Analysis Overview
SHA256
576413bd9a4657d9d1daed04b0d137e88b600ba58a0df11296f58f7fcb14c04a
Threat Level: Known bad
The file 576413bd9a4657d9d1daed04b0d137e88b600ba58a0df11296f58f7fcb14c04a was found to be: Known bad.
Malicious Activity Summary
RedLine
Modifies Windows Defender Real-time Protection settings
Amadey
Healer
Mystic
Detect Mystic stealer payload
Detects Healer an antivirus disabler dropper
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
Windows security modification
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Program crash
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:49
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:49
Reported
2023-10-10 21:29
Platform
win10v2004-20230915-en
Max time kernel
170s
Max time network
522s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8534993.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9133550.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\576413bd9a4657d9d1daed04b0d137e88b600ba58a0df11296f58f7fcb14c04a.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4892 set thread context of 4948 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 2604 set thread context of 1460 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6860353.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\576413bd9a4657d9d1daed04b0d137e88b600ba58a0df11296f58f7fcb14c04a.exe
"C:\Users\Admin\AppData\Local\Temp\576413bd9a4657d9d1daed04b0d137e88b600ba58a0df11296f58f7fcb14c04a.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4892 -ip 4892
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4948 -ip 4948
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 544
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 160
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6860353.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6860353.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2604 -ip 2604
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 156
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8534993.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8534993.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9133550.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9133550.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9023083.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9023083.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.211.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.179.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.16.208.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.57.101.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
| MD5 | db92825edad19c66feff37194a90786b |
| SHA1 | 00652f1fe573fbc7daacbe99d9bca819a63acc00 |
| SHA256 | 2fb25523aecc0cb50644809d4cca6eebef80f4a5526d82a7abb261e68d9869c0 |
| SHA512 | 2ca9b537e35597a2cfbb4859acea2e65367fca7b985b297b897ec5378c1e22b59ad05d43467c23af43f9e9a318ced93e5c1b4d5d6e6074b4cc1a92b86f49e6c0 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
| MD5 | db92825edad19c66feff37194a90786b |
| SHA1 | 00652f1fe573fbc7daacbe99d9bca819a63acc00 |
| SHA256 | 2fb25523aecc0cb50644809d4cca6eebef80f4a5526d82a7abb261e68d9869c0 |
| SHA512 | 2ca9b537e35597a2cfbb4859acea2e65367fca7b985b297b897ec5378c1e22b59ad05d43467c23af43f9e9a318ced93e5c1b4d5d6e6074b4cc1a92b86f49e6c0 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
| MD5 | 9a1a3f549c798f70209c6aa3fc3c97e4 |
| SHA1 | 857a174fbfc893438b51c50b7075d530981163ac |
| SHA256 | 33f019c7a3d247a3a869504b28120cbd004ed01093a9c50c79eb1ed798b42860 |
| SHA512 | 4dba45913faa8abef61d5807d7cf4ea9d8b4eb760858d8ad167b3ed04721cf4fe9dc3785c8d108d4f7defe4bdda4dcb3b6c4278c05435f27b4c914ad49c8d23d |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
| MD5 | 9a1a3f549c798f70209c6aa3fc3c97e4 |
| SHA1 | 857a174fbfc893438b51c50b7075d530981163ac |
| SHA256 | 33f019c7a3d247a3a869504b28120cbd004ed01093a9c50c79eb1ed798b42860 |
| SHA512 | 4dba45913faa8abef61d5807d7cf4ea9d8b4eb760858d8ad167b3ed04721cf4fe9dc3785c8d108d4f7defe4bdda4dcb3b6c4278c05435f27b4c914ad49c8d23d |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
| MD5 | 4609d13275386c7eaed2c220af7437f3 |
| SHA1 | 2a5b0b1feb7fd7d2f2726038150d56961867eca1 |
| SHA256 | bc564fe5c8703882292b1d9c447dde69c157a3f6e235bae8709f586f2261e01a |
| SHA512 | 4ccab22f4581bd475784d6c38548dd13544813b37c9bbb81dec67785e6564a0282aa83d3dba66d7f3af73f9d954c98424042cdf290fd7cd14db78af7b68d7e0e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
| MD5 | 4609d13275386c7eaed2c220af7437f3 |
| SHA1 | 2a5b0b1feb7fd7d2f2726038150d56961867eca1 |
| SHA256 | bc564fe5c8703882292b1d9c447dde69c157a3f6e235bae8709f586f2261e01a |
| SHA512 | 4ccab22f4581bd475784d6c38548dd13544813b37c9bbb81dec67785e6564a0282aa83d3dba66d7f3af73f9d954c98424042cdf290fd7cd14db78af7b68d7e0e |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
| MD5 | 4638f4a6eedfb66c021537ac06c0a8db |
| SHA1 | 6b924a939c25673fa739132ed14502a0a1fc991f |
| SHA256 | a71f15a246ee293a10b6fd47823ee3692ea7fbcc616040396f2536c4ea20f55f |
| SHA512 | bb9410f1da94bdda34a103c8f409d82fb6b46fad2b370bf84416c89d28c3bf304695c638c2b5fedff00f6a5ecaa8da57521af0e37252043250513d99e3f3d17f |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
| MD5 | 4638f4a6eedfb66c021537ac06c0a8db |
| SHA1 | 6b924a939c25673fa739132ed14502a0a1fc991f |
| SHA256 | a71f15a246ee293a10b6fd47823ee3692ea7fbcc616040396f2536c4ea20f55f |
| SHA512 | bb9410f1da94bdda34a103c8f409d82fb6b46fad2b370bf84416c89d28c3bf304695c638c2b5fedff00f6a5ecaa8da57521af0e37252043250513d99e3f3d17f |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe
| MD5 | c895450ea2d0fa38603840096ce4c156 |
| SHA1 | 461af9da5ccf6a711598bd1bfeaa80470b84aad1 |
| SHA256 | 74db56153d4768f921c1074e2c4e35d6664bd139f00833283d663cfd1fe9529e |
| SHA512 | 6bfc940a7d01cb89478c4d0f98ec272080bd7a95d46dcd27a37e8c028085ec08dfa7f0ad997c779e842fe23eb354870c2ba3dec85db61e2827516340297c6510 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe
| MD5 | c895450ea2d0fa38603840096ce4c156 |
| SHA1 | 461af9da5ccf6a711598bd1bfeaa80470b84aad1 |
| SHA256 | 74db56153d4768f921c1074e2c4e35d6664bd139f00833283d663cfd1fe9529e |
| SHA512 | 6bfc940a7d01cb89478c4d0f98ec272080bd7a95d46dcd27a37e8c028085ec08dfa7f0ad997c779e842fe23eb354870c2ba3dec85db61e2827516340297c6510 |
memory/4604-35-0x0000000000B20000-0x0000000000B2A000-memory.dmp
memory/4604-36-0x00007FFB1E1A0000-0x00007FFB1EC61000-memory.dmp
memory/4604-37-0x00007FFB1E1A0000-0x00007FFB1EC61000-memory.dmp
memory/4604-39-0x00007FFB1E1A0000-0x00007FFB1EC61000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
memory/4948-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4948-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4948-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4948-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6860353.exe
| MD5 | a031fb1b12e7b2707e4ebc09f7b7b19d |
| SHA1 | 2dabf4a50483b6ced095747aae8f8ab08824fea1 |
| SHA256 | 7b66f6bad73cb7f460a5f46a32f1b43a30638b0be81823fbff5ecbbba2eb20e1 |
| SHA512 | 862c63e1c7d5ded0d2b1daa0540d85fb07d3ea4c4a471e705c1186f73852a488a204280e694a57f544561293f0365da093202c0e17e03f7ccc5718ee0af9d1b5 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6860353.exe
| MD5 | a031fb1b12e7b2707e4ebc09f7b7b19d |
| SHA1 | 2dabf4a50483b6ced095747aae8f8ab08824fea1 |
| SHA256 | 7b66f6bad73cb7f460a5f46a32f1b43a30638b0be81823fbff5ecbbba2eb20e1 |
| SHA512 | 862c63e1c7d5ded0d2b1daa0540d85fb07d3ea4c4a471e705c1186f73852a488a204280e694a57f544561293f0365da093202c0e17e03f7ccc5718ee0af9d1b5 |
memory/1460-51-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1460-52-0x0000000000ED0000-0x0000000000ED6000-memory.dmp
memory/1460-53-0x00000000737E0000-0x0000000073F90000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8534993.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8534993.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/1460-59-0x00000000056F0000-0x0000000005D08000-memory.dmp
memory/1460-60-0x00000000051E0000-0x00000000052EA000-memory.dmp
memory/1460-61-0x0000000004F10000-0x0000000004F22000-memory.dmp
memory/1460-62-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
memory/1460-64-0x0000000004F70000-0x0000000004FAC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9133550.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9133550.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/1460-74-0x00000000050D0000-0x000000000511C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9023083.exe
| MD5 | e86d821e155cfb1ee3ca690e318992f1 |
| SHA1 | 0f1fda393821bc3c5481a2b7e63333511cec8596 |
| SHA256 | 92a049aae1f70cac6b1f583bf85b2faad17fb6fc040ac94acc5c14b18609c953 |
| SHA512 | f7593641bcff728f932baf74787131807b4050e793b0f3cf7f8d8f89c053fe77b65a14cbf9eca55c22807398bc31cf862e011956b2a1e3339ebf7cd77905229c |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9023083.exe
| MD5 | e86d821e155cfb1ee3ca690e318992f1 |
| SHA1 | 0f1fda393821bc3c5481a2b7e63333511cec8596 |
| SHA256 | 92a049aae1f70cac6b1f583bf85b2faad17fb6fc040ac94acc5c14b18609c953 |
| SHA512 | f7593641bcff728f932baf74787131807b4050e793b0f3cf7f8d8f89c053fe77b65a14cbf9eca55c22807398bc31cf862e011956b2a1e3339ebf7cd77905229c |
memory/1460-87-0x00000000737E0000-0x0000000073F90000-memory.dmp
memory/1460-88-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:49
Reported
2023-10-10 21:22
Platform
win7-20230831-en
Max time kernel
121s
Max time network
128s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\576413bd9a4657d9d1daed04b0d137e88b600ba58a0df11296f58f7fcb14c04a.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2560 set thread context of 2440 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\576413bd9a4657d9d1daed04b0d137e88b600ba58a0df11296f58f7fcb14c04a.exe
"C:\Users\Admin\AppData\Local\Temp\576413bd9a4657d9d1daed04b0d137e88b600ba58a0df11296f58f7fcb14c04a.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 36
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
| MD5 | db92825edad19c66feff37194a90786b |
| SHA1 | 00652f1fe573fbc7daacbe99d9bca819a63acc00 |
| SHA256 | 2fb25523aecc0cb50644809d4cca6eebef80f4a5526d82a7abb261e68d9869c0 |
| SHA512 | 2ca9b537e35597a2cfbb4859acea2e65367fca7b985b297b897ec5378c1e22b59ad05d43467c23af43f9e9a318ced93e5c1b4d5d6e6074b4cc1a92b86f49e6c0 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
| MD5 | db92825edad19c66feff37194a90786b |
| SHA1 | 00652f1fe573fbc7daacbe99d9bca819a63acc00 |
| SHA256 | 2fb25523aecc0cb50644809d4cca6eebef80f4a5526d82a7abb261e68d9869c0 |
| SHA512 | 2ca9b537e35597a2cfbb4859acea2e65367fca7b985b297b897ec5378c1e22b59ad05d43467c23af43f9e9a318ced93e5c1b4d5d6e6074b4cc1a92b86f49e6c0 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
| MD5 | db92825edad19c66feff37194a90786b |
| SHA1 | 00652f1fe573fbc7daacbe99d9bca819a63acc00 |
| SHA256 | 2fb25523aecc0cb50644809d4cca6eebef80f4a5526d82a7abb261e68d9869c0 |
| SHA512 | 2ca9b537e35597a2cfbb4859acea2e65367fca7b985b297b897ec5378c1e22b59ad05d43467c23af43f9e9a318ced93e5c1b4d5d6e6074b4cc1a92b86f49e6c0 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4107917.exe
| MD5 | db92825edad19c66feff37194a90786b |
| SHA1 | 00652f1fe573fbc7daacbe99d9bca819a63acc00 |
| SHA256 | 2fb25523aecc0cb50644809d4cca6eebef80f4a5526d82a7abb261e68d9869c0 |
| SHA512 | 2ca9b537e35597a2cfbb4859acea2e65367fca7b985b297b897ec5378c1e22b59ad05d43467c23af43f9e9a318ced93e5c1b4d5d6e6074b4cc1a92b86f49e6c0 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
| MD5 | 9a1a3f549c798f70209c6aa3fc3c97e4 |
| SHA1 | 857a174fbfc893438b51c50b7075d530981163ac |
| SHA256 | 33f019c7a3d247a3a869504b28120cbd004ed01093a9c50c79eb1ed798b42860 |
| SHA512 | 4dba45913faa8abef61d5807d7cf4ea9d8b4eb760858d8ad167b3ed04721cf4fe9dc3785c8d108d4f7defe4bdda4dcb3b6c4278c05435f27b4c914ad49c8d23d |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
| MD5 | 9a1a3f549c798f70209c6aa3fc3c97e4 |
| SHA1 | 857a174fbfc893438b51c50b7075d530981163ac |
| SHA256 | 33f019c7a3d247a3a869504b28120cbd004ed01093a9c50c79eb1ed798b42860 |
| SHA512 | 4dba45913faa8abef61d5807d7cf4ea9d8b4eb760858d8ad167b3ed04721cf4fe9dc3785c8d108d4f7defe4bdda4dcb3b6c4278c05435f27b4c914ad49c8d23d |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
| MD5 | 9a1a3f549c798f70209c6aa3fc3c97e4 |
| SHA1 | 857a174fbfc893438b51c50b7075d530981163ac |
| SHA256 | 33f019c7a3d247a3a869504b28120cbd004ed01093a9c50c79eb1ed798b42860 |
| SHA512 | 4dba45913faa8abef61d5807d7cf4ea9d8b4eb760858d8ad167b3ed04721cf4fe9dc3785c8d108d4f7defe4bdda4dcb3b6c4278c05435f27b4c914ad49c8d23d |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1825352.exe
| MD5 | 9a1a3f549c798f70209c6aa3fc3c97e4 |
| SHA1 | 857a174fbfc893438b51c50b7075d530981163ac |
| SHA256 | 33f019c7a3d247a3a869504b28120cbd004ed01093a9c50c79eb1ed798b42860 |
| SHA512 | 4dba45913faa8abef61d5807d7cf4ea9d8b4eb760858d8ad167b3ed04721cf4fe9dc3785c8d108d4f7defe4bdda4dcb3b6c4278c05435f27b4c914ad49c8d23d |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
| MD5 | 4609d13275386c7eaed2c220af7437f3 |
| SHA1 | 2a5b0b1feb7fd7d2f2726038150d56961867eca1 |
| SHA256 | bc564fe5c8703882292b1d9c447dde69c157a3f6e235bae8709f586f2261e01a |
| SHA512 | 4ccab22f4581bd475784d6c38548dd13544813b37c9bbb81dec67785e6564a0282aa83d3dba66d7f3af73f9d954c98424042cdf290fd7cd14db78af7b68d7e0e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
| MD5 | 4609d13275386c7eaed2c220af7437f3 |
| SHA1 | 2a5b0b1feb7fd7d2f2726038150d56961867eca1 |
| SHA256 | bc564fe5c8703882292b1d9c447dde69c157a3f6e235bae8709f586f2261e01a |
| SHA512 | 4ccab22f4581bd475784d6c38548dd13544813b37c9bbb81dec67785e6564a0282aa83d3dba66d7f3af73f9d954c98424042cdf290fd7cd14db78af7b68d7e0e |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
| MD5 | 4609d13275386c7eaed2c220af7437f3 |
| SHA1 | 2a5b0b1feb7fd7d2f2726038150d56961867eca1 |
| SHA256 | bc564fe5c8703882292b1d9c447dde69c157a3f6e235bae8709f586f2261e01a |
| SHA512 | 4ccab22f4581bd475784d6c38548dd13544813b37c9bbb81dec67785e6564a0282aa83d3dba66d7f3af73f9d954c98424042cdf290fd7cd14db78af7b68d7e0e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3877034.exe
| MD5 | 4609d13275386c7eaed2c220af7437f3 |
| SHA1 | 2a5b0b1feb7fd7d2f2726038150d56961867eca1 |
| SHA256 | bc564fe5c8703882292b1d9c447dde69c157a3f6e235bae8709f586f2261e01a |
| SHA512 | 4ccab22f4581bd475784d6c38548dd13544813b37c9bbb81dec67785e6564a0282aa83d3dba66d7f3af73f9d954c98424042cdf290fd7cd14db78af7b68d7e0e |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
| MD5 | 4638f4a6eedfb66c021537ac06c0a8db |
| SHA1 | 6b924a939c25673fa739132ed14502a0a1fc991f |
| SHA256 | a71f15a246ee293a10b6fd47823ee3692ea7fbcc616040396f2536c4ea20f55f |
| SHA512 | bb9410f1da94bdda34a103c8f409d82fb6b46fad2b370bf84416c89d28c3bf304695c638c2b5fedff00f6a5ecaa8da57521af0e37252043250513d99e3f3d17f |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
| MD5 | 4638f4a6eedfb66c021537ac06c0a8db |
| SHA1 | 6b924a939c25673fa739132ed14502a0a1fc991f |
| SHA256 | a71f15a246ee293a10b6fd47823ee3692ea7fbcc616040396f2536c4ea20f55f |
| SHA512 | bb9410f1da94bdda34a103c8f409d82fb6b46fad2b370bf84416c89d28c3bf304695c638c2b5fedff00f6a5ecaa8da57521af0e37252043250513d99e3f3d17f |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
| MD5 | 4638f4a6eedfb66c021537ac06c0a8db |
| SHA1 | 6b924a939c25673fa739132ed14502a0a1fc991f |
| SHA256 | a71f15a246ee293a10b6fd47823ee3692ea7fbcc616040396f2536c4ea20f55f |
| SHA512 | bb9410f1da94bdda34a103c8f409d82fb6b46fad2b370bf84416c89d28c3bf304695c638c2b5fedff00f6a5ecaa8da57521af0e37252043250513d99e3f3d17f |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8955508.exe
| MD5 | 4638f4a6eedfb66c021537ac06c0a8db |
| SHA1 | 6b924a939c25673fa739132ed14502a0a1fc991f |
| SHA256 | a71f15a246ee293a10b6fd47823ee3692ea7fbcc616040396f2536c4ea20f55f |
| SHA512 | bb9410f1da94bdda34a103c8f409d82fb6b46fad2b370bf84416c89d28c3bf304695c638c2b5fedff00f6a5ecaa8da57521af0e37252043250513d99e3f3d17f |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe
| MD5 | c895450ea2d0fa38603840096ce4c156 |
| SHA1 | 461af9da5ccf6a711598bd1bfeaa80470b84aad1 |
| SHA256 | 74db56153d4768f921c1074e2c4e35d6664bd139f00833283d663cfd1fe9529e |
| SHA512 | 6bfc940a7d01cb89478c4d0f98ec272080bd7a95d46dcd27a37e8c028085ec08dfa7f0ad997c779e842fe23eb354870c2ba3dec85db61e2827516340297c6510 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe
| MD5 | c895450ea2d0fa38603840096ce4c156 |
| SHA1 | 461af9da5ccf6a711598bd1bfeaa80470b84aad1 |
| SHA256 | 74db56153d4768f921c1074e2c4e35d6664bd139f00833283d663cfd1fe9529e |
| SHA512 | 6bfc940a7d01cb89478c4d0f98ec272080bd7a95d46dcd27a37e8c028085ec08dfa7f0ad997c779e842fe23eb354870c2ba3dec85db61e2827516340297c6510 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3727438.exe
| MD5 | c895450ea2d0fa38603840096ce4c156 |
| SHA1 | 461af9da5ccf6a711598bd1bfeaa80470b84aad1 |
| SHA256 | 74db56153d4768f921c1074e2c4e35d6664bd139f00833283d663cfd1fe9529e |
| SHA512 | 6bfc940a7d01cb89478c4d0f98ec272080bd7a95d46dcd27a37e8c028085ec08dfa7f0ad997c779e842fe23eb354870c2ba3dec85db61e2827516340297c6510 |
memory/2212-48-0x0000000000030000-0x000000000003A000-memory.dmp
memory/2212-49-0x000007FEF5D30000-0x000007FEF671C000-memory.dmp
memory/2212-50-0x000007FEF5D30000-0x000007FEF671C000-memory.dmp
memory/2212-51-0x000007FEF5D30000-0x000007FEF671C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
memory/2440-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2440-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2440-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2440-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2440-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2440-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2440-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2440-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2440-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2440-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1554351.exe
| MD5 | 92568f53430d734c7a157463aea44b9b |
| SHA1 | c88969ad10a79688e21c86b2f1cd59131bfd4ab1 |
| SHA256 | 4016b254c7589ab67dc93a38149ed483dbe3b2e044bf9a13d56e871ffbcaf800 |
| SHA512 | 8364aa2bc816f8fedd4cd6f5d4e995e1a6c94620176432be5f98dc4529abefbb5e71469a54dd030650ead5c1edc33f7cb106b6e3b935dd925753b84d6f88868a |