Analysis Overview
SHA256
4cdd112fcec3a06ca471941a426b22f59431c210ee3cbbfa42aad61343e63e19
Threat Level: Known bad
The file 4cdd112fcec3a06ca471941a426b22f59431c210ee3cbbfa42aad61343e63e19 was found to be: Known bad.
Malicious Activity Summary
Amadey
Detect Mystic stealer payload
Detects Healer an antivirus disabler dropper
RedLine
Healer
Mystic
Modifies Windows Defender Real-time Protection settings
Checks computer location settings
Executes dropped EXE
Windows security modification
Loads dropped DLL
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Program crash
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:50
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:50
Reported
2023-10-10 21:26
Platform
win10v2004-20230915-en
Max time kernel
151s
Max time network
164s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7556342.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8577110.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\4cdd112fcec3a06ca471941a426b22f59431c210ee3cbbfa42aad61343e63e19.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1816 set thread context of 5036 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3384 set thread context of 1456 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1924586.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\4cdd112fcec3a06ca471941a426b22f59431c210ee3cbbfa42aad61343e63e19.exe
"C:\Users\Admin\AppData\Local\Temp\4cdd112fcec3a06ca471941a426b22f59431c210ee3cbbfa42aad61343e63e19.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1816 -ip 1816
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5036 -ip 5036
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 592
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1924586.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1924586.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3384 -ip 3384
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 156
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7556342.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7556342.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8577110.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8577110.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0441904.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0441904.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 3.17.178.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
| MD5 | 1f65ab4da30e9b04d84b7915db39f4a1 |
| SHA1 | f96ec434ae23935d5162ac498cc33345c1da0694 |
| SHA256 | fcf8b3334a4c5863aa1006ca4674c344f1f39c2ca19a010722671494c14e985b |
| SHA512 | a381f4389b98da13e9fc4fe68cf80d059b4e014bbadb1329738717051d9c0fc1b4dc4915354b8cbb5728363e553a891b62522b8e66083ad3bc656d552eaa3af9 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
| MD5 | 1f65ab4da30e9b04d84b7915db39f4a1 |
| SHA1 | f96ec434ae23935d5162ac498cc33345c1da0694 |
| SHA256 | fcf8b3334a4c5863aa1006ca4674c344f1f39c2ca19a010722671494c14e985b |
| SHA512 | a381f4389b98da13e9fc4fe68cf80d059b4e014bbadb1329738717051d9c0fc1b4dc4915354b8cbb5728363e553a891b62522b8e66083ad3bc656d552eaa3af9 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
| MD5 | f71f837667812889e57db8b786a0aff0 |
| SHA1 | d8e6d16463e2bec441ed50cda36966f7022672dc |
| SHA256 | ad6b5ffcb6755d42ddd1e043bfd03819ad3302cffcc3952745fe23d39401510e |
| SHA512 | 3088f89372f7053310a9c0c9ca7f7857d12685a3b3d97bf62c705e32b1cdee036c81bec8e46c773506930b45d82cc8645d3855e7fc1f5f210b8ac996196b8f53 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
| MD5 | f71f837667812889e57db8b786a0aff0 |
| SHA1 | d8e6d16463e2bec441ed50cda36966f7022672dc |
| SHA256 | ad6b5ffcb6755d42ddd1e043bfd03819ad3302cffcc3952745fe23d39401510e |
| SHA512 | 3088f89372f7053310a9c0c9ca7f7857d12685a3b3d97bf62c705e32b1cdee036c81bec8e46c773506930b45d82cc8645d3855e7fc1f5f210b8ac996196b8f53 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
| MD5 | 78f56ae5dee9a413331cd6702404e8ce |
| SHA1 | 2f565fa995f2e53f6c700c8ac8e830fa35439d83 |
| SHA256 | fa71d82a3b1712e0cfeac0f07682a21ac77dcc8f137cbf7533cebf4515dbe7ef |
| SHA512 | 745250e52bf9a1415178255b758946a2677b39d5f64268cd8318be9961c969cd0212f41bbac19cb0d4854e7381824ad013438592ff626df86df5c51e7c9ecb79 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
| MD5 | 78f56ae5dee9a413331cd6702404e8ce |
| SHA1 | 2f565fa995f2e53f6c700c8ac8e830fa35439d83 |
| SHA256 | fa71d82a3b1712e0cfeac0f07682a21ac77dcc8f137cbf7533cebf4515dbe7ef |
| SHA512 | 745250e52bf9a1415178255b758946a2677b39d5f64268cd8318be9961c969cd0212f41bbac19cb0d4854e7381824ad013438592ff626df86df5c51e7c9ecb79 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
| MD5 | 5aef654b484faa27b1663dd681a48aa3 |
| SHA1 | 927481059577b28bfa7990ef927650c22872e903 |
| SHA256 | 16e4f640c04b005f712bb451d0f9156061aef98854ab0b22e00407c425dda9cb |
| SHA512 | b91850153ccec3239fd870f9bb42604ab20af8b5314c00999be2dce491f5c8e95e0b7d97040feb8fbc41fc38cc6eee6f6b01cf70dd55b90107b833b786e784f3 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
| MD5 | 5aef654b484faa27b1663dd681a48aa3 |
| SHA1 | 927481059577b28bfa7990ef927650c22872e903 |
| SHA256 | 16e4f640c04b005f712bb451d0f9156061aef98854ab0b22e00407c425dda9cb |
| SHA512 | b91850153ccec3239fd870f9bb42604ab20af8b5314c00999be2dce491f5c8e95e0b7d97040feb8fbc41fc38cc6eee6f6b01cf70dd55b90107b833b786e784f3 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe
| MD5 | ba5afc363bb86d0b1288238fe497d0c8 |
| SHA1 | edf08b6fd20be6ab8eb76fdd81b1992033d30d25 |
| SHA256 | 25652893318851800c1473c6f4be6e27808926c5e1736a176e93903e5bf9cdfe |
| SHA512 | 35b4f8885b2fcdff38439ca28ce3bc4ee9eec64f20e4c036e61ca4ab330e8b9965b98247c22ffc25de094ece2fe34f4ec06a5cd7597c4f6d778aa56bd01ab26a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe
| MD5 | ba5afc363bb86d0b1288238fe497d0c8 |
| SHA1 | edf08b6fd20be6ab8eb76fdd81b1992033d30d25 |
| SHA256 | 25652893318851800c1473c6f4be6e27808926c5e1736a176e93903e5bf9cdfe |
| SHA512 | 35b4f8885b2fcdff38439ca28ce3bc4ee9eec64f20e4c036e61ca4ab330e8b9965b98247c22ffc25de094ece2fe34f4ec06a5cd7597c4f6d778aa56bd01ab26a |
memory/2376-35-0x0000000000F80000-0x0000000000F8A000-memory.dmp
memory/2376-36-0x00007FF9B96E0000-0x00007FF9BA1A1000-memory.dmp
memory/2376-37-0x00007FF9B96E0000-0x00007FF9BA1A1000-memory.dmp
memory/2376-39-0x00007FF9B96E0000-0x00007FF9BA1A1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
memory/5036-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5036-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5036-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5036-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1924586.exe
| MD5 | 77c7c67087ea5c46ef4b99993ae2ad3e |
| SHA1 | 40b7091a5f9926d2de7e8e227b438e4cebb22561 |
| SHA256 | d6b637422da0de0d9a778aaa9d0a26d39a46df63e6750f2c00747cb5564162d2 |
| SHA512 | 25efaacd00f1fbb7794867b9a698a5e9c2f8b71bbc73144a22ac0fd70f56d4cba4e5c8172898e64cfd05d9a520898d6f7dcc0e18e160021ed01d2967e1376840 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1924586.exe
| MD5 | 77c7c67087ea5c46ef4b99993ae2ad3e |
| SHA1 | 40b7091a5f9926d2de7e8e227b438e4cebb22561 |
| SHA256 | d6b637422da0de0d9a778aaa9d0a26d39a46df63e6750f2c00747cb5564162d2 |
| SHA512 | 25efaacd00f1fbb7794867b9a698a5e9c2f8b71bbc73144a22ac0fd70f56d4cba4e5c8172898e64cfd05d9a520898d6f7dcc0e18e160021ed01d2967e1376840 |
memory/1456-51-0x0000000000400000-0x0000000000430000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7556342.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7556342.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/1456-57-0x0000000074140000-0x00000000748F0000-memory.dmp
memory/1456-58-0x0000000002500000-0x0000000002506000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8577110.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8577110.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/1456-71-0x0000000005190000-0x00000000057A8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/1456-79-0x0000000004C80000-0x0000000004D8A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/1456-80-0x00000000049E0000-0x00000000049F2000-memory.dmp
memory/1456-81-0x0000000004A60000-0x0000000004A70000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0441904.exe
| MD5 | ba0e3de65b6fe06804e24d099a7fe025 |
| SHA1 | 3fd017464911f317bbeaf65e515fb5857375dfcb |
| SHA256 | 51035457b0ee29170f08ca26013e79c3c97f995805ce015baf412e26a053d198 |
| SHA512 | f8430c10ff12344e1290a87577719c820fd70ef7ea584168df825500b061aeb9adc40bc9f2ed6a5451fb26b2e1c9181febbe6e902dc2c71d3907a2ab7c148b4b |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0441904.exe
| MD5 | ba0e3de65b6fe06804e24d099a7fe025 |
| SHA1 | 3fd017464911f317bbeaf65e515fb5857375dfcb |
| SHA256 | 51035457b0ee29170f08ca26013e79c3c97f995805ce015baf412e26a053d198 |
| SHA512 | f8430c10ff12344e1290a87577719c820fd70ef7ea584168df825500b061aeb9adc40bc9f2ed6a5451fb26b2e1c9181febbe6e902dc2c71d3907a2ab7c148b4b |
memory/1456-85-0x0000000004B70000-0x0000000004BAC000-memory.dmp
memory/1456-86-0x0000000004BB0000-0x0000000004BFC000-memory.dmp
memory/1456-87-0x0000000074140000-0x00000000748F0000-memory.dmp
memory/1456-88-0x0000000004A60000-0x0000000004A70000-memory.dmp
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:50
Reported
2023-10-10 21:28
Platform
win7-20230831-en
Max time kernel
120s
Max time network
127s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\4cdd112fcec3a06ca471941a426b22f59431c210ee3cbbfa42aad61343e63e19.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1820 set thread context of 1632 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\4cdd112fcec3a06ca471941a426b22f59431c210ee3cbbfa42aad61343e63e19.exe
"C:\Users\Admin\AppData\Local\Temp\4cdd112fcec3a06ca471941a426b22f59431c210ee3cbbfa42aad61343e63e19.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 36
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
| MD5 | 1f65ab4da30e9b04d84b7915db39f4a1 |
| SHA1 | f96ec434ae23935d5162ac498cc33345c1da0694 |
| SHA256 | fcf8b3334a4c5863aa1006ca4674c344f1f39c2ca19a010722671494c14e985b |
| SHA512 | a381f4389b98da13e9fc4fe68cf80d059b4e014bbadb1329738717051d9c0fc1b4dc4915354b8cbb5728363e553a891b62522b8e66083ad3bc656d552eaa3af9 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
| MD5 | 1f65ab4da30e9b04d84b7915db39f4a1 |
| SHA1 | f96ec434ae23935d5162ac498cc33345c1da0694 |
| SHA256 | fcf8b3334a4c5863aa1006ca4674c344f1f39c2ca19a010722671494c14e985b |
| SHA512 | a381f4389b98da13e9fc4fe68cf80d059b4e014bbadb1329738717051d9c0fc1b4dc4915354b8cbb5728363e553a891b62522b8e66083ad3bc656d552eaa3af9 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
| MD5 | 1f65ab4da30e9b04d84b7915db39f4a1 |
| SHA1 | f96ec434ae23935d5162ac498cc33345c1da0694 |
| SHA256 | fcf8b3334a4c5863aa1006ca4674c344f1f39c2ca19a010722671494c14e985b |
| SHA512 | a381f4389b98da13e9fc4fe68cf80d059b4e014bbadb1329738717051d9c0fc1b4dc4915354b8cbb5728363e553a891b62522b8e66083ad3bc656d552eaa3af9 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0709470.exe
| MD5 | 1f65ab4da30e9b04d84b7915db39f4a1 |
| SHA1 | f96ec434ae23935d5162ac498cc33345c1da0694 |
| SHA256 | fcf8b3334a4c5863aa1006ca4674c344f1f39c2ca19a010722671494c14e985b |
| SHA512 | a381f4389b98da13e9fc4fe68cf80d059b4e014bbadb1329738717051d9c0fc1b4dc4915354b8cbb5728363e553a891b62522b8e66083ad3bc656d552eaa3af9 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
| MD5 | f71f837667812889e57db8b786a0aff0 |
| SHA1 | d8e6d16463e2bec441ed50cda36966f7022672dc |
| SHA256 | ad6b5ffcb6755d42ddd1e043bfd03819ad3302cffcc3952745fe23d39401510e |
| SHA512 | 3088f89372f7053310a9c0c9ca7f7857d12685a3b3d97bf62c705e32b1cdee036c81bec8e46c773506930b45d82cc8645d3855e7fc1f5f210b8ac996196b8f53 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
| MD5 | f71f837667812889e57db8b786a0aff0 |
| SHA1 | d8e6d16463e2bec441ed50cda36966f7022672dc |
| SHA256 | ad6b5ffcb6755d42ddd1e043bfd03819ad3302cffcc3952745fe23d39401510e |
| SHA512 | 3088f89372f7053310a9c0c9ca7f7857d12685a3b3d97bf62c705e32b1cdee036c81bec8e46c773506930b45d82cc8645d3855e7fc1f5f210b8ac996196b8f53 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
| MD5 | f71f837667812889e57db8b786a0aff0 |
| SHA1 | d8e6d16463e2bec441ed50cda36966f7022672dc |
| SHA256 | ad6b5ffcb6755d42ddd1e043bfd03819ad3302cffcc3952745fe23d39401510e |
| SHA512 | 3088f89372f7053310a9c0c9ca7f7857d12685a3b3d97bf62c705e32b1cdee036c81bec8e46c773506930b45d82cc8645d3855e7fc1f5f210b8ac996196b8f53 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5854622.exe
| MD5 | f71f837667812889e57db8b786a0aff0 |
| SHA1 | d8e6d16463e2bec441ed50cda36966f7022672dc |
| SHA256 | ad6b5ffcb6755d42ddd1e043bfd03819ad3302cffcc3952745fe23d39401510e |
| SHA512 | 3088f89372f7053310a9c0c9ca7f7857d12685a3b3d97bf62c705e32b1cdee036c81bec8e46c773506930b45d82cc8645d3855e7fc1f5f210b8ac996196b8f53 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
| MD5 | 78f56ae5dee9a413331cd6702404e8ce |
| SHA1 | 2f565fa995f2e53f6c700c8ac8e830fa35439d83 |
| SHA256 | fa71d82a3b1712e0cfeac0f07682a21ac77dcc8f137cbf7533cebf4515dbe7ef |
| SHA512 | 745250e52bf9a1415178255b758946a2677b39d5f64268cd8318be9961c969cd0212f41bbac19cb0d4854e7381824ad013438592ff626df86df5c51e7c9ecb79 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
| MD5 | 78f56ae5dee9a413331cd6702404e8ce |
| SHA1 | 2f565fa995f2e53f6c700c8ac8e830fa35439d83 |
| SHA256 | fa71d82a3b1712e0cfeac0f07682a21ac77dcc8f137cbf7533cebf4515dbe7ef |
| SHA512 | 745250e52bf9a1415178255b758946a2677b39d5f64268cd8318be9961c969cd0212f41bbac19cb0d4854e7381824ad013438592ff626df86df5c51e7c9ecb79 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
| MD5 | 78f56ae5dee9a413331cd6702404e8ce |
| SHA1 | 2f565fa995f2e53f6c700c8ac8e830fa35439d83 |
| SHA256 | fa71d82a3b1712e0cfeac0f07682a21ac77dcc8f137cbf7533cebf4515dbe7ef |
| SHA512 | 745250e52bf9a1415178255b758946a2677b39d5f64268cd8318be9961c969cd0212f41bbac19cb0d4854e7381824ad013438592ff626df86df5c51e7c9ecb79 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9282105.exe
| MD5 | 78f56ae5dee9a413331cd6702404e8ce |
| SHA1 | 2f565fa995f2e53f6c700c8ac8e830fa35439d83 |
| SHA256 | fa71d82a3b1712e0cfeac0f07682a21ac77dcc8f137cbf7533cebf4515dbe7ef |
| SHA512 | 745250e52bf9a1415178255b758946a2677b39d5f64268cd8318be9961c969cd0212f41bbac19cb0d4854e7381824ad013438592ff626df86df5c51e7c9ecb79 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
| MD5 | 5aef654b484faa27b1663dd681a48aa3 |
| SHA1 | 927481059577b28bfa7990ef927650c22872e903 |
| SHA256 | 16e4f640c04b005f712bb451d0f9156061aef98854ab0b22e00407c425dda9cb |
| SHA512 | b91850153ccec3239fd870f9bb42604ab20af8b5314c00999be2dce491f5c8e95e0b7d97040feb8fbc41fc38cc6eee6f6b01cf70dd55b90107b833b786e784f3 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
| MD5 | 5aef654b484faa27b1663dd681a48aa3 |
| SHA1 | 927481059577b28bfa7990ef927650c22872e903 |
| SHA256 | 16e4f640c04b005f712bb451d0f9156061aef98854ab0b22e00407c425dda9cb |
| SHA512 | b91850153ccec3239fd870f9bb42604ab20af8b5314c00999be2dce491f5c8e95e0b7d97040feb8fbc41fc38cc6eee6f6b01cf70dd55b90107b833b786e784f3 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
| MD5 | 5aef654b484faa27b1663dd681a48aa3 |
| SHA1 | 927481059577b28bfa7990ef927650c22872e903 |
| SHA256 | 16e4f640c04b005f712bb451d0f9156061aef98854ab0b22e00407c425dda9cb |
| SHA512 | b91850153ccec3239fd870f9bb42604ab20af8b5314c00999be2dce491f5c8e95e0b7d97040feb8fbc41fc38cc6eee6f6b01cf70dd55b90107b833b786e784f3 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6233666.exe
| MD5 | 5aef654b484faa27b1663dd681a48aa3 |
| SHA1 | 927481059577b28bfa7990ef927650c22872e903 |
| SHA256 | 16e4f640c04b005f712bb451d0f9156061aef98854ab0b22e00407c425dda9cb |
| SHA512 | b91850153ccec3239fd870f9bb42604ab20af8b5314c00999be2dce491f5c8e95e0b7d97040feb8fbc41fc38cc6eee6f6b01cf70dd55b90107b833b786e784f3 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe
| MD5 | ba5afc363bb86d0b1288238fe497d0c8 |
| SHA1 | edf08b6fd20be6ab8eb76fdd81b1992033d30d25 |
| SHA256 | 25652893318851800c1473c6f4be6e27808926c5e1736a176e93903e5bf9cdfe |
| SHA512 | 35b4f8885b2fcdff38439ca28ce3bc4ee9eec64f20e4c036e61ca4ab330e8b9965b98247c22ffc25de094ece2fe34f4ec06a5cd7597c4f6d778aa56bd01ab26a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe
| MD5 | ba5afc363bb86d0b1288238fe497d0c8 |
| SHA1 | edf08b6fd20be6ab8eb76fdd81b1992033d30d25 |
| SHA256 | 25652893318851800c1473c6f4be6e27808926c5e1736a176e93903e5bf9cdfe |
| SHA512 | 35b4f8885b2fcdff38439ca28ce3bc4ee9eec64f20e4c036e61ca4ab330e8b9965b98247c22ffc25de094ece2fe34f4ec06a5cd7597c4f6d778aa56bd01ab26a |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3031715.exe
| MD5 | ba5afc363bb86d0b1288238fe497d0c8 |
| SHA1 | edf08b6fd20be6ab8eb76fdd81b1992033d30d25 |
| SHA256 | 25652893318851800c1473c6f4be6e27808926c5e1736a176e93903e5bf9cdfe |
| SHA512 | 35b4f8885b2fcdff38439ca28ce3bc4ee9eec64f20e4c036e61ca4ab330e8b9965b98247c22ffc25de094ece2fe34f4ec06a5cd7597c4f6d778aa56bd01ab26a |
memory/2544-48-0x0000000000FB0000-0x0000000000FBA000-memory.dmp
memory/2544-49-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/2544-50-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
memory/2544-51-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
memory/1632-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1632-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1632-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1632-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1632-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1632-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1632-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/1632-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1632-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1632-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1648068.exe
| MD5 | 75bb5293eb4a112efd242fdc1ee652a6 |
| SHA1 | f6bc7886d3288b8dd16a9ccf9df122f0edb637e0 |
| SHA256 | f4ba030ddff0482c1a86ac362b9528457653b848a24c17c8d477131979ab9466 |
| SHA512 | 59d9bd0084f88b800b2f738b85eee6b328ff33a5c6cfbd4008801c9520278429718e7ef3fee1502ce6534d7ded00b279750421a32e1340fcd9ac73b52df3e7cb |