Analysis Overview
SHA256
bd2daed14e453cff351b09493b5b7b37de4303daf32fbc02c9f55e8fbc569d1d
Threat Level: Known bad
The file bd2daed14e453cff351b09493b5b7b37de4303daf32fbc02c9f55e8fbc569d1d was found to be: Known bad.
Malicious Activity Summary
Modifies Windows Defender Real-time Protection settings
Detect Mystic stealer payload
Amadey
Healer
Mystic
RedLine
Detects Healer an antivirus disabler dropper
Windows security modification
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
Adds Run key to start application
Suspicious use of SetThreadContext
Program crash
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:48
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:48
Reported
2023-10-10 21:19
Platform
win7-20230831-en
Max time kernel
117s
Max time network
135s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\bd2daed14e453cff351b09493b5b7b37de4303daf32fbc02c9f55e8fbc569d1d.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2384 set thread context of 1044 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\bd2daed14e453cff351b09493b5b7b37de4303daf32fbc02c9f55e8fbc569d1d.exe
"C:\Users\Admin\AppData\Local\Temp\bd2daed14e453cff351b09493b5b7b37de4303daf32fbc02c9f55e8fbc569d1d.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 36
Network
| Country | Destination | Domain | Proto |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
| MD5 | 502b585794232cf56000b4eb24f89309 |
| SHA1 | 3fc9b139250fcae5b3905dede532d688299464fb |
| SHA256 | 84be482698e2bd67344e9a8f56d72cad187f6c7503e8572d0eecc4f8530668b9 |
| SHA512 | 7df0bb414d3d32232b49d064ee8554d74d60735c0f2fa1225269b2bc3fb5b8a5877276996a821fbf497d0695ba6b74712853b4709d2b739e4379274fc621e335 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
| MD5 | 502b585794232cf56000b4eb24f89309 |
| SHA1 | 3fc9b139250fcae5b3905dede532d688299464fb |
| SHA256 | 84be482698e2bd67344e9a8f56d72cad187f6c7503e8572d0eecc4f8530668b9 |
| SHA512 | 7df0bb414d3d32232b49d064ee8554d74d60735c0f2fa1225269b2bc3fb5b8a5877276996a821fbf497d0695ba6b74712853b4709d2b739e4379274fc621e335 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
| MD5 | 502b585794232cf56000b4eb24f89309 |
| SHA1 | 3fc9b139250fcae5b3905dede532d688299464fb |
| SHA256 | 84be482698e2bd67344e9a8f56d72cad187f6c7503e8572d0eecc4f8530668b9 |
| SHA512 | 7df0bb414d3d32232b49d064ee8554d74d60735c0f2fa1225269b2bc3fb5b8a5877276996a821fbf497d0695ba6b74712853b4709d2b739e4379274fc621e335 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
| MD5 | 502b585794232cf56000b4eb24f89309 |
| SHA1 | 3fc9b139250fcae5b3905dede532d688299464fb |
| SHA256 | 84be482698e2bd67344e9a8f56d72cad187f6c7503e8572d0eecc4f8530668b9 |
| SHA512 | 7df0bb414d3d32232b49d064ee8554d74d60735c0f2fa1225269b2bc3fb5b8a5877276996a821fbf497d0695ba6b74712853b4709d2b739e4379274fc621e335 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
| MD5 | 22a49d27237bf0a2009219497896425e |
| SHA1 | befc1d3c8a07a0a1294a573f9114607e6bf6b2f5 |
| SHA256 | 3266202ecbca59154e77de45b097ea553703c3ee65de7e5520eae6880a2b492b |
| SHA512 | afef44a9ad89d2dfd346b3b5d896a6d9cba4942f4573bef1d46c882d6457355e1d5d4600da51c393e0013c5e43dc82e42a2f9654f17030fb20b7efdf91b3c868 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
| MD5 | 22a49d27237bf0a2009219497896425e |
| SHA1 | befc1d3c8a07a0a1294a573f9114607e6bf6b2f5 |
| SHA256 | 3266202ecbca59154e77de45b097ea553703c3ee65de7e5520eae6880a2b492b |
| SHA512 | afef44a9ad89d2dfd346b3b5d896a6d9cba4942f4573bef1d46c882d6457355e1d5d4600da51c393e0013c5e43dc82e42a2f9654f17030fb20b7efdf91b3c868 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
| MD5 | 22a49d27237bf0a2009219497896425e |
| SHA1 | befc1d3c8a07a0a1294a573f9114607e6bf6b2f5 |
| SHA256 | 3266202ecbca59154e77de45b097ea553703c3ee65de7e5520eae6880a2b492b |
| SHA512 | afef44a9ad89d2dfd346b3b5d896a6d9cba4942f4573bef1d46c882d6457355e1d5d4600da51c393e0013c5e43dc82e42a2f9654f17030fb20b7efdf91b3c868 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
| MD5 | 22a49d27237bf0a2009219497896425e |
| SHA1 | befc1d3c8a07a0a1294a573f9114607e6bf6b2f5 |
| SHA256 | 3266202ecbca59154e77de45b097ea553703c3ee65de7e5520eae6880a2b492b |
| SHA512 | afef44a9ad89d2dfd346b3b5d896a6d9cba4942f4573bef1d46c882d6457355e1d5d4600da51c393e0013c5e43dc82e42a2f9654f17030fb20b7efdf91b3c868 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
| MD5 | e9aee06dfbe17e032526e8cc1c7287f2 |
| SHA1 | 1b06d7603fb7dd65740187c5032ef7d0d495c46f |
| SHA256 | 2a7c9ca14a0424e11e2c930b2c8849d40fbd8aefd45045d8f917da1456486c88 |
| SHA512 | cf7e102be4ba39e347556292578bcdf87d6102fed1669205c71da6309abd9bacd0fa9da24facd31dc3de520154423dcaea5036b73139e6160a771576830fbcad |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
| MD5 | e9aee06dfbe17e032526e8cc1c7287f2 |
| SHA1 | 1b06d7603fb7dd65740187c5032ef7d0d495c46f |
| SHA256 | 2a7c9ca14a0424e11e2c930b2c8849d40fbd8aefd45045d8f917da1456486c88 |
| SHA512 | cf7e102be4ba39e347556292578bcdf87d6102fed1669205c71da6309abd9bacd0fa9da24facd31dc3de520154423dcaea5036b73139e6160a771576830fbcad |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
| MD5 | e9aee06dfbe17e032526e8cc1c7287f2 |
| SHA1 | 1b06d7603fb7dd65740187c5032ef7d0d495c46f |
| SHA256 | 2a7c9ca14a0424e11e2c930b2c8849d40fbd8aefd45045d8f917da1456486c88 |
| SHA512 | cf7e102be4ba39e347556292578bcdf87d6102fed1669205c71da6309abd9bacd0fa9da24facd31dc3de520154423dcaea5036b73139e6160a771576830fbcad |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
| MD5 | e9aee06dfbe17e032526e8cc1c7287f2 |
| SHA1 | 1b06d7603fb7dd65740187c5032ef7d0d495c46f |
| SHA256 | 2a7c9ca14a0424e11e2c930b2c8849d40fbd8aefd45045d8f917da1456486c88 |
| SHA512 | cf7e102be4ba39e347556292578bcdf87d6102fed1669205c71da6309abd9bacd0fa9da24facd31dc3de520154423dcaea5036b73139e6160a771576830fbcad |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
| MD5 | 3904ce4a94ce9f0d1c89f470d538447e |
| SHA1 | fe1cd0fe8abf2f4fa6837b6666207a383f12d58f |
| SHA256 | 1e8e5a6791dc2b254f3c079158140840799f612f294b36bdb41b26581daede41 |
| SHA512 | c107f1cfc5bbc0a8d4e88dfea9b4cedd1094c7c24489e7df734a6f01d375142e10bf65c09e0cc9c2f122b7786cc98f8a46906b58a98d746ac71c84193fd24513 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
| MD5 | 3904ce4a94ce9f0d1c89f470d538447e |
| SHA1 | fe1cd0fe8abf2f4fa6837b6666207a383f12d58f |
| SHA256 | 1e8e5a6791dc2b254f3c079158140840799f612f294b36bdb41b26581daede41 |
| SHA512 | c107f1cfc5bbc0a8d4e88dfea9b4cedd1094c7c24489e7df734a6f01d375142e10bf65c09e0cc9c2f122b7786cc98f8a46906b58a98d746ac71c84193fd24513 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
| MD5 | 3904ce4a94ce9f0d1c89f470d538447e |
| SHA1 | fe1cd0fe8abf2f4fa6837b6666207a383f12d58f |
| SHA256 | 1e8e5a6791dc2b254f3c079158140840799f612f294b36bdb41b26581daede41 |
| SHA512 | c107f1cfc5bbc0a8d4e88dfea9b4cedd1094c7c24489e7df734a6f01d375142e10bf65c09e0cc9c2f122b7786cc98f8a46906b58a98d746ac71c84193fd24513 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
| MD5 | 3904ce4a94ce9f0d1c89f470d538447e |
| SHA1 | fe1cd0fe8abf2f4fa6837b6666207a383f12d58f |
| SHA256 | 1e8e5a6791dc2b254f3c079158140840799f612f294b36bdb41b26581daede41 |
| SHA512 | c107f1cfc5bbc0a8d4e88dfea9b4cedd1094c7c24489e7df734a6f01d375142e10bf65c09e0cc9c2f122b7786cc98f8a46906b58a98d746ac71c84193fd24513 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe
| MD5 | 784824e2fee0a9f4042d47322c39316c |
| SHA1 | 502af8b8b8570847860c7beebb93df0caffe5f5c |
| SHA256 | efc1de07c5570c007190ec75e53ad7835e84ca1579575dd1a85135f86ffb9f94 |
| SHA512 | 0eba57bb6ec53f49b077472896fe85e68ddebfe54c1e676bdb34c79aac71483ef3bb58ad0f09bab431ae275d93310ed71fe22c673d42aeabc93447674efa5db4 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe
| MD5 | 784824e2fee0a9f4042d47322c39316c |
| SHA1 | 502af8b8b8570847860c7beebb93df0caffe5f5c |
| SHA256 | efc1de07c5570c007190ec75e53ad7835e84ca1579575dd1a85135f86ffb9f94 |
| SHA512 | 0eba57bb6ec53f49b077472896fe85e68ddebfe54c1e676bdb34c79aac71483ef3bb58ad0f09bab431ae275d93310ed71fe22c673d42aeabc93447674efa5db4 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe
| MD5 | 784824e2fee0a9f4042d47322c39316c |
| SHA1 | 502af8b8b8570847860c7beebb93df0caffe5f5c |
| SHA256 | efc1de07c5570c007190ec75e53ad7835e84ca1579575dd1a85135f86ffb9f94 |
| SHA512 | 0eba57bb6ec53f49b077472896fe85e68ddebfe54c1e676bdb34c79aac71483ef3bb58ad0f09bab431ae275d93310ed71fe22c673d42aeabc93447674efa5db4 |
memory/2664-48-0x000007FEF5940000-0x000007FEF632C000-memory.dmp
memory/2664-49-0x0000000000EA0000-0x0000000000EAA000-memory.dmp
memory/2664-50-0x000007FEF5940000-0x000007FEF632C000-memory.dmp
memory/2664-51-0x000007FEF5940000-0x000007FEF632C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
memory/1044-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-72-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-69-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/1044-74-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1044-75-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
memory/1044-79-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:48
Reported
2023-10-10 21:19
Platform
win10v2004-20230915-en
Max time kernel
160s
Max time network
173s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6032132.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6595865.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\bd2daed14e453cff351b09493b5b7b37de4303daf32fbc02c9f55e8fbc569d1d.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4952 set thread context of 3944 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 2912 set thread context of 3336 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4927941.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\bd2daed14e453cff351b09493b5b7b37de4303daf32fbc02c9f55e8fbc569d1d.exe
"C:\Users\Admin\AppData\Local\Temp\bd2daed14e453cff351b09493b5b7b37de4303daf32fbc02c9f55e8fbc569d1d.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4952 -ip 4952
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3944 -ip 3944
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 148
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4927941.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4927941.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2912 -ip 2912
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6032132.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6032132.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6595865.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6595865.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3211606.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3211606.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 71.121.18.2.in-addr.arpa | udp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 8.179.89.13.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
| MD5 | 502b585794232cf56000b4eb24f89309 |
| SHA1 | 3fc9b139250fcae5b3905dede532d688299464fb |
| SHA256 | 84be482698e2bd67344e9a8f56d72cad187f6c7503e8572d0eecc4f8530668b9 |
| SHA512 | 7df0bb414d3d32232b49d064ee8554d74d60735c0f2fa1225269b2bc3fb5b8a5877276996a821fbf497d0695ba6b74712853b4709d2b739e4379274fc621e335 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4211650.exe
| MD5 | 502b585794232cf56000b4eb24f89309 |
| SHA1 | 3fc9b139250fcae5b3905dede532d688299464fb |
| SHA256 | 84be482698e2bd67344e9a8f56d72cad187f6c7503e8572d0eecc4f8530668b9 |
| SHA512 | 7df0bb414d3d32232b49d064ee8554d74d60735c0f2fa1225269b2bc3fb5b8a5877276996a821fbf497d0695ba6b74712853b4709d2b739e4379274fc621e335 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
| MD5 | 22a49d27237bf0a2009219497896425e |
| SHA1 | befc1d3c8a07a0a1294a573f9114607e6bf6b2f5 |
| SHA256 | 3266202ecbca59154e77de45b097ea553703c3ee65de7e5520eae6880a2b492b |
| SHA512 | afef44a9ad89d2dfd346b3b5d896a6d9cba4942f4573bef1d46c882d6457355e1d5d4600da51c393e0013c5e43dc82e42a2f9654f17030fb20b7efdf91b3c868 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2482740.exe
| MD5 | 22a49d27237bf0a2009219497896425e |
| SHA1 | befc1d3c8a07a0a1294a573f9114607e6bf6b2f5 |
| SHA256 | 3266202ecbca59154e77de45b097ea553703c3ee65de7e5520eae6880a2b492b |
| SHA512 | afef44a9ad89d2dfd346b3b5d896a6d9cba4942f4573bef1d46c882d6457355e1d5d4600da51c393e0013c5e43dc82e42a2f9654f17030fb20b7efdf91b3c868 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
| MD5 | e9aee06dfbe17e032526e8cc1c7287f2 |
| SHA1 | 1b06d7603fb7dd65740187c5032ef7d0d495c46f |
| SHA256 | 2a7c9ca14a0424e11e2c930b2c8849d40fbd8aefd45045d8f917da1456486c88 |
| SHA512 | cf7e102be4ba39e347556292578bcdf87d6102fed1669205c71da6309abd9bacd0fa9da24facd31dc3de520154423dcaea5036b73139e6160a771576830fbcad |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5897984.exe
| MD5 | e9aee06dfbe17e032526e8cc1c7287f2 |
| SHA1 | 1b06d7603fb7dd65740187c5032ef7d0d495c46f |
| SHA256 | 2a7c9ca14a0424e11e2c930b2c8849d40fbd8aefd45045d8f917da1456486c88 |
| SHA512 | cf7e102be4ba39e347556292578bcdf87d6102fed1669205c71da6309abd9bacd0fa9da24facd31dc3de520154423dcaea5036b73139e6160a771576830fbcad |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
| MD5 | 3904ce4a94ce9f0d1c89f470d538447e |
| SHA1 | fe1cd0fe8abf2f4fa6837b6666207a383f12d58f |
| SHA256 | 1e8e5a6791dc2b254f3c079158140840799f612f294b36bdb41b26581daede41 |
| SHA512 | c107f1cfc5bbc0a8d4e88dfea9b4cedd1094c7c24489e7df734a6f01d375142e10bf65c09e0cc9c2f122b7786cc98f8a46906b58a98d746ac71c84193fd24513 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1562855.exe
| MD5 | 3904ce4a94ce9f0d1c89f470d538447e |
| SHA1 | fe1cd0fe8abf2f4fa6837b6666207a383f12d58f |
| SHA256 | 1e8e5a6791dc2b254f3c079158140840799f612f294b36bdb41b26581daede41 |
| SHA512 | c107f1cfc5bbc0a8d4e88dfea9b4cedd1094c7c24489e7df734a6f01d375142e10bf65c09e0cc9c2f122b7786cc98f8a46906b58a98d746ac71c84193fd24513 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe
| MD5 | 784824e2fee0a9f4042d47322c39316c |
| SHA1 | 502af8b8b8570847860c7beebb93df0caffe5f5c |
| SHA256 | efc1de07c5570c007190ec75e53ad7835e84ca1579575dd1a85135f86ffb9f94 |
| SHA512 | 0eba57bb6ec53f49b077472896fe85e68ddebfe54c1e676bdb34c79aac71483ef3bb58ad0f09bab431ae275d93310ed71fe22c673d42aeabc93447674efa5db4 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1380406.exe
| MD5 | 784824e2fee0a9f4042d47322c39316c |
| SHA1 | 502af8b8b8570847860c7beebb93df0caffe5f5c |
| SHA256 | efc1de07c5570c007190ec75e53ad7835e84ca1579575dd1a85135f86ffb9f94 |
| SHA512 | 0eba57bb6ec53f49b077472896fe85e68ddebfe54c1e676bdb34c79aac71483ef3bb58ad0f09bab431ae275d93310ed71fe22c673d42aeabc93447674efa5db4 |
memory/3488-35-0x0000000000EA0000-0x0000000000EAA000-memory.dmp
memory/3488-36-0x00007FFEF7EF0000-0x00007FFEF89B1000-memory.dmp
memory/3488-38-0x00007FFEF7EF0000-0x00007FFEF89B1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7917920.exe
| MD5 | 4bda0e1d8ff0269100d2f4e268a80dd8 |
| SHA1 | 247c6b7f4098f4f083cd28a42ff04392ba5a4e64 |
| SHA256 | 9d4fc278c588da4fb2aa4c78502943e35522dad1a0e4843f17364970ba609b5e |
| SHA512 | c4b8013f7a2176dc3008c7408a3297a6122d6c956217cc0c2318de1e5f131ec8d97004e268d67048b30a432689926b1e5e83581a4e41a4ebd4f8e401b141354a |
memory/3944-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3944-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3944-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3944-46-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4927941.exe
| MD5 | 1f4b31b186597f1a98a01da09e78d584 |
| SHA1 | dd87d8b9831efc0f6db22ae0cb6b0b0d2c52e06a |
| SHA256 | 252826656b785ecef8204b05cfc4ecf55957c60801fd79f7ba0cdb9641029bab |
| SHA512 | 402a5881f300316b29fb4957ceb7f95e363184292e5fdd1a068cf1607a6efe7a9fc1fd510fe99bf5c1982db13f3709faaa7203376c4bffde10e156229f5e88f5 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4927941.exe
| MD5 | 1f4b31b186597f1a98a01da09e78d584 |
| SHA1 | dd87d8b9831efc0f6db22ae0cb6b0b0d2c52e06a |
| SHA256 | 252826656b785ecef8204b05cfc4ecf55957c60801fd79f7ba0cdb9641029bab |
| SHA512 | 402a5881f300316b29fb4957ceb7f95e363184292e5fdd1a068cf1607a6efe7a9fc1fd510fe99bf5c1982db13f3709faaa7203376c4bffde10e156229f5e88f5 |
memory/3336-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3336-51-0x0000000073950000-0x0000000074100000-memory.dmp
memory/3336-52-0x0000000005500000-0x0000000005506000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6032132.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6032132.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/3336-58-0x0000000005BB0000-0x00000000061C8000-memory.dmp
memory/3336-63-0x00000000056A0000-0x00000000057AA000-memory.dmp
memory/3336-64-0x0000000005580000-0x0000000005590000-memory.dmp
memory/3336-65-0x00000000055B0000-0x00000000055C2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6595865.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6595865.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/3336-72-0x0000000005610000-0x000000000564C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/3336-82-0x0000000005650000-0x000000000569C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3211606.exe
| MD5 | 268248ca2538db29f5f9ca6627feea81 |
| SHA1 | 60f39562cf7744ed565c4c313b8a94f30b068eaf |
| SHA256 | 78a60a07331611e740af8e570e824133103bd883e75a2958227f456b987c13b6 |
| SHA512 | 594dbfe4b18405adc7783ba839256d8dfff0d9c75e8ecc226a60c23ad47e1dcfe5c7a66fbcdfbfc3a573f51ae38eb6e096b9bab2a3882b9af556812a49b01460 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3211606.exe
| MD5 | 268248ca2538db29f5f9ca6627feea81 |
| SHA1 | 60f39562cf7744ed565c4c313b8a94f30b068eaf |
| SHA256 | 78a60a07331611e740af8e570e824133103bd883e75a2958227f456b987c13b6 |
| SHA512 | 594dbfe4b18405adc7783ba839256d8dfff0d9c75e8ecc226a60c23ad47e1dcfe5c7a66fbcdfbfc3a573f51ae38eb6e096b9bab2a3882b9af556812a49b01460 |
memory/3336-86-0x0000000073950000-0x0000000074100000-memory.dmp
memory/3336-87-0x0000000005580000-0x0000000005590000-memory.dmp
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |