Analysis Overview
SHA256
30e97175b73dfa9fc7f7bfc860ad611497f68282985eb156dc05abdbed29e5fb
Threat Level: Known bad
The file 30e97175b73dfa9fc7f7bfc860ad611497f68282985eb156dc05abdbed29e5fb was found to be: Known bad.
Malicious Activity Summary
Healer
Mystic
Modifies Windows Defender Real-time Protection settings
Amadey
Detect Mystic stealer payload
Detects Healer an antivirus disabler dropper
RedLine
Windows security modification
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Program crash
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:39
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:39
Reported
2023-10-10 21:01
Platform
win7-20230831-en
Max time kernel
118s
Max time network
123s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\30e97175b73dfa9fc7f7bfc860ad611497f68282985eb156dc05abdbed29e5fb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2540 set thread context of 1060 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\30e97175b73dfa9fc7f7bfc860ad611497f68282985eb156dc05abdbed29e5fb.exe
"C:\Users\Admin\AppData\Local\Temp\30e97175b73dfa9fc7f7bfc860ad611497f68282985eb156dc05abdbed29e5fb.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 268
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 36
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
| MD5 | 82b4fe1f088b6e6cdd8b49d401b48fb8 |
| SHA1 | d05c98139e0f05e3c7427161371db99fa327da38 |
| SHA256 | a2b621b07d5760b49ab0de190deb3941c0b27ab9cb5467c378c3c2417559e0a3 |
| SHA512 | 4dcd75035255bd32b67a6259ab1204876fed482fb9cb91ff2a88536cc829867903898498d44acaa5a2800902cc1348d1c237e7027323045cdb4ccc37afaea786 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
| MD5 | 82b4fe1f088b6e6cdd8b49d401b48fb8 |
| SHA1 | d05c98139e0f05e3c7427161371db99fa327da38 |
| SHA256 | a2b621b07d5760b49ab0de190deb3941c0b27ab9cb5467c378c3c2417559e0a3 |
| SHA512 | 4dcd75035255bd32b67a6259ab1204876fed482fb9cb91ff2a88536cc829867903898498d44acaa5a2800902cc1348d1c237e7027323045cdb4ccc37afaea786 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
| MD5 | 82b4fe1f088b6e6cdd8b49d401b48fb8 |
| SHA1 | d05c98139e0f05e3c7427161371db99fa327da38 |
| SHA256 | a2b621b07d5760b49ab0de190deb3941c0b27ab9cb5467c378c3c2417559e0a3 |
| SHA512 | 4dcd75035255bd32b67a6259ab1204876fed482fb9cb91ff2a88536cc829867903898498d44acaa5a2800902cc1348d1c237e7027323045cdb4ccc37afaea786 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
| MD5 | 82b4fe1f088b6e6cdd8b49d401b48fb8 |
| SHA1 | d05c98139e0f05e3c7427161371db99fa327da38 |
| SHA256 | a2b621b07d5760b49ab0de190deb3941c0b27ab9cb5467c378c3c2417559e0a3 |
| SHA512 | 4dcd75035255bd32b67a6259ab1204876fed482fb9cb91ff2a88536cc829867903898498d44acaa5a2800902cc1348d1c237e7027323045cdb4ccc37afaea786 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
| MD5 | 3dcf1e14d835ba935f3631c6df3f9db5 |
| SHA1 | 1fd3050fb9aee9442751270e21300c29ede5491e |
| SHA256 | 801ae89e10f3f68c1e75b25f17f55fc09c12149bd4b86da87b069c8a8e87e45c |
| SHA512 | 50cd6bf00c04fc7bed7fee6e78294860ec46ca80ae33de167b4c19278c12ad312a0b4e863b3abaf0c0a7a63d231d1ab366ea6ea0bc8a797b028f5a80333f40ba |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
| MD5 | 3dcf1e14d835ba935f3631c6df3f9db5 |
| SHA1 | 1fd3050fb9aee9442751270e21300c29ede5491e |
| SHA256 | 801ae89e10f3f68c1e75b25f17f55fc09c12149bd4b86da87b069c8a8e87e45c |
| SHA512 | 50cd6bf00c04fc7bed7fee6e78294860ec46ca80ae33de167b4c19278c12ad312a0b4e863b3abaf0c0a7a63d231d1ab366ea6ea0bc8a797b028f5a80333f40ba |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
| MD5 | 3dcf1e14d835ba935f3631c6df3f9db5 |
| SHA1 | 1fd3050fb9aee9442751270e21300c29ede5491e |
| SHA256 | 801ae89e10f3f68c1e75b25f17f55fc09c12149bd4b86da87b069c8a8e87e45c |
| SHA512 | 50cd6bf00c04fc7bed7fee6e78294860ec46ca80ae33de167b4c19278c12ad312a0b4e863b3abaf0c0a7a63d231d1ab366ea6ea0bc8a797b028f5a80333f40ba |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
| MD5 | 3dcf1e14d835ba935f3631c6df3f9db5 |
| SHA1 | 1fd3050fb9aee9442751270e21300c29ede5491e |
| SHA256 | 801ae89e10f3f68c1e75b25f17f55fc09c12149bd4b86da87b069c8a8e87e45c |
| SHA512 | 50cd6bf00c04fc7bed7fee6e78294860ec46ca80ae33de167b4c19278c12ad312a0b4e863b3abaf0c0a7a63d231d1ab366ea6ea0bc8a797b028f5a80333f40ba |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
| MD5 | 792555cf29e18157fd562a662d628058 |
| SHA1 | d692d89cda193935d24725849ae10e1c63c6fa7e |
| SHA256 | 28143958eb06b508c13a3bab913ba6aa2e4e5b88a4117439e106c344a3b6600f |
| SHA512 | 2def2b3bbd3454a0ea51b84b7d724346043cc0701c84ba5a2969614ec6e75bc67c837886753c5147b1979d7c689dc7186b9d3d1d1b17814546e5ebfdfe2b52bc |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
| MD5 | 792555cf29e18157fd562a662d628058 |
| SHA1 | d692d89cda193935d24725849ae10e1c63c6fa7e |
| SHA256 | 28143958eb06b508c13a3bab913ba6aa2e4e5b88a4117439e106c344a3b6600f |
| SHA512 | 2def2b3bbd3454a0ea51b84b7d724346043cc0701c84ba5a2969614ec6e75bc67c837886753c5147b1979d7c689dc7186b9d3d1d1b17814546e5ebfdfe2b52bc |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
| MD5 | 792555cf29e18157fd562a662d628058 |
| SHA1 | d692d89cda193935d24725849ae10e1c63c6fa7e |
| SHA256 | 28143958eb06b508c13a3bab913ba6aa2e4e5b88a4117439e106c344a3b6600f |
| SHA512 | 2def2b3bbd3454a0ea51b84b7d724346043cc0701c84ba5a2969614ec6e75bc67c837886753c5147b1979d7c689dc7186b9d3d1d1b17814546e5ebfdfe2b52bc |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
| MD5 | 792555cf29e18157fd562a662d628058 |
| SHA1 | d692d89cda193935d24725849ae10e1c63c6fa7e |
| SHA256 | 28143958eb06b508c13a3bab913ba6aa2e4e5b88a4117439e106c344a3b6600f |
| SHA512 | 2def2b3bbd3454a0ea51b84b7d724346043cc0701c84ba5a2969614ec6e75bc67c837886753c5147b1979d7c689dc7186b9d3d1d1b17814546e5ebfdfe2b52bc |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
| MD5 | 0f45221e9f6d0f88070171f5c2bbac23 |
| SHA1 | b41683564c45eb468151930b48b9c4cbacc54102 |
| SHA256 | 5dc1e01dd63185d7211f74c08873bf19a148d65b9643b71818ffbabfb7d26679 |
| SHA512 | 11df3ee8a3e19d7b206aeb3126cbddc2dbc5638999442ffbbcdd916303201298236365769a98ad4966c0e22d5f591e69f9c014f1e757269a94e5edac9422b6aa |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
| MD5 | 0f45221e9f6d0f88070171f5c2bbac23 |
| SHA1 | b41683564c45eb468151930b48b9c4cbacc54102 |
| SHA256 | 5dc1e01dd63185d7211f74c08873bf19a148d65b9643b71818ffbabfb7d26679 |
| SHA512 | 11df3ee8a3e19d7b206aeb3126cbddc2dbc5638999442ffbbcdd916303201298236365769a98ad4966c0e22d5f591e69f9c014f1e757269a94e5edac9422b6aa |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
| MD5 | 0f45221e9f6d0f88070171f5c2bbac23 |
| SHA1 | b41683564c45eb468151930b48b9c4cbacc54102 |
| SHA256 | 5dc1e01dd63185d7211f74c08873bf19a148d65b9643b71818ffbabfb7d26679 |
| SHA512 | 11df3ee8a3e19d7b206aeb3126cbddc2dbc5638999442ffbbcdd916303201298236365769a98ad4966c0e22d5f591e69f9c014f1e757269a94e5edac9422b6aa |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
| MD5 | 0f45221e9f6d0f88070171f5c2bbac23 |
| SHA1 | b41683564c45eb468151930b48b9c4cbacc54102 |
| SHA256 | 5dc1e01dd63185d7211f74c08873bf19a148d65b9643b71818ffbabfb7d26679 |
| SHA512 | 11df3ee8a3e19d7b206aeb3126cbddc2dbc5638999442ffbbcdd916303201298236365769a98ad4966c0e22d5f591e69f9c014f1e757269a94e5edac9422b6aa |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe
| MD5 | 4a52f5ac63c258eb43a31d19c1ef0f10 |
| SHA1 | e234ac66b801fe1be51c144206a811809b2b53ef |
| SHA256 | 45c201511196955b077ff6d298ab9d6f10cc394dfa6f91a746d10246db41ab00 |
| SHA512 | 15c2c18b9b19fdbd6744b81687f92263114a363b1cc32af2483676ab465c4a9f4eac35553212f331808744c7abb159b25b521556ec5a5b766b468f93d6fbcbc7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe
| MD5 | 4a52f5ac63c258eb43a31d19c1ef0f10 |
| SHA1 | e234ac66b801fe1be51c144206a811809b2b53ef |
| SHA256 | 45c201511196955b077ff6d298ab9d6f10cc394dfa6f91a746d10246db41ab00 |
| SHA512 | 15c2c18b9b19fdbd6744b81687f92263114a363b1cc32af2483676ab465c4a9f4eac35553212f331808744c7abb159b25b521556ec5a5b766b468f93d6fbcbc7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe
| MD5 | 4a52f5ac63c258eb43a31d19c1ef0f10 |
| SHA1 | e234ac66b801fe1be51c144206a811809b2b53ef |
| SHA256 | 45c201511196955b077ff6d298ab9d6f10cc394dfa6f91a746d10246db41ab00 |
| SHA512 | 15c2c18b9b19fdbd6744b81687f92263114a363b1cc32af2483676ab465c4a9f4eac35553212f331808744c7abb159b25b521556ec5a5b766b468f93d6fbcbc7 |
memory/2700-48-0x000007FEF5820000-0x000007FEF620C000-memory.dmp
memory/2700-49-0x00000000010D0000-0x00000000010DA000-memory.dmp
memory/2700-50-0x000007FEF5820000-0x000007FEF620C000-memory.dmp
memory/2700-51-0x000007FEF5820000-0x000007FEF620C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
memory/1060-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1060-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1060-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1060-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1060-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1060-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1060-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1060-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/1060-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1060-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:39
Reported
2023-10-10 21:02
Platform
win10v2004-20230915-en
Max time kernel
167s
Max time network
182s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9299257.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0993207.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\30e97175b73dfa9fc7f7bfc860ad611497f68282985eb156dc05abdbed29e5fb.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4052 set thread context of 3060 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4060 set thread context of 3248 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0081795.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\30e97175b73dfa9fc7f7bfc860ad611497f68282985eb156dc05abdbed29e5fb.exe
"C:\Users\Admin\AppData\Local\Temp\30e97175b73dfa9fc7f7bfc860ad611497f68282985eb156dc05abdbed29e5fb.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4052 -ip 4052
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3060 -ip 3060
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 548
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 148
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0081795.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0081795.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4060 -ip 4060
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 156
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9299257.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9299257.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0993207.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0993207.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8096006.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8096006.exe
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.111.26.67.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 85.65.42.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
| MD5 | 82b4fe1f088b6e6cdd8b49d401b48fb8 |
| SHA1 | d05c98139e0f05e3c7427161371db99fa327da38 |
| SHA256 | a2b621b07d5760b49ab0de190deb3941c0b27ab9cb5467c378c3c2417559e0a3 |
| SHA512 | 4dcd75035255bd32b67a6259ab1204876fed482fb9cb91ff2a88536cc829867903898498d44acaa5a2800902cc1348d1c237e7027323045cdb4ccc37afaea786 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9148291.exe
| MD5 | 82b4fe1f088b6e6cdd8b49d401b48fb8 |
| SHA1 | d05c98139e0f05e3c7427161371db99fa327da38 |
| SHA256 | a2b621b07d5760b49ab0de190deb3941c0b27ab9cb5467c378c3c2417559e0a3 |
| SHA512 | 4dcd75035255bd32b67a6259ab1204876fed482fb9cb91ff2a88536cc829867903898498d44acaa5a2800902cc1348d1c237e7027323045cdb4ccc37afaea786 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
| MD5 | 3dcf1e14d835ba935f3631c6df3f9db5 |
| SHA1 | 1fd3050fb9aee9442751270e21300c29ede5491e |
| SHA256 | 801ae89e10f3f68c1e75b25f17f55fc09c12149bd4b86da87b069c8a8e87e45c |
| SHA512 | 50cd6bf00c04fc7bed7fee6e78294860ec46ca80ae33de167b4c19278c12ad312a0b4e863b3abaf0c0a7a63d231d1ab366ea6ea0bc8a797b028f5a80333f40ba |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4972885.exe
| MD5 | 3dcf1e14d835ba935f3631c6df3f9db5 |
| SHA1 | 1fd3050fb9aee9442751270e21300c29ede5491e |
| SHA256 | 801ae89e10f3f68c1e75b25f17f55fc09c12149bd4b86da87b069c8a8e87e45c |
| SHA512 | 50cd6bf00c04fc7bed7fee6e78294860ec46ca80ae33de167b4c19278c12ad312a0b4e863b3abaf0c0a7a63d231d1ab366ea6ea0bc8a797b028f5a80333f40ba |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
| MD5 | 792555cf29e18157fd562a662d628058 |
| SHA1 | d692d89cda193935d24725849ae10e1c63c6fa7e |
| SHA256 | 28143958eb06b508c13a3bab913ba6aa2e4e5b88a4117439e106c344a3b6600f |
| SHA512 | 2def2b3bbd3454a0ea51b84b7d724346043cc0701c84ba5a2969614ec6e75bc67c837886753c5147b1979d7c689dc7186b9d3d1d1b17814546e5ebfdfe2b52bc |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4041887.exe
| MD5 | 792555cf29e18157fd562a662d628058 |
| SHA1 | d692d89cda193935d24725849ae10e1c63c6fa7e |
| SHA256 | 28143958eb06b508c13a3bab913ba6aa2e4e5b88a4117439e106c344a3b6600f |
| SHA512 | 2def2b3bbd3454a0ea51b84b7d724346043cc0701c84ba5a2969614ec6e75bc67c837886753c5147b1979d7c689dc7186b9d3d1d1b17814546e5ebfdfe2b52bc |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
| MD5 | 0f45221e9f6d0f88070171f5c2bbac23 |
| SHA1 | b41683564c45eb468151930b48b9c4cbacc54102 |
| SHA256 | 5dc1e01dd63185d7211f74c08873bf19a148d65b9643b71818ffbabfb7d26679 |
| SHA512 | 11df3ee8a3e19d7b206aeb3126cbddc2dbc5638999442ffbbcdd916303201298236365769a98ad4966c0e22d5f591e69f9c014f1e757269a94e5edac9422b6aa |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9051686.exe
| MD5 | 0f45221e9f6d0f88070171f5c2bbac23 |
| SHA1 | b41683564c45eb468151930b48b9c4cbacc54102 |
| SHA256 | 5dc1e01dd63185d7211f74c08873bf19a148d65b9643b71818ffbabfb7d26679 |
| SHA512 | 11df3ee8a3e19d7b206aeb3126cbddc2dbc5638999442ffbbcdd916303201298236365769a98ad4966c0e22d5f591e69f9c014f1e757269a94e5edac9422b6aa |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe
| MD5 | 4a52f5ac63c258eb43a31d19c1ef0f10 |
| SHA1 | e234ac66b801fe1be51c144206a811809b2b53ef |
| SHA256 | 45c201511196955b077ff6d298ab9d6f10cc394dfa6f91a746d10246db41ab00 |
| SHA512 | 15c2c18b9b19fdbd6744b81687f92263114a363b1cc32af2483676ab465c4a9f4eac35553212f331808744c7abb159b25b521556ec5a5b766b468f93d6fbcbc7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7787435.exe
| MD5 | 4a52f5ac63c258eb43a31d19c1ef0f10 |
| SHA1 | e234ac66b801fe1be51c144206a811809b2b53ef |
| SHA256 | 45c201511196955b077ff6d298ab9d6f10cc394dfa6f91a746d10246db41ab00 |
| SHA512 | 15c2c18b9b19fdbd6744b81687f92263114a363b1cc32af2483676ab465c4a9f4eac35553212f331808744c7abb159b25b521556ec5a5b766b468f93d6fbcbc7 |
memory/1176-35-0x0000000000CA0000-0x0000000000CAA000-memory.dmp
memory/1176-36-0x00007FFFC0E70000-0x00007FFFC1931000-memory.dmp
memory/1176-37-0x00007FFFC0E70000-0x00007FFFC1931000-memory.dmp
memory/1176-39-0x00007FFFC0E70000-0x00007FFFC1931000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6917036.exe
| MD5 | 08b24c76f4fe37ced6a6fce2447588a2 |
| SHA1 | d7488908c169e4c39c09287a26331ba1dc0e6c94 |
| SHA256 | 33792e48ccc2e8ed71f0439029b7cd2b9b91899badb0953ef66f0b16d63b185f |
| SHA512 | 4e38a08185bc6b72eca1a0b151e3cc6bb4f1b6fa6ef1f4e0754934ca382e2de9784fea7524a3578356f02fd67fffdba96005415e0954d4eecfce9045e667576a |
memory/3060-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3060-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3060-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3060-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0081795.exe
| MD5 | c3fa36db4880f3b70129aa6b813434ba |
| SHA1 | cf214706891f49e868834e16fdb9fb2cf4e3513e |
| SHA256 | 3d38aa2051db11d5d2305f90695c87fdd5d7cdb73a8beb776cf4941040315789 |
| SHA512 | aa8a27092f079c5f9970da195c1985f40cbfa71522d55fddd8949933d129a6454b5fdc3d81612a599d2f831f6256d61e38834df57c0066c2ab6d903f37d2c982 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0081795.exe
| MD5 | c3fa36db4880f3b70129aa6b813434ba |
| SHA1 | cf214706891f49e868834e16fdb9fb2cf4e3513e |
| SHA256 | 3d38aa2051db11d5d2305f90695c87fdd5d7cdb73a8beb776cf4941040315789 |
| SHA512 | aa8a27092f079c5f9970da195c1985f40cbfa71522d55fddd8949933d129a6454b5fdc3d81612a599d2f831f6256d61e38834df57c0066c2ab6d903f37d2c982 |
memory/3248-51-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3248-52-0x00000000739A0000-0x0000000074150000-memory.dmp
memory/3248-53-0x0000000004D40000-0x0000000004D46000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9299257.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9299257.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/3248-63-0x0000000005400000-0x0000000005A18000-memory.dmp
memory/3248-64-0x0000000004EF0000-0x0000000004FFA000-memory.dmp
memory/3248-65-0x0000000004DE0000-0x0000000004DF2000-memory.dmp
memory/3248-66-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/3248-67-0x0000000004E40000-0x0000000004E7C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0993207.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0993207.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/3248-74-0x0000000004E90000-0x0000000004EDC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8096006.exe
| MD5 | b86d2d6c7c7a0c148881fe6a2a2d83e7 |
| SHA1 | 739ef02d7d6faf771a51c99ad3cd6b9270839a33 |
| SHA256 | 8719067d2c3ff5bed3f708c745ab4e97d15765c985720e5b02fec41950cd7d43 |
| SHA512 | cf3668db2370dfee685709f65b0f832813c5054f1b914069c4cc1e8bb254715fba292860567d7f46814442ad317a9da5ae2497244edadbca93d7d3ebb1bf8e06 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8096006.exe
| MD5 | b86d2d6c7c7a0c148881fe6a2a2d83e7 |
| SHA1 | 739ef02d7d6faf771a51c99ad3cd6b9270839a33 |
| SHA256 | 8719067d2c3ff5bed3f708c745ab4e97d15765c985720e5b02fec41950cd7d43 |
| SHA512 | cf3668db2370dfee685709f65b0f832813c5054f1b914069c4cc1e8bb254715fba292860567d7f46814442ad317a9da5ae2497244edadbca93d7d3ebb1bf8e06 |
memory/3248-87-0x00000000739A0000-0x0000000074150000-memory.dmp
memory/3248-88-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |