Analysis Overview
SHA256
07d1295ab60e1d305e62340d32a1e36bf48e3fc7bb029bc1ca72f4da91688f6a
Threat Level: Known bad
The file 07d1295ab60e1d305e62340d32a1e36bf48e3fc7bb029bc1ca72f4da91688f6a was found to be: Known bad.
Malicious Activity Summary
RedLine
Modifies Windows Defender Real-time Protection settings
Healer
Detect Mystic stealer payload
Detects Healer an antivirus disabler dropper
Mystic
Amadey
Checks computer location settings
Loads dropped DLL
Windows security modification
Executes dropped EXE
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
Enumerates physical storage devices
Program crash
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:49
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:49
Reported
2023-10-10 21:22
Platform
win7-20230831-en
Max time kernel
170s
Max time network
143s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\07d1295ab60e1d305e62340d32a1e36bf48e3fc7bb029bc1ca72f4da91688f6a.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1668 set thread context of 808 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\07d1295ab60e1d305e62340d32a1e36bf48e3fc7bb029bc1ca72f4da91688f6a.exe
"C:\Users\Admin\AppData\Local\Temp\07d1295ab60e1d305e62340d32a1e36bf48e3fc7bb029bc1ca72f4da91688f6a.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 268
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 36
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
| MD5 | 765198a5f853cb7d58905bc74053edc4 |
| SHA1 | 2552983714e66e6e4e6800c3f9da9a0c41e5b34e |
| SHA256 | d76beff24148666cf3ea62d4c452ae7d141546a938ad2f65e5bb8fded8ea9750 |
| SHA512 | 2c357454f69d8129ed38d8efc11e51f04b347ea00f182e7e247a3dd4b88fbcd4c9150149906fddd6949f8ee8d70dc2fbc3e9e40e596dda4494edd534e3de02be |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
| MD5 | 765198a5f853cb7d58905bc74053edc4 |
| SHA1 | 2552983714e66e6e4e6800c3f9da9a0c41e5b34e |
| SHA256 | d76beff24148666cf3ea62d4c452ae7d141546a938ad2f65e5bb8fded8ea9750 |
| SHA512 | 2c357454f69d8129ed38d8efc11e51f04b347ea00f182e7e247a3dd4b88fbcd4c9150149906fddd6949f8ee8d70dc2fbc3e9e40e596dda4494edd534e3de02be |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
| MD5 | 765198a5f853cb7d58905bc74053edc4 |
| SHA1 | 2552983714e66e6e4e6800c3f9da9a0c41e5b34e |
| SHA256 | d76beff24148666cf3ea62d4c452ae7d141546a938ad2f65e5bb8fded8ea9750 |
| SHA512 | 2c357454f69d8129ed38d8efc11e51f04b347ea00f182e7e247a3dd4b88fbcd4c9150149906fddd6949f8ee8d70dc2fbc3e9e40e596dda4494edd534e3de02be |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
| MD5 | 765198a5f853cb7d58905bc74053edc4 |
| SHA1 | 2552983714e66e6e4e6800c3f9da9a0c41e5b34e |
| SHA256 | d76beff24148666cf3ea62d4c452ae7d141546a938ad2f65e5bb8fded8ea9750 |
| SHA512 | 2c357454f69d8129ed38d8efc11e51f04b347ea00f182e7e247a3dd4b88fbcd4c9150149906fddd6949f8ee8d70dc2fbc3e9e40e596dda4494edd534e3de02be |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
| MD5 | 1a964872f6b46f2acc376abf4ec5117c |
| SHA1 | 9afd7b11efb789e77f127f4312362eb0b14e607c |
| SHA256 | 747122cb5ccc873030121e9c0773057d60d8d53fb59dc0d13234c80bfa05a2e5 |
| SHA512 | c655aa2f1678abd42d00000e860de56e91d5016c16108b8396948e8c01946c8cd8efc3514d4c5898adf52e60bda90f17d1fc6456ea9cd436773783eeb4a6161e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
| MD5 | 1a964872f6b46f2acc376abf4ec5117c |
| SHA1 | 9afd7b11efb789e77f127f4312362eb0b14e607c |
| SHA256 | 747122cb5ccc873030121e9c0773057d60d8d53fb59dc0d13234c80bfa05a2e5 |
| SHA512 | c655aa2f1678abd42d00000e860de56e91d5016c16108b8396948e8c01946c8cd8efc3514d4c5898adf52e60bda90f17d1fc6456ea9cd436773783eeb4a6161e |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
| MD5 | 1a964872f6b46f2acc376abf4ec5117c |
| SHA1 | 9afd7b11efb789e77f127f4312362eb0b14e607c |
| SHA256 | 747122cb5ccc873030121e9c0773057d60d8d53fb59dc0d13234c80bfa05a2e5 |
| SHA512 | c655aa2f1678abd42d00000e860de56e91d5016c16108b8396948e8c01946c8cd8efc3514d4c5898adf52e60bda90f17d1fc6456ea9cd436773783eeb4a6161e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
| MD5 | 1a964872f6b46f2acc376abf4ec5117c |
| SHA1 | 9afd7b11efb789e77f127f4312362eb0b14e607c |
| SHA256 | 747122cb5ccc873030121e9c0773057d60d8d53fb59dc0d13234c80bfa05a2e5 |
| SHA512 | c655aa2f1678abd42d00000e860de56e91d5016c16108b8396948e8c01946c8cd8efc3514d4c5898adf52e60bda90f17d1fc6456ea9cd436773783eeb4a6161e |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
| MD5 | 5603c4f3340b43d0a837f944e30d080d |
| SHA1 | 93d3c22bc663404c6d38e0bb224e8def0ca8fdf4 |
| SHA256 | 248dcdf14362cd2c99243a14170a65b3babd8f3e071dc5cbabdfbe08097c6779 |
| SHA512 | ea3fb64d4921baef15927681341cc04f15895c8002362a083d6c4a357e47de926bf808ee4039b4dce62472ef97f7fdcf03e50e3c54c4dd8ea3232b254e71e354 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
| MD5 | 5603c4f3340b43d0a837f944e30d080d |
| SHA1 | 93d3c22bc663404c6d38e0bb224e8def0ca8fdf4 |
| SHA256 | 248dcdf14362cd2c99243a14170a65b3babd8f3e071dc5cbabdfbe08097c6779 |
| SHA512 | ea3fb64d4921baef15927681341cc04f15895c8002362a083d6c4a357e47de926bf808ee4039b4dce62472ef97f7fdcf03e50e3c54c4dd8ea3232b254e71e354 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
| MD5 | 5603c4f3340b43d0a837f944e30d080d |
| SHA1 | 93d3c22bc663404c6d38e0bb224e8def0ca8fdf4 |
| SHA256 | 248dcdf14362cd2c99243a14170a65b3babd8f3e071dc5cbabdfbe08097c6779 |
| SHA512 | ea3fb64d4921baef15927681341cc04f15895c8002362a083d6c4a357e47de926bf808ee4039b4dce62472ef97f7fdcf03e50e3c54c4dd8ea3232b254e71e354 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
| MD5 | 5603c4f3340b43d0a837f944e30d080d |
| SHA1 | 93d3c22bc663404c6d38e0bb224e8def0ca8fdf4 |
| SHA256 | 248dcdf14362cd2c99243a14170a65b3babd8f3e071dc5cbabdfbe08097c6779 |
| SHA512 | ea3fb64d4921baef15927681341cc04f15895c8002362a083d6c4a357e47de926bf808ee4039b4dce62472ef97f7fdcf03e50e3c54c4dd8ea3232b254e71e354 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
| MD5 | a9d453b0a5c3f4111748d246dfa61977 |
| SHA1 | 44d7fcee00dd60c508a57d83d2c6da5ce846bb68 |
| SHA256 | cd4166663f5e9b7df50927e5a5884dbff1a767c20208c933b6195ca19aeddccb |
| SHA512 | 89afa9a117d6b017c677bef3955b15666ceb2ac4d087399d634300e69bcddcce96f918224ba628d01c34d3918a21729ec684ed82364c3d2c8ee5a61c3602c2ce |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
| MD5 | a9d453b0a5c3f4111748d246dfa61977 |
| SHA1 | 44d7fcee00dd60c508a57d83d2c6da5ce846bb68 |
| SHA256 | cd4166663f5e9b7df50927e5a5884dbff1a767c20208c933b6195ca19aeddccb |
| SHA512 | 89afa9a117d6b017c677bef3955b15666ceb2ac4d087399d634300e69bcddcce96f918224ba628d01c34d3918a21729ec684ed82364c3d2c8ee5a61c3602c2ce |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
| MD5 | a9d453b0a5c3f4111748d246dfa61977 |
| SHA1 | 44d7fcee00dd60c508a57d83d2c6da5ce846bb68 |
| SHA256 | cd4166663f5e9b7df50927e5a5884dbff1a767c20208c933b6195ca19aeddccb |
| SHA512 | 89afa9a117d6b017c677bef3955b15666ceb2ac4d087399d634300e69bcddcce96f918224ba628d01c34d3918a21729ec684ed82364c3d2c8ee5a61c3602c2ce |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
| MD5 | a9d453b0a5c3f4111748d246dfa61977 |
| SHA1 | 44d7fcee00dd60c508a57d83d2c6da5ce846bb68 |
| SHA256 | cd4166663f5e9b7df50927e5a5884dbff1a767c20208c933b6195ca19aeddccb |
| SHA512 | 89afa9a117d6b017c677bef3955b15666ceb2ac4d087399d634300e69bcddcce96f918224ba628d01c34d3918a21729ec684ed82364c3d2c8ee5a61c3602c2ce |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe
| MD5 | 5007ce0284ee653d3b72ec1cd89d4815 |
| SHA1 | c6f03471024b2d6e56efdcb4a25b98b34594b6de |
| SHA256 | 4ceefdd9cf4339e431ae0ccefb44a89869568bf36ded382be9242de23d329ecf |
| SHA512 | a4b5c5c5c3dfa4835ff98175743e2350d937bd3a7df276752dfe3931a1e2e1f2c63a07fc944065252465db6c9767a08ea8bb397aee4e8bc7219c99a296f7e346 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe
| MD5 | 5007ce0284ee653d3b72ec1cd89d4815 |
| SHA1 | c6f03471024b2d6e56efdcb4a25b98b34594b6de |
| SHA256 | 4ceefdd9cf4339e431ae0ccefb44a89869568bf36ded382be9242de23d329ecf |
| SHA512 | a4b5c5c5c3dfa4835ff98175743e2350d937bd3a7df276752dfe3931a1e2e1f2c63a07fc944065252465db6c9767a08ea8bb397aee4e8bc7219c99a296f7e346 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe
| MD5 | 5007ce0284ee653d3b72ec1cd89d4815 |
| SHA1 | c6f03471024b2d6e56efdcb4a25b98b34594b6de |
| SHA256 | 4ceefdd9cf4339e431ae0ccefb44a89869568bf36ded382be9242de23d329ecf |
| SHA512 | a4b5c5c5c3dfa4835ff98175743e2350d937bd3a7df276752dfe3931a1e2e1f2c63a07fc944065252465db6c9767a08ea8bb397aee4e8bc7219c99a296f7e346 |
memory/2552-48-0x000007FEF5740000-0x000007FEF612C000-memory.dmp
memory/2552-49-0x0000000001200000-0x000000000120A000-memory.dmp
memory/2552-50-0x000007FEF5740000-0x000007FEF612C000-memory.dmp
memory/2552-51-0x000007FEF5740000-0x000007FEF612C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
memory/808-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/808-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/808-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/808-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/808-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/808-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/808-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/808-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/808-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/808-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:49
Reported
2023-10-10 21:21
Platform
win10v2004-20230915-en
Max time kernel
164s
Max time network
175s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2802966.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1454730.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\07d1295ab60e1d305e62340d32a1e36bf48e3fc7bb029bc1ca72f4da91688f6a.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1736 set thread context of 468 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3096 set thread context of 3620 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0593180.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\07d1295ab60e1d305e62340d32a1e36bf48e3fc7bb029bc1ca72f4da91688f6a.exe
"C:\Users\Admin\AppData\Local\Temp\07d1295ab60e1d305e62340d32a1e36bf48e3fc7bb029bc1ca72f4da91688f6a.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1736 -ip 1736
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 468 -ip 468
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 264
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0593180.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0593180.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3096 -ip 3096
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2802966.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2802966.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1454730.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1454730.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3066547.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3066547.exe
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.120.234.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.209.247.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 15.173.189.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
| MD5 | 765198a5f853cb7d58905bc74053edc4 |
| SHA1 | 2552983714e66e6e4e6800c3f9da9a0c41e5b34e |
| SHA256 | d76beff24148666cf3ea62d4c452ae7d141546a938ad2f65e5bb8fded8ea9750 |
| SHA512 | 2c357454f69d8129ed38d8efc11e51f04b347ea00f182e7e247a3dd4b88fbcd4c9150149906fddd6949f8ee8d70dc2fbc3e9e40e596dda4494edd534e3de02be |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2686827.exe
| MD5 | 765198a5f853cb7d58905bc74053edc4 |
| SHA1 | 2552983714e66e6e4e6800c3f9da9a0c41e5b34e |
| SHA256 | d76beff24148666cf3ea62d4c452ae7d141546a938ad2f65e5bb8fded8ea9750 |
| SHA512 | 2c357454f69d8129ed38d8efc11e51f04b347ea00f182e7e247a3dd4b88fbcd4c9150149906fddd6949f8ee8d70dc2fbc3e9e40e596dda4494edd534e3de02be |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
| MD5 | 1a964872f6b46f2acc376abf4ec5117c |
| SHA1 | 9afd7b11efb789e77f127f4312362eb0b14e607c |
| SHA256 | 747122cb5ccc873030121e9c0773057d60d8d53fb59dc0d13234c80bfa05a2e5 |
| SHA512 | c655aa2f1678abd42d00000e860de56e91d5016c16108b8396948e8c01946c8cd8efc3514d4c5898adf52e60bda90f17d1fc6456ea9cd436773783eeb4a6161e |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3170756.exe
| MD5 | 1a964872f6b46f2acc376abf4ec5117c |
| SHA1 | 9afd7b11efb789e77f127f4312362eb0b14e607c |
| SHA256 | 747122cb5ccc873030121e9c0773057d60d8d53fb59dc0d13234c80bfa05a2e5 |
| SHA512 | c655aa2f1678abd42d00000e860de56e91d5016c16108b8396948e8c01946c8cd8efc3514d4c5898adf52e60bda90f17d1fc6456ea9cd436773783eeb4a6161e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
| MD5 | 5603c4f3340b43d0a837f944e30d080d |
| SHA1 | 93d3c22bc663404c6d38e0bb224e8def0ca8fdf4 |
| SHA256 | 248dcdf14362cd2c99243a14170a65b3babd8f3e071dc5cbabdfbe08097c6779 |
| SHA512 | ea3fb64d4921baef15927681341cc04f15895c8002362a083d6c4a357e47de926bf808ee4039b4dce62472ef97f7fdcf03e50e3c54c4dd8ea3232b254e71e354 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6853173.exe
| MD5 | 5603c4f3340b43d0a837f944e30d080d |
| SHA1 | 93d3c22bc663404c6d38e0bb224e8def0ca8fdf4 |
| SHA256 | 248dcdf14362cd2c99243a14170a65b3babd8f3e071dc5cbabdfbe08097c6779 |
| SHA512 | ea3fb64d4921baef15927681341cc04f15895c8002362a083d6c4a357e47de926bf808ee4039b4dce62472ef97f7fdcf03e50e3c54c4dd8ea3232b254e71e354 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
| MD5 | a9d453b0a5c3f4111748d246dfa61977 |
| SHA1 | 44d7fcee00dd60c508a57d83d2c6da5ce846bb68 |
| SHA256 | cd4166663f5e9b7df50927e5a5884dbff1a767c20208c933b6195ca19aeddccb |
| SHA512 | 89afa9a117d6b017c677bef3955b15666ceb2ac4d087399d634300e69bcddcce96f918224ba628d01c34d3918a21729ec684ed82364c3d2c8ee5a61c3602c2ce |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1496353.exe
| MD5 | a9d453b0a5c3f4111748d246dfa61977 |
| SHA1 | 44d7fcee00dd60c508a57d83d2c6da5ce846bb68 |
| SHA256 | cd4166663f5e9b7df50927e5a5884dbff1a767c20208c933b6195ca19aeddccb |
| SHA512 | 89afa9a117d6b017c677bef3955b15666ceb2ac4d087399d634300e69bcddcce96f918224ba628d01c34d3918a21729ec684ed82364c3d2c8ee5a61c3602c2ce |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe
| MD5 | 5007ce0284ee653d3b72ec1cd89d4815 |
| SHA1 | c6f03471024b2d6e56efdcb4a25b98b34594b6de |
| SHA256 | 4ceefdd9cf4339e431ae0ccefb44a89869568bf36ded382be9242de23d329ecf |
| SHA512 | a4b5c5c5c3dfa4835ff98175743e2350d937bd3a7df276752dfe3931a1e2e1f2c63a07fc944065252465db6c9767a08ea8bb397aee4e8bc7219c99a296f7e346 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5120931.exe
| MD5 | 5007ce0284ee653d3b72ec1cd89d4815 |
| SHA1 | c6f03471024b2d6e56efdcb4a25b98b34594b6de |
| SHA256 | 4ceefdd9cf4339e431ae0ccefb44a89869568bf36ded382be9242de23d329ecf |
| SHA512 | a4b5c5c5c3dfa4835ff98175743e2350d937bd3a7df276752dfe3931a1e2e1f2c63a07fc944065252465db6c9767a08ea8bb397aee4e8bc7219c99a296f7e346 |
memory/4396-35-0x00000000001E0000-0x00000000001EA000-memory.dmp
memory/4396-36-0x00007FFA9FA60000-0x00007FFAA0521000-memory.dmp
memory/4396-38-0x00007FFA9FA60000-0x00007FFAA0521000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7623322.exe
| MD5 | d3b175833cb8bcd898790721191cdb00 |
| SHA1 | bc13c584d1a4dd44c870a7f26ffd76a45903dd1e |
| SHA256 | f4a4da8b5c8d23e7c4b9da82df00f8c4a175d4fa46de22e460e3dd27efbf38f7 |
| SHA512 | f46496a3087bec7892423ec60f4189a9875bc6b551b6818146e6db4b4bb08e15333ece9fc0ad12521a1ee9be156610b09a1f051c944854daf9283c2e9d2f88a5 |
memory/468-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/468-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/468-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/468-46-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0593180.exe
| MD5 | fe75c067452b965aa3c620c6d833d40f |
| SHA1 | 8eaa08303403e901caab4ef37c47dc6258d33328 |
| SHA256 | 66c1cc290bebc5cbc74263f93b758177d3aadacbc08efad3a7ab2a7fba6871cf |
| SHA512 | bd23d2fef5fde8e8dda914c96ef146e8e11c8d94bfa5a475bd2b09d8bd0d5aedc4aca2afb4022bf09d4d14005a00be8e3376da6add7480b2c78ee46ee6ca6e9a |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0593180.exe
| MD5 | fe75c067452b965aa3c620c6d833d40f |
| SHA1 | 8eaa08303403e901caab4ef37c47dc6258d33328 |
| SHA256 | 66c1cc290bebc5cbc74263f93b758177d3aadacbc08efad3a7ab2a7fba6871cf |
| SHA512 | bd23d2fef5fde8e8dda914c96ef146e8e11c8d94bfa5a475bd2b09d8bd0d5aedc4aca2afb4022bf09d4d14005a00be8e3376da6add7480b2c78ee46ee6ca6e9a |
memory/3620-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3620-51-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3620-52-0x00000000032A0000-0x00000000032A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2802966.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2802966.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/3620-58-0x000000000B430000-0x000000000BA48000-memory.dmp
memory/3620-60-0x000000000AF70000-0x000000000B07A000-memory.dmp
memory/3620-62-0x000000000AEA0000-0x000000000AEB2000-memory.dmp
memory/3620-61-0x0000000005980000-0x0000000005990000-memory.dmp
memory/3620-66-0x000000000AF00000-0x000000000AF3C000-memory.dmp
memory/3620-67-0x000000000B080000-0x000000000B0CC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1454730.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1454730.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3066547.exe
| MD5 | ea220c580106331be09474c85c88778c |
| SHA1 | c6df6b54d31a22af9aec25880a67320ce2841798 |
| SHA256 | 81eeb1375137f150a51077e67a26e8b719219a90c9268a69ebca8cfea9e8c21c |
| SHA512 | 9e7a800eda71becbe59a09a00b7044c58bd14e0e4173bc85340c2632c89a3d65cb326b3a10b6b0d1b6bc0ba61977e057fa2e5181a0dafa9a43a87ac0acbc8ee3 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3066547.exe
| MD5 | ea220c580106331be09474c85c88778c |
| SHA1 | c6df6b54d31a22af9aec25880a67320ce2841798 |
| SHA256 | 81eeb1375137f150a51077e67a26e8b719219a90c9268a69ebca8cfea9e8c21c |
| SHA512 | 9e7a800eda71becbe59a09a00b7044c58bd14e0e4173bc85340c2632c89a3d65cb326b3a10b6b0d1b6bc0ba61977e057fa2e5181a0dafa9a43a87ac0acbc8ee3 |
memory/3620-86-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/3620-87-0x0000000005980000-0x0000000005990000-memory.dmp
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |