575ecf586ed1bd2319b1dd1662e82aa6b40a168ba |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
| MD5 | 2d92010b8fda72ec3fa8c6959d08cf42 |
| SHA1 | e40e19d084348cb2fa0cd4a6986ac16823167190 |
| SHA256 | 97ae64c4d24454f100c7664a89454adecec50f83eadbce6c991d9efb89b00844 |
| SHA512 | 6f7e90ceb872fc3ff48c21588d9ab0f298884e08047aba3621e16b97889bfbe706e694def77580f5393c57ccb63c98b791365e706f753bbe669f2caad28e79ee |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4696145.exe
| MD5 | 2d92010b8fda72ec3fa8c6959d08cf42 |
| SHA1 | e40e19d084348cb2fa0cd4a6986ac16823167190 |
| SHA256 | 97ae64c4d24454f100c7664a89454adecec50f83eadbce6c991d9efb89b00844 |
| SHA512 | 6f7e90ceb872fc3ff48c21588d9ab0f298884e08047aba3621e16b97889bfbe706e694def77580f5393c57ccb63c98b791365e706f753bbe669f2caad28e79ee |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
| MD5 | 2e5cdedd303f1e7e3fa07c916771154f |
| SHA1 | 891b2102c6f572636a4768d77f08cd3bc8cad23f |
| SHA256 | 4f768f8e34322cd9dcf6b5ab0ab55b8b437fa53e4321b3b528c2d55af602d9fa |
| SHA512 | b74c6937f0082322acc29bfc883322ccc601734f502aa0117ec8f5467618dda34f6e8dde64b42359a7a7b9dad8e5840f6947e11372f832d19d851d39e10fc41a |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4585205.exe
| MD5 | 2e5cdedd303f1e7e3fa07c916771154f |
| SHA1 | 891b2102c6f572636a4768d77f08cd3bc8cad23f |
| SHA256 | 4f768f8e34322cd9dcf6b5ab0ab55b8b437fa53e4321b3b528c2d55af602d9fa |
| SHA512 | b74c6937f0082322acc29bfc883322ccc601734f502aa0117ec8f5467618dda34f6e8dde64b42359a7a7b9dad8e5840f6947e11372f832d19d851d39e10fc41a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe
| MD5 | 3f801188b87b3efd69c51f1c93f62561 |
| SHA1 | 94364c72a405693364c2ee1af3ab50a0ad735886 |
| SHA256 | 343fd64400facd46b29f171733ea51d2353aa998de205735d098ffca3d141b9a |
| SHA512 | 7dad5bb07fc165910c8c43705c8f6cebe82ebece16d25913409c254ba43bbdff4892627534591088cc98d8ec1094d78d9dd3cd48598844fa277d5cf72db8778c |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5569338.exe
| MD5 | 3f801188b87b3efd69c51f1c93f62561 |
| SHA1 | 94364c72a405693364c2ee1af3ab50a0ad735886 |
| SHA256 | 343fd64400facd46b29f171733ea51d2353aa998de205735d098ffca3d141b9a |
| SHA512 | 7dad5bb07fc165910c8c43705c8f6cebe82ebece16d25913409c254ba43bbdff4892627534591088cc98d8ec1094d78d9dd3cd48598844fa277d5cf72db8778c |
memory/428-35-0x0000000000310000-0x000000000031A000-memory.dmp
memory/428-36-0x00007FFE9D9A0000-0x00007FFE9E461000-memory.dmp
memory/428-38-0x00007FFE9D9A0000-0x00007FFE9E461000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5444812.exe
| MD5 | 56521a0f333ba20257a34abe918bc1de |
| SHA1 | 759a684b0c08487504d2fb56dba71be75532194a |
| SHA256 | a38410123170c8c50284782861bf188b832b1468f1c068c61e90f241a17b565a |
| SHA512 | 33d83f2ca92abf5f283647e5424dc31b7c54a5fd65f4d8109b6f707ede8e7e95266d32719411203054938d44b8c26ac4740c9ecff4f71f2e9729c0b0d65817a3 |
memory/2204-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2204-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2204-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2204-46-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3420873.exe
| MD5 | c1aeccf479607a94e83f40f8daf272c8 |
| SHA1 | e25e52a53e397c6b1649bb9b28c2b2165ab8d109 |
| SHA256 | 0822451affe5fb1aa41fd323128158dbe9190f7059541963925a4184b3e56e3b |
| SHA512 | 766a70da6fbb9b0223619e2369137241d41f8bc704ceaca9736a58df18fec3d84a3c67643975dae605c97090d5b66b65f915cb6e43e34b48338b542051ab7757 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3420873.exe
| MD5 | c1aeccf479607a94e83f40f8daf272c8 |
| SHA1 | e25e52a53e397c6b1649bb9b28c2b2165ab8d109 |
| SHA256 | 0822451affe5fb1aa41fd323128158dbe9190f7059541963925a4184b3e56e3b |
| SHA512 | 766a70da6fbb9b0223619e2369137241d41f8bc704ceaca9736a58df18fec3d84a3c67643975dae605c97090d5b66b65f915cb6e43e34b48338b542051ab7757 |
memory/2176-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2176-51-0x0000000073A70000-0x0000000074220000-memory.dmp
memory/2176-52-0x0000000002950000-0x0000000002956000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9277018.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9277018.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2176-58-0x00000000055E0000-0x0000000005BF8000-memory.dmp
memory/2176-59-0x00000000050D0000-0x00000000051DA000-memory.dmp
memory/2176-62-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
memory/2176-61-0x0000000004F00000-0x0000000004F12000-memory.dmp
memory/2176-66-0x0000000004F60000-0x0000000004F9C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1795224.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1795224.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2176-75-0x0000000004FC0000-0x000000000500C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8742120.exe
| MD5 | 40b36eb95908c251033e2cd9b4166152 |
| SHA1 | be3615273faa802946753f429910a9053cfaf559 |
| SHA256 | 798f629ccd0472f70c7e92dcfed3587c08b21435ae4dfacdbd8b46751a4d2cdf |
| SHA512 | fb831cf501e82e7db3744b9cea8218374665625e2c38194285f10c2c49cb5dc3737733e3fdcec3579f6cdd9877a4e09d45b039a36ae7501e931719381453e887 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8742120.exe
| MD5 | 40b36eb95908c251033e2cd9b4166152 |
| SHA1 | be3615273faa802946753f429910a9053cfaf559 |
| SHA256 | 798f629ccd0472f70c7e92dcfed3587c08b21435ae4dfacdbd8b46751a4d2cdf |
| SHA512 | fb831cf501e82e7db3744b9cea8218374665625e2c38194285f10c2c49cb5dc3737733e3fdcec3579f6cdd9877a4e09d45b039a36ae7501e931719381453e887 |
memory/2176-86-0x0000000073A70000-0x0000000074220000-memory.dmp
memory/2176-87-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |