Analysis Overview
SHA256
b053491bc2d7b1f6878e3bdff73a07e8b1ea81daf965f7b93527b63c85a002a4
Threat Level: Known bad
The file b053491bc2d7b1f6878e3bdff73a07e8b1ea81daf965f7b93527b63c85a002a4 was found to be: Known bad.
Malicious Activity Summary
RedLine
Mystic
Amadey
Healer
Detects Healer an antivirus disabler dropper
Detect Mystic stealer payload
Modifies Windows Defender Real-time Protection settings
Checks computer location settings
Windows security modification
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Suspicious use of SetThreadContext
Launches sc.exe
Enumerates physical storage devices
Unsigned PE
Program crash
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:59
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:59
Reported
2023-10-10 21:46
Platform
win7-20230831-en
Max time kernel
118s
Max time network
130s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\b053491bc2d7b1f6878e3bdff73a07e8b1ea81daf965f7b93527b63c85a002a4.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2512 set thread context of 2884 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b053491bc2d7b1f6878e3bdff73a07e8b1ea81daf965f7b93527b63c85a002a4.exe
"C:\Users\Admin\AppData\Local\Temp\b053491bc2d7b1f6878e3bdff73a07e8b1ea81daf965f7b93527b63c85a002a4.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 36
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
| MD5 | 78b24c73a2b1512672ef1ae087bb4a3b |
| SHA1 | 78dd30e94b951fcc6ddb75c7b816c0019c50ab09 |
| SHA256 | 6228dfdfb15b31418c13b216168d8b6faf0f6a3373b6f321fe6b25b351fd3005 |
| SHA512 | 01b761c0c45425ef33e575e23f133e2f47c00acb7898a8c51bd13b1c440668924fa80421eeaedecb6baaf2abbb3d9102305a60c5d5d3def9f89a32490ada1135 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
| MD5 | 78b24c73a2b1512672ef1ae087bb4a3b |
| SHA1 | 78dd30e94b951fcc6ddb75c7b816c0019c50ab09 |
| SHA256 | 6228dfdfb15b31418c13b216168d8b6faf0f6a3373b6f321fe6b25b351fd3005 |
| SHA512 | 01b761c0c45425ef33e575e23f133e2f47c00acb7898a8c51bd13b1c440668924fa80421eeaedecb6baaf2abbb3d9102305a60c5d5d3def9f89a32490ada1135 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
| MD5 | 78b24c73a2b1512672ef1ae087bb4a3b |
| SHA1 | 78dd30e94b951fcc6ddb75c7b816c0019c50ab09 |
| SHA256 | 6228dfdfb15b31418c13b216168d8b6faf0f6a3373b6f321fe6b25b351fd3005 |
| SHA512 | 01b761c0c45425ef33e575e23f133e2f47c00acb7898a8c51bd13b1c440668924fa80421eeaedecb6baaf2abbb3d9102305a60c5d5d3def9f89a32490ada1135 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
| MD5 | 78b24c73a2b1512672ef1ae087bb4a3b |
| SHA1 | 78dd30e94b951fcc6ddb75c7b816c0019c50ab09 |
| SHA256 | 6228dfdfb15b31418c13b216168d8b6faf0f6a3373b6f321fe6b25b351fd3005 |
| SHA512 | 01b761c0c45425ef33e575e23f133e2f47c00acb7898a8c51bd13b1c440668924fa80421eeaedecb6baaf2abbb3d9102305a60c5d5d3def9f89a32490ada1135 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
| MD5 | 6629d00c6841ba6f621b0abe44029a56 |
| SHA1 | 0946a02402c0b23e79957ea8bbd433f571a3b442 |
| SHA256 | a52cf331834cc84eb8ba149a666bbff8f0dbcbafcc76af3e566b7ab8d36ca418 |
| SHA512 | 4ebd98d4e294c631b4de98f8bfb5d6aa6430ee32e31ed1f3eb979dc7130b77ef549191d71314f75c6f19682c250b80aee881efb9aacc4f4bce7f6c7150baca34 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
| MD5 | 6629d00c6841ba6f621b0abe44029a56 |
| SHA1 | 0946a02402c0b23e79957ea8bbd433f571a3b442 |
| SHA256 | a52cf331834cc84eb8ba149a666bbff8f0dbcbafcc76af3e566b7ab8d36ca418 |
| SHA512 | 4ebd98d4e294c631b4de98f8bfb5d6aa6430ee32e31ed1f3eb979dc7130b77ef549191d71314f75c6f19682c250b80aee881efb9aacc4f4bce7f6c7150baca34 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
| MD5 | 6629d00c6841ba6f621b0abe44029a56 |
| SHA1 | 0946a02402c0b23e79957ea8bbd433f571a3b442 |
| SHA256 | a52cf331834cc84eb8ba149a666bbff8f0dbcbafcc76af3e566b7ab8d36ca418 |
| SHA512 | 4ebd98d4e294c631b4de98f8bfb5d6aa6430ee32e31ed1f3eb979dc7130b77ef549191d71314f75c6f19682c250b80aee881efb9aacc4f4bce7f6c7150baca34 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
| MD5 | 6629d00c6841ba6f621b0abe44029a56 |
| SHA1 | 0946a02402c0b23e79957ea8bbd433f571a3b442 |
| SHA256 | a52cf331834cc84eb8ba149a666bbff8f0dbcbafcc76af3e566b7ab8d36ca418 |
| SHA512 | 4ebd98d4e294c631b4de98f8bfb5d6aa6430ee32e31ed1f3eb979dc7130b77ef549191d71314f75c6f19682c250b80aee881efb9aacc4f4bce7f6c7150baca34 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
| MD5 | d7b95b1e0f38b9bb951da6ad8094fcd9 |
| SHA1 | 3799ffe09ccb5c203919b4c704a924da217db456 |
| SHA256 | c7b94a54ff9c7bd3e0760e8dd80935d78304374d3a5e6a94b676931ceab5115b |
| SHA512 | 24ee82fe222c60304dd0528586bc7f1a421a62c9c72389a5cc8d00cd2dcff8942316163437a19595b7160da39c3c670d3d976204a228a442182ff3dc86faec57 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
| MD5 | d7b95b1e0f38b9bb951da6ad8094fcd9 |
| SHA1 | 3799ffe09ccb5c203919b4c704a924da217db456 |
| SHA256 | c7b94a54ff9c7bd3e0760e8dd80935d78304374d3a5e6a94b676931ceab5115b |
| SHA512 | 24ee82fe222c60304dd0528586bc7f1a421a62c9c72389a5cc8d00cd2dcff8942316163437a19595b7160da39c3c670d3d976204a228a442182ff3dc86faec57 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
| MD5 | d7b95b1e0f38b9bb951da6ad8094fcd9 |
| SHA1 | 3799ffe09ccb5c203919b4c704a924da217db456 |
| SHA256 | c7b94a54ff9c7bd3e0760e8dd80935d78304374d3a5e6a94b676931ceab5115b |
| SHA512 | 24ee82fe222c60304dd0528586bc7f1a421a62c9c72389a5cc8d00cd2dcff8942316163437a19595b7160da39c3c670d3d976204a228a442182ff3dc86faec57 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
| MD5 | d7b95b1e0f38b9bb951da6ad8094fcd9 |
| SHA1 | 3799ffe09ccb5c203919b4c704a924da217db456 |
| SHA256 | c7b94a54ff9c7bd3e0760e8dd80935d78304374d3a5e6a94b676931ceab5115b |
| SHA512 | 24ee82fe222c60304dd0528586bc7f1a421a62c9c72389a5cc8d00cd2dcff8942316163437a19595b7160da39c3c670d3d976204a228a442182ff3dc86faec57 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
| MD5 | 27da62f12e2a10702440b3421b9ec55f |
| SHA1 | bcc8bd98bd55b92e8d30bbee799d2b62e34c28a4 |
| SHA256 | a79515c8cbf4298e31c312a40c0f536c676afee2301cb7e6d50ce9bbf8720641 |
| SHA512 | 933341b184450744b931fd993bab55b67712ff04c1fab6a0f0cd5474f9aab56f644c577726ad9f3eea62d8ecde548be17c882c7f62bee15fbec615894117b260 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
| MD5 | 27da62f12e2a10702440b3421b9ec55f |
| SHA1 | bcc8bd98bd55b92e8d30bbee799d2b62e34c28a4 |
| SHA256 | a79515c8cbf4298e31c312a40c0f536c676afee2301cb7e6d50ce9bbf8720641 |
| SHA512 | 933341b184450744b931fd993bab55b67712ff04c1fab6a0f0cd5474f9aab56f644c577726ad9f3eea62d8ecde548be17c882c7f62bee15fbec615894117b260 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
| MD5 | 27da62f12e2a10702440b3421b9ec55f |
| SHA1 | bcc8bd98bd55b92e8d30bbee799d2b62e34c28a4 |
| SHA256 | a79515c8cbf4298e31c312a40c0f536c676afee2301cb7e6d50ce9bbf8720641 |
| SHA512 | 933341b184450744b931fd993bab55b67712ff04c1fab6a0f0cd5474f9aab56f644c577726ad9f3eea62d8ecde548be17c882c7f62bee15fbec615894117b260 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
| MD5 | 27da62f12e2a10702440b3421b9ec55f |
| SHA1 | bcc8bd98bd55b92e8d30bbee799d2b62e34c28a4 |
| SHA256 | a79515c8cbf4298e31c312a40c0f536c676afee2301cb7e6d50ce9bbf8720641 |
| SHA512 | 933341b184450744b931fd993bab55b67712ff04c1fab6a0f0cd5474f9aab56f644c577726ad9f3eea62d8ecde548be17c882c7f62bee15fbec615894117b260 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe
| MD5 | 3cb1768049acea810f774e5322411bc2 |
| SHA1 | e04d19f0127e366611919b226a2e34b7b655299c |
| SHA256 | df99b1482b471387ab39fd89a701dd9a7027d1ca8e6970b7e46329d257df369a |
| SHA512 | caf238337af1288f8fbf76ba8fa9dfe788828cf1a1185355cdfb7c890fd28be00b02ab923b1d294a8aac3a08ec615d8e9e2e87f44ef6c651d7cd7ea151f6cb76 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe
| MD5 | 3cb1768049acea810f774e5322411bc2 |
| SHA1 | e04d19f0127e366611919b226a2e34b7b655299c |
| SHA256 | df99b1482b471387ab39fd89a701dd9a7027d1ca8e6970b7e46329d257df369a |
| SHA512 | caf238337af1288f8fbf76ba8fa9dfe788828cf1a1185355cdfb7c890fd28be00b02ab923b1d294a8aac3a08ec615d8e9e2e87f44ef6c651d7cd7ea151f6cb76 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe
| MD5 | 3cb1768049acea810f774e5322411bc2 |
| SHA1 | e04d19f0127e366611919b226a2e34b7b655299c |
| SHA256 | df99b1482b471387ab39fd89a701dd9a7027d1ca8e6970b7e46329d257df369a |
| SHA512 | caf238337af1288f8fbf76ba8fa9dfe788828cf1a1185355cdfb7c890fd28be00b02ab923b1d294a8aac3a08ec615d8e9e2e87f44ef6c651d7cd7ea151f6cb76 |
memory/2396-48-0x00000000001A0000-0x00000000001AA000-memory.dmp
memory/2396-49-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp
memory/2396-50-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp
memory/2396-51-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
memory/2884-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2884-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2884-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2884-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2884-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2884-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2884-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2884-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2884-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2884-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:59
Reported
2023-10-10 21:47
Platform
win10v2004-20230915-en
Max time kernel
141s
Max time network
168s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2050351.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1934427.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\b053491bc2d7b1f6878e3bdff73a07e8b1ea81daf965f7b93527b63c85a002a4.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2568 set thread context of 3488 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 2896 set thread context of 3132 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8964185.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b053491bc2d7b1f6878e3bdff73a07e8b1ea81daf965f7b93527b63c85a002a4.exe
"C:\Users\Admin\AppData\Local\Temp\b053491bc2d7b1f6878e3bdff73a07e8b1ea81daf965f7b93527b63c85a002a4.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2568 -ip 2568
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3488 -ip 3488
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 148
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8964185.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8964185.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2896 -ip 2896
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2050351.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2050351.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1934427.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1934427.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1549153.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1549153.exe
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 254.109.26.67.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
| MD5 | 78b24c73a2b1512672ef1ae087bb4a3b |
| SHA1 | 78dd30e94b951fcc6ddb75c7b816c0019c50ab09 |
| SHA256 | 6228dfdfb15b31418c13b216168d8b6faf0f6a3373b6f321fe6b25b351fd3005 |
| SHA512 | 01b761c0c45425ef33e575e23f133e2f47c00acb7898a8c51bd13b1c440668924fa80421eeaedecb6baaf2abbb3d9102305a60c5d5d3def9f89a32490ada1135 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5760717.exe
| MD5 | 78b24c73a2b1512672ef1ae087bb4a3b |
| SHA1 | 78dd30e94b951fcc6ddb75c7b816c0019c50ab09 |
| SHA256 | 6228dfdfb15b31418c13b216168d8b6faf0f6a3373b6f321fe6b25b351fd3005 |
| SHA512 | 01b761c0c45425ef33e575e23f133e2f47c00acb7898a8c51bd13b1c440668924fa80421eeaedecb6baaf2abbb3d9102305a60c5d5d3def9f89a32490ada1135 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
| MD5 | 6629d00c6841ba6f621b0abe44029a56 |
| SHA1 | 0946a02402c0b23e79957ea8bbd433f571a3b442 |
| SHA256 | a52cf331834cc84eb8ba149a666bbff8f0dbcbafcc76af3e566b7ab8d36ca418 |
| SHA512 | 4ebd98d4e294c631b4de98f8bfb5d6aa6430ee32e31ed1f3eb979dc7130b77ef549191d71314f75c6f19682c250b80aee881efb9aacc4f4bce7f6c7150baca34 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3489905.exe
| MD5 | 6629d00c6841ba6f621b0abe44029a56 |
| SHA1 | 0946a02402c0b23e79957ea8bbd433f571a3b442 |
| SHA256 | a52cf331834cc84eb8ba149a666bbff8f0dbcbafcc76af3e566b7ab8d36ca418 |
| SHA512 | 4ebd98d4e294c631b4de98f8bfb5d6aa6430ee32e31ed1f3eb979dc7130b77ef549191d71314f75c6f19682c250b80aee881efb9aacc4f4bce7f6c7150baca34 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
| MD5 | d7b95b1e0f38b9bb951da6ad8094fcd9 |
| SHA1 | 3799ffe09ccb5c203919b4c704a924da217db456 |
| SHA256 | c7b94a54ff9c7bd3e0760e8dd80935d78304374d3a5e6a94b676931ceab5115b |
| SHA512 | 24ee82fe222c60304dd0528586bc7f1a421a62c9c72389a5cc8d00cd2dcff8942316163437a19595b7160da39c3c670d3d976204a228a442182ff3dc86faec57 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6533410.exe
| MD5 | d7b95b1e0f38b9bb951da6ad8094fcd9 |
| SHA1 | 3799ffe09ccb5c203919b4c704a924da217db456 |
| SHA256 | c7b94a54ff9c7bd3e0760e8dd80935d78304374d3a5e6a94b676931ceab5115b |
| SHA512 | 24ee82fe222c60304dd0528586bc7f1a421a62c9c72389a5cc8d00cd2dcff8942316163437a19595b7160da39c3c670d3d976204a228a442182ff3dc86faec57 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
| MD5 | 27da62f12e2a10702440b3421b9ec55f |
| SHA1 | bcc8bd98bd55b92e8d30bbee799d2b62e34c28a4 |
| SHA256 | a79515c8cbf4298e31c312a40c0f536c676afee2301cb7e6d50ce9bbf8720641 |
| SHA512 | 933341b184450744b931fd993bab55b67712ff04c1fab6a0f0cd5474f9aab56f644c577726ad9f3eea62d8ecde548be17c882c7f62bee15fbec615894117b260 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7463505.exe
| MD5 | 27da62f12e2a10702440b3421b9ec55f |
| SHA1 | bcc8bd98bd55b92e8d30bbee799d2b62e34c28a4 |
| SHA256 | a79515c8cbf4298e31c312a40c0f536c676afee2301cb7e6d50ce9bbf8720641 |
| SHA512 | 933341b184450744b931fd993bab55b67712ff04c1fab6a0f0cd5474f9aab56f644c577726ad9f3eea62d8ecde548be17c882c7f62bee15fbec615894117b260 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe
| MD5 | 3cb1768049acea810f774e5322411bc2 |
| SHA1 | e04d19f0127e366611919b226a2e34b7b655299c |
| SHA256 | df99b1482b471387ab39fd89a701dd9a7027d1ca8e6970b7e46329d257df369a |
| SHA512 | caf238337af1288f8fbf76ba8fa9dfe788828cf1a1185355cdfb7c890fd28be00b02ab923b1d294a8aac3a08ec615d8e9e2e87f44ef6c651d7cd7ea151f6cb76 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3409252.exe
| MD5 | 3cb1768049acea810f774e5322411bc2 |
| SHA1 | e04d19f0127e366611919b226a2e34b7b655299c |
| SHA256 | df99b1482b471387ab39fd89a701dd9a7027d1ca8e6970b7e46329d257df369a |
| SHA512 | caf238337af1288f8fbf76ba8fa9dfe788828cf1a1185355cdfb7c890fd28be00b02ab923b1d294a8aac3a08ec615d8e9e2e87f44ef6c651d7cd7ea151f6cb76 |
memory/3816-35-0x0000000000E20000-0x0000000000E2A000-memory.dmp
memory/3816-36-0x00007FFA9E710000-0x00007FFA9F1D1000-memory.dmp
memory/3816-38-0x00007FFA9E710000-0x00007FFA9F1D1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6400599.exe
| MD5 | e0ef205ef6dd80d5e513acc4a6a95f01 |
| SHA1 | 1a69152c9ca1707b7a7dfa4713fe0d4519d34428 |
| SHA256 | d4aa55e2c3bf2b3681be33209898ac4b2c9445a67f5e2b577f9bbff5b768004e |
| SHA512 | 1f50ca7c5a5f70be2b19ed89399f24ac27323cfc8e0f1435455339575f2314e0eecb8af030045463753c6f91da9602e97fe69baff06a3e9acb6fbdba14e695b0 |
memory/3488-42-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3488-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3488-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3488-46-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8964185.exe
| MD5 | 1eb91a2b62117852c2e7807150925f58 |
| SHA1 | 90e1e3133baffadc219a16d0bafdbfb235c58aa3 |
| SHA256 | ad5aace42c9e8010c6163f8a4514c72912e1aa3d8e13e97011eb86415946cbbd |
| SHA512 | 9acf6670dcf5ae7d30903b0d08bf407c119bb8168fc3428a4edf8e4c2f1284096e34264c557444c33fc2b4dd15a2b0f93eb5ad4b452aedd040eaaa1d7e005258 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8964185.exe
| MD5 | 1eb91a2b62117852c2e7807150925f58 |
| SHA1 | 90e1e3133baffadc219a16d0bafdbfb235c58aa3 |
| SHA256 | ad5aace42c9e8010c6163f8a4514c72912e1aa3d8e13e97011eb86415946cbbd |
| SHA512 | 9acf6670dcf5ae7d30903b0d08bf407c119bb8168fc3428a4edf8e4c2f1284096e34264c557444c33fc2b4dd15a2b0f93eb5ad4b452aedd040eaaa1d7e005258 |
memory/3132-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3132-51-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/3132-52-0x0000000002BD0000-0x0000000002BD6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2050351.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2050351.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/3132-63-0x0000000005990000-0x0000000005FA8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1934427.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1934427.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/3132-71-0x0000000005480000-0x000000000558A000-memory.dmp
memory/3132-73-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/3132-72-0x0000000005370000-0x0000000005382000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
memory/3132-80-0x00000000053D0000-0x000000000540C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1549153.exe
| MD5 | c71836d9124cd4ebdecf2045664aae6c |
| SHA1 | fdb476288ba3088f6788ed78d80e35ea7974c36a |
| SHA256 | a4643c3e5119a9f5a52740da6a4cc3f15f83b1cb1c00f6b6450a488e1543d05c |
| SHA512 | 652d9856594e629fe46034ed1d62e6f94c4adbb58c55d3b363fc79dfdaab6c26a84f8a9b84ef6ac8b81003fa85ac7666579009fcdb46487645a5a0325bff15f0 |
memory/3132-84-0x0000000005420000-0x000000000546C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1549153.exe
| MD5 | c71836d9124cd4ebdecf2045664aae6c |
| SHA1 | fdb476288ba3088f6788ed78d80e35ea7974c36a |
| SHA256 | a4643c3e5119a9f5a52740da6a4cc3f15f83b1cb1c00f6b6450a488e1543d05c |
| SHA512 | 652d9856594e629fe46034ed1d62e6f94c4adbb58c55d3b363fc79dfdaab6c26a84f8a9b84ef6ac8b81003fa85ac7666579009fcdb46487645a5a0325bff15f0 |
memory/3132-86-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/3132-87-0x0000000002C00000-0x0000000002C10000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |