Analysis Overview
SHA256
3d12fbf585a0733ca8693b5655849f93fc149728456c3d32736d79241b5f0c18
Threat Level: Known bad
The file 3d12fbf585a0733ca8693b5655849f93fc149728456c3d32736d79241b5f0c18 was found to be: Known bad.
Malicious Activity Summary
Healer
Detects Healer an antivirus disabler dropper
Mystic
Modifies Windows Defender Real-time Protection settings
Amadey
RedLine
Detect Mystic stealer payload
Executes dropped EXE
Windows security modification
Loads dropped DLL
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Program crash
Unsigned PE
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:47
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:47
Reported
2023-10-10 21:20
Platform
win7-20230831-en
Max time kernel
121s
Max time network
151s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\3d12fbf585a0733ca8693b5655849f93fc149728456c3d32736d79241b5f0c18.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2736 set thread context of 1760 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\3d12fbf585a0733ca8693b5655849f93fc149728456c3d32736d79241b5f0c18.exe
"C:\Users\Admin\AppData\Local\Temp\3d12fbf585a0733ca8693b5655849f93fc149728456c3d32736d79241b5f0c18.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 300
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
| MD5 | 041414c5a1d119fcf4923e8c130d85b6 |
| SHA1 | 4ea3345e617316511d160e8f845239e878e56437 |
| SHA256 | c0eb10eb530df227c0a26d5f6ae464915516bad54a9f2fd3adad7935b9645043 |
| SHA512 | aba6beb5799121eaa5e6c7dd9e847cc17913b04a62eebc81264b8acd50b063566c3c1b0adb128843029ef7278bf7e7e5ed8d1198d8376d4f0137398dec78e0e8 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
| MD5 | 041414c5a1d119fcf4923e8c130d85b6 |
| SHA1 | 4ea3345e617316511d160e8f845239e878e56437 |
| SHA256 | c0eb10eb530df227c0a26d5f6ae464915516bad54a9f2fd3adad7935b9645043 |
| SHA512 | aba6beb5799121eaa5e6c7dd9e847cc17913b04a62eebc81264b8acd50b063566c3c1b0adb128843029ef7278bf7e7e5ed8d1198d8376d4f0137398dec78e0e8 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
| MD5 | 041414c5a1d119fcf4923e8c130d85b6 |
| SHA1 | 4ea3345e617316511d160e8f845239e878e56437 |
| SHA256 | c0eb10eb530df227c0a26d5f6ae464915516bad54a9f2fd3adad7935b9645043 |
| SHA512 | aba6beb5799121eaa5e6c7dd9e847cc17913b04a62eebc81264b8acd50b063566c3c1b0adb128843029ef7278bf7e7e5ed8d1198d8376d4f0137398dec78e0e8 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
| MD5 | 041414c5a1d119fcf4923e8c130d85b6 |
| SHA1 | 4ea3345e617316511d160e8f845239e878e56437 |
| SHA256 | c0eb10eb530df227c0a26d5f6ae464915516bad54a9f2fd3adad7935b9645043 |
| SHA512 | aba6beb5799121eaa5e6c7dd9e847cc17913b04a62eebc81264b8acd50b063566c3c1b0adb128843029ef7278bf7e7e5ed8d1198d8376d4f0137398dec78e0e8 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
| MD5 | c178919274cba2e13b16aa35030d3386 |
| SHA1 | 3b650fa54d57bd565ddff45ae4a6e9af75b61d55 |
| SHA256 | 6804e4fa95daf6aa6bbd0cb79559bdc58e693772d3d22deba3b512a9b6b17bc0 |
| SHA512 | 9c9cb22e77f1548627b3b4a5c716a1805c63823f0966063ebcb9d4eb26bf88c2d20c337769c68c6ff06bd402d753a53868d6864e197dfe06319d98cce8187a85 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
| MD5 | c178919274cba2e13b16aa35030d3386 |
| SHA1 | 3b650fa54d57bd565ddff45ae4a6e9af75b61d55 |
| SHA256 | 6804e4fa95daf6aa6bbd0cb79559bdc58e693772d3d22deba3b512a9b6b17bc0 |
| SHA512 | 9c9cb22e77f1548627b3b4a5c716a1805c63823f0966063ebcb9d4eb26bf88c2d20c337769c68c6ff06bd402d753a53868d6864e197dfe06319d98cce8187a85 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
| MD5 | c178919274cba2e13b16aa35030d3386 |
| SHA1 | 3b650fa54d57bd565ddff45ae4a6e9af75b61d55 |
| SHA256 | 6804e4fa95daf6aa6bbd0cb79559bdc58e693772d3d22deba3b512a9b6b17bc0 |
| SHA512 | 9c9cb22e77f1548627b3b4a5c716a1805c63823f0966063ebcb9d4eb26bf88c2d20c337769c68c6ff06bd402d753a53868d6864e197dfe06319d98cce8187a85 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
| MD5 | c178919274cba2e13b16aa35030d3386 |
| SHA1 | 3b650fa54d57bd565ddff45ae4a6e9af75b61d55 |
| SHA256 | 6804e4fa95daf6aa6bbd0cb79559bdc58e693772d3d22deba3b512a9b6b17bc0 |
| SHA512 | 9c9cb22e77f1548627b3b4a5c716a1805c63823f0966063ebcb9d4eb26bf88c2d20c337769c68c6ff06bd402d753a53868d6864e197dfe06319d98cce8187a85 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
| MD5 | 4e4a59f3a0309818b954da4d101f65b3 |
| SHA1 | a79a7f0e57a5ff63520d3fe4ea83e278db29e754 |
| SHA256 | 0198a93584a90e886b2f7fe7e78a3c323377f2d2301aecb0f81e39c261beba06 |
| SHA512 | 3795411ce169fecb761b09be8cf9a0192ee37f6c16dc9efdaf4d11485defda9073bf29f334ceb8218b2e4d6be00573d10997495246b431d489ee773268319b45 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
| MD5 | 4e4a59f3a0309818b954da4d101f65b3 |
| SHA1 | a79a7f0e57a5ff63520d3fe4ea83e278db29e754 |
| SHA256 | 0198a93584a90e886b2f7fe7e78a3c323377f2d2301aecb0f81e39c261beba06 |
| SHA512 | 3795411ce169fecb761b09be8cf9a0192ee37f6c16dc9efdaf4d11485defda9073bf29f334ceb8218b2e4d6be00573d10997495246b431d489ee773268319b45 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
| MD5 | 4e4a59f3a0309818b954da4d101f65b3 |
| SHA1 | a79a7f0e57a5ff63520d3fe4ea83e278db29e754 |
| SHA256 | 0198a93584a90e886b2f7fe7e78a3c323377f2d2301aecb0f81e39c261beba06 |
| SHA512 | 3795411ce169fecb761b09be8cf9a0192ee37f6c16dc9efdaf4d11485defda9073bf29f334ceb8218b2e4d6be00573d10997495246b431d489ee773268319b45 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
| MD5 | 4e4a59f3a0309818b954da4d101f65b3 |
| SHA1 | a79a7f0e57a5ff63520d3fe4ea83e278db29e754 |
| SHA256 | 0198a93584a90e886b2f7fe7e78a3c323377f2d2301aecb0f81e39c261beba06 |
| SHA512 | 3795411ce169fecb761b09be8cf9a0192ee37f6c16dc9efdaf4d11485defda9073bf29f334ceb8218b2e4d6be00573d10997495246b431d489ee773268319b45 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
| MD5 | a92b532f9c444d0d61d1e9f3a9d536a0 |
| SHA1 | 6457289fe5fba7df592945e2fbbc9154b3d50357 |
| SHA256 | f211972348ed00db7365a9ee66449bc0df29164e9f131c285668af8885dc2247 |
| SHA512 | 4d33c91980f86f099417028f988fca63a9db3ebd4a7859bb8aaee8d98c5f7dc58976a16bfbc975e8073cd43c475dba20e898c5fb12d8ad4eb3c22944169dbb5b |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
| MD5 | a92b532f9c444d0d61d1e9f3a9d536a0 |
| SHA1 | 6457289fe5fba7df592945e2fbbc9154b3d50357 |
| SHA256 | f211972348ed00db7365a9ee66449bc0df29164e9f131c285668af8885dc2247 |
| SHA512 | 4d33c91980f86f099417028f988fca63a9db3ebd4a7859bb8aaee8d98c5f7dc58976a16bfbc975e8073cd43c475dba20e898c5fb12d8ad4eb3c22944169dbb5b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
| MD5 | a92b532f9c444d0d61d1e9f3a9d536a0 |
| SHA1 | 6457289fe5fba7df592945e2fbbc9154b3d50357 |
| SHA256 | f211972348ed00db7365a9ee66449bc0df29164e9f131c285668af8885dc2247 |
| SHA512 | 4d33c91980f86f099417028f988fca63a9db3ebd4a7859bb8aaee8d98c5f7dc58976a16bfbc975e8073cd43c475dba20e898c5fb12d8ad4eb3c22944169dbb5b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
| MD5 | a92b532f9c444d0d61d1e9f3a9d536a0 |
| SHA1 | 6457289fe5fba7df592945e2fbbc9154b3d50357 |
| SHA256 | f211972348ed00db7365a9ee66449bc0df29164e9f131c285668af8885dc2247 |
| SHA512 | 4d33c91980f86f099417028f988fca63a9db3ebd4a7859bb8aaee8d98c5f7dc58976a16bfbc975e8073cd43c475dba20e898c5fb12d8ad4eb3c22944169dbb5b |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe
| MD5 | adc51bb9b178c25216e01ed35840bf99 |
| SHA1 | 336fb3779557295abf6b1129f8793336f332f025 |
| SHA256 | 61af37e580dd9c43f4231f5d0e4d2f28999d92cbe00e17bbfb5df088dd94436f |
| SHA512 | 0a1e079e1a9ccc83221482f939b34083b918e6777fb4eb02187f1e8765cf304a382d38e0072f448d25c493bbe1889895aad5fc1c2f479fcc7a26bd43d55ddbbf |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe
| MD5 | adc51bb9b178c25216e01ed35840bf99 |
| SHA1 | 336fb3779557295abf6b1129f8793336f332f025 |
| SHA256 | 61af37e580dd9c43f4231f5d0e4d2f28999d92cbe00e17bbfb5df088dd94436f |
| SHA512 | 0a1e079e1a9ccc83221482f939b34083b918e6777fb4eb02187f1e8765cf304a382d38e0072f448d25c493bbe1889895aad5fc1c2f479fcc7a26bd43d55ddbbf |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe
| MD5 | adc51bb9b178c25216e01ed35840bf99 |
| SHA1 | 336fb3779557295abf6b1129f8793336f332f025 |
| SHA256 | 61af37e580dd9c43f4231f5d0e4d2f28999d92cbe00e17bbfb5df088dd94436f |
| SHA512 | 0a1e079e1a9ccc83221482f939b34083b918e6777fb4eb02187f1e8765cf304a382d38e0072f448d25c493bbe1889895aad5fc1c2f479fcc7a26bd43d55ddbbf |
memory/2436-48-0x0000000001000000-0x000000000100A000-memory.dmp
memory/2436-49-0x000007FEF5510000-0x000007FEF5EFC000-memory.dmp
memory/2436-50-0x000007FEF5510000-0x000007FEF5EFC000-memory.dmp
memory/2436-51-0x000007FEF5510000-0x000007FEF5EFC000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
memory/1760-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1760-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1760-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1760-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1760-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1760-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/1760-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1760-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1760-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1760-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:47
Reported
2023-10-10 21:18
Platform
win10v2004-20230915-en
Max time kernel
153s
Max time network
162s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8398556.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2502058.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\3d12fbf585a0733ca8693b5655849f93fc149728456c3d32736d79241b5f0c18.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3688 set thread context of 4172 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3584 set thread context of 2108 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7988811.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\3d12fbf585a0733ca8693b5655849f93fc149728456c3d32736d79241b5f0c18.exe
"C:\Users\Admin\AppData\Local\Temp\3d12fbf585a0733ca8693b5655849f93fc149728456c3d32736d79241b5f0c18.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3688 -ip 3688
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4172 -ip 4172
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 148
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 200
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7988811.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7988811.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3584 -ip 3584
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 160
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8398556.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8398556.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2502058.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2502058.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7345297.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7345297.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.211.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.179.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 9.179.89.13.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
| MD5 | 041414c5a1d119fcf4923e8c130d85b6 |
| SHA1 | 4ea3345e617316511d160e8f845239e878e56437 |
| SHA256 | c0eb10eb530df227c0a26d5f6ae464915516bad54a9f2fd3adad7935b9645043 |
| SHA512 | aba6beb5799121eaa5e6c7dd9e847cc17913b04a62eebc81264b8acd50b063566c3c1b0adb128843029ef7278bf7e7e5ed8d1198d8376d4f0137398dec78e0e8 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1917119.exe
| MD5 | 041414c5a1d119fcf4923e8c130d85b6 |
| SHA1 | 4ea3345e617316511d160e8f845239e878e56437 |
| SHA256 | c0eb10eb530df227c0a26d5f6ae464915516bad54a9f2fd3adad7935b9645043 |
| SHA512 | aba6beb5799121eaa5e6c7dd9e847cc17913b04a62eebc81264b8acd50b063566c3c1b0adb128843029ef7278bf7e7e5ed8d1198d8376d4f0137398dec78e0e8 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
| MD5 | c178919274cba2e13b16aa35030d3386 |
| SHA1 | 3b650fa54d57bd565ddff45ae4a6e9af75b61d55 |
| SHA256 | 6804e4fa95daf6aa6bbd0cb79559bdc58e693772d3d22deba3b512a9b6b17bc0 |
| SHA512 | 9c9cb22e77f1548627b3b4a5c716a1805c63823f0966063ebcb9d4eb26bf88c2d20c337769c68c6ff06bd402d753a53868d6864e197dfe06319d98cce8187a85 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6648982.exe
| MD5 | c178919274cba2e13b16aa35030d3386 |
| SHA1 | 3b650fa54d57bd565ddff45ae4a6e9af75b61d55 |
| SHA256 | 6804e4fa95daf6aa6bbd0cb79559bdc58e693772d3d22deba3b512a9b6b17bc0 |
| SHA512 | 9c9cb22e77f1548627b3b4a5c716a1805c63823f0966063ebcb9d4eb26bf88c2d20c337769c68c6ff06bd402d753a53868d6864e197dfe06319d98cce8187a85 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
| MD5 | 4e4a59f3a0309818b954da4d101f65b3 |
| SHA1 | a79a7f0e57a5ff63520d3fe4ea83e278db29e754 |
| SHA256 | 0198a93584a90e886b2f7fe7e78a3c323377f2d2301aecb0f81e39c261beba06 |
| SHA512 | 3795411ce169fecb761b09be8cf9a0192ee37f6c16dc9efdaf4d11485defda9073bf29f334ceb8218b2e4d6be00573d10997495246b431d489ee773268319b45 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3328388.exe
| MD5 | 4e4a59f3a0309818b954da4d101f65b3 |
| SHA1 | a79a7f0e57a5ff63520d3fe4ea83e278db29e754 |
| SHA256 | 0198a93584a90e886b2f7fe7e78a3c323377f2d2301aecb0f81e39c261beba06 |
| SHA512 | 3795411ce169fecb761b09be8cf9a0192ee37f6c16dc9efdaf4d11485defda9073bf29f334ceb8218b2e4d6be00573d10997495246b431d489ee773268319b45 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
| MD5 | a92b532f9c444d0d61d1e9f3a9d536a0 |
| SHA1 | 6457289fe5fba7df592945e2fbbc9154b3d50357 |
| SHA256 | f211972348ed00db7365a9ee66449bc0df29164e9f131c285668af8885dc2247 |
| SHA512 | 4d33c91980f86f099417028f988fca63a9db3ebd4a7859bb8aaee8d98c5f7dc58976a16bfbc975e8073cd43c475dba20e898c5fb12d8ad4eb3c22944169dbb5b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7789797.exe
| MD5 | a92b532f9c444d0d61d1e9f3a9d536a0 |
| SHA1 | 6457289fe5fba7df592945e2fbbc9154b3d50357 |
| SHA256 | f211972348ed00db7365a9ee66449bc0df29164e9f131c285668af8885dc2247 |
| SHA512 | 4d33c91980f86f099417028f988fca63a9db3ebd4a7859bb8aaee8d98c5f7dc58976a16bfbc975e8073cd43c475dba20e898c5fb12d8ad4eb3c22944169dbb5b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe
| MD5 | adc51bb9b178c25216e01ed35840bf99 |
| SHA1 | 336fb3779557295abf6b1129f8793336f332f025 |
| SHA256 | 61af37e580dd9c43f4231f5d0e4d2f28999d92cbe00e17bbfb5df088dd94436f |
| SHA512 | 0a1e079e1a9ccc83221482f939b34083b918e6777fb4eb02187f1e8765cf304a382d38e0072f448d25c493bbe1889895aad5fc1c2f479fcc7a26bd43d55ddbbf |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6063355.exe
| MD5 | adc51bb9b178c25216e01ed35840bf99 |
| SHA1 | 336fb3779557295abf6b1129f8793336f332f025 |
| SHA256 | 61af37e580dd9c43f4231f5d0e4d2f28999d92cbe00e17bbfb5df088dd94436f |
| SHA512 | 0a1e079e1a9ccc83221482f939b34083b918e6777fb4eb02187f1e8765cf304a382d38e0072f448d25c493bbe1889895aad5fc1c2f479fcc7a26bd43d55ddbbf |
memory/5012-35-0x0000000000890000-0x000000000089A000-memory.dmp
memory/5012-36-0x00007FF8D4D70000-0x00007FF8D5831000-memory.dmp
memory/5012-38-0x00007FF8D4D70000-0x00007FF8D5831000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5603770.exe
| MD5 | 1f5389cbc762971a2cc5515cea35ed72 |
| SHA1 | db5f3e38f36eaa96740d8f8da33f112f4cf38e56 |
| SHA256 | 9d44e5ea813f630fedd3a604baa51c4faf276eb5d0ea9d0e96f76ba7f0955641 |
| SHA512 | c5b1642ec6c5784e1753de05b8805a84d78c4cb495fbd76ad98cca93921cfc1c0c24c6c04fc94f3125335a1df895823779814e63c58d20832f498735410073b7 |
memory/4172-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4172-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4172-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4172-46-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7988811.exe
| MD5 | f07a001e273bc4a6ac2705fef1379215 |
| SHA1 | d2a573e12b1899be78a84ce05e57123cf5305a2a |
| SHA256 | 8560f23167753beae06d1a176d974b9787d9c22265c31fe511d1049e3cc2470d |
| SHA512 | 3ce45469f064d6e02434afe1605c36cc08f8558c12d42c7d34761661a2af20f2f7bb5742ffef413a69a97480cf72a31135576c5477388d794af2ec4327d32001 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7988811.exe
| MD5 | f07a001e273bc4a6ac2705fef1379215 |
| SHA1 | d2a573e12b1899be78a84ce05e57123cf5305a2a |
| SHA256 | 8560f23167753beae06d1a176d974b9787d9c22265c31fe511d1049e3cc2470d |
| SHA512 | 3ce45469f064d6e02434afe1605c36cc08f8558c12d42c7d34761661a2af20f2f7bb5742ffef413a69a97480cf72a31135576c5477388d794af2ec4327d32001 |
memory/2108-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2108-51-0x0000000073890000-0x0000000074040000-memory.dmp
memory/2108-52-0x0000000003030000-0x0000000003036000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8398556.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8398556.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2108-62-0x0000000005E10000-0x0000000006428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/2108-66-0x0000000005930000-0x0000000005A3A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2502058.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2502058.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/2108-73-0x0000000003090000-0x00000000030A0000-memory.dmp
memory/2108-72-0x0000000005860000-0x0000000005872000-memory.dmp
memory/2108-78-0x00000000058C0000-0x00000000058FC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7345297.exe
| MD5 | 5c576ffcd9f2ec0e6145ad977b7e85ed |
| SHA1 | 71f051b3e348b2e857c997cca362fe73a65c0396 |
| SHA256 | 6373ee78e3a8aab766facf57519c10d96a41815e19687d8b7a97b4bf5d537858 |
| SHA512 | 2fe629e2cd2de8e4db517cd8c1af1781632a1eeb98b0dc296aa9f8d6036c96d6351c7221400cf8c28908213b8eb844977c9466b4e32c5d47cb775c9e7ce74996 |
memory/2108-84-0x0000000005A40000-0x0000000005A8C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7345297.exe
| MD5 | 5c576ffcd9f2ec0e6145ad977b7e85ed |
| SHA1 | 71f051b3e348b2e857c997cca362fe73a65c0396 |
| SHA256 | 6373ee78e3a8aab766facf57519c10d96a41815e19687d8b7a97b4bf5d537858 |
| SHA512 | 2fe629e2cd2de8e4db517cd8c1af1781632a1eeb98b0dc296aa9f8d6036c96d6351c7221400cf8c28908213b8eb844977c9466b4e32c5d47cb775c9e7ce74996 |
memory/2108-86-0x0000000073890000-0x0000000074040000-memory.dmp
memory/2108-87-0x0000000003090000-0x00000000030A0000-memory.dmp
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |