Analysis
-
max time kernel
150s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:01
Static task
static1
Behavioral task
behavioral1
Sample
a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe
Resource
win7-20230831-en
General
-
Target
a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe
-
Size
994KB
-
MD5
6828e2a39ac159ee24d8bcb13ad6498f
-
SHA1
b1c8875d86cb392c13ec33c501aee1a08ee97c13
-
SHA256
a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5
-
SHA512
ae894b49a961d80d923eac7fdc10ae8de1c9614a06516c964065845be3a35dae70f25c9a26d214377fe5a12c103e8623faf70f456eca226a0c66ea47915f8745
-
SSDEEP
24576:DyT0mRUH6WBf3AlZ9vXJ/Boi3tjhFaVbv:WFGjBgPBBoidtQV
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3108-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3108-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3108-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3108-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6477603.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6477603.exe healer behavioral2/memory/1268-35-0x00000000003C0000-0x00000000003CA000-memory.dmp healer -
Processes:
q6477603.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q6477603.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q6477603.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q6477603.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q6477603.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q6477603.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q6477603.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t8451928.exeexplothe.exeu9459776.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation t8451928.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation u9459776.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z4618426.exez0257859.exez0563267.exez5701879.exeq6477603.exer8811528.exes2793810.exet8451928.exeexplothe.exeu9459776.exelegota.exew5452985.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 2600 z4618426.exe 1936 z0257859.exe 4108 z0563267.exe 2704 z5701879.exe 1268 q6477603.exe 3348 r8811528.exe 640 s2793810.exe 3028 t8451928.exe 904 explothe.exe 4708 u9459776.exe 4164 legota.exe 1872 w5452985.exe 4948 explothe.exe 2144 legota.exe 1504 explothe.exe 4044 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4828 rundll32.exe 1112 rundll32.exe -
Processes:
q6477603.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q6477603.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exez4618426.exez0257859.exez0563267.exez5701879.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4618426.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z0257859.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z0563267.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z5701879.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r8811528.exes2793810.exedescription pid process target process PID 3348 set thread context of 3108 3348 r8811528.exe AppLaunch.exe PID 640 set thread context of 2872 640 s2793810.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3008 3348 WerFault.exe r8811528.exe 1284 3108 WerFault.exe AppLaunch.exe 216 640 WerFault.exe s2793810.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3352 schtasks.exe 1820 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q6477603.exepid process 1268 q6477603.exe 1268 q6477603.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q6477603.exedescription pid process Token: SeDebugPrivilege 1268 q6477603.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exez4618426.exez0257859.exez0563267.exez5701879.exer8811528.exes2793810.exet8451928.exeu9459776.exeexplothe.exedescription pid process target process PID 3244 wrote to memory of 2600 3244 a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe z4618426.exe PID 3244 wrote to memory of 2600 3244 a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe z4618426.exe PID 3244 wrote to memory of 2600 3244 a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe z4618426.exe PID 2600 wrote to memory of 1936 2600 z4618426.exe z0257859.exe PID 2600 wrote to memory of 1936 2600 z4618426.exe z0257859.exe PID 2600 wrote to memory of 1936 2600 z4618426.exe z0257859.exe PID 1936 wrote to memory of 4108 1936 z0257859.exe z0563267.exe PID 1936 wrote to memory of 4108 1936 z0257859.exe z0563267.exe PID 1936 wrote to memory of 4108 1936 z0257859.exe z0563267.exe PID 4108 wrote to memory of 2704 4108 z0563267.exe z5701879.exe PID 4108 wrote to memory of 2704 4108 z0563267.exe z5701879.exe PID 4108 wrote to memory of 2704 4108 z0563267.exe z5701879.exe PID 2704 wrote to memory of 1268 2704 z5701879.exe q6477603.exe PID 2704 wrote to memory of 1268 2704 z5701879.exe q6477603.exe PID 2704 wrote to memory of 3348 2704 z5701879.exe r8811528.exe PID 2704 wrote to memory of 3348 2704 z5701879.exe r8811528.exe PID 2704 wrote to memory of 3348 2704 z5701879.exe r8811528.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 3348 wrote to memory of 3108 3348 r8811528.exe AppLaunch.exe PID 4108 wrote to memory of 640 4108 z0563267.exe s2793810.exe PID 4108 wrote to memory of 640 4108 z0563267.exe s2793810.exe PID 4108 wrote to memory of 640 4108 z0563267.exe s2793810.exe PID 640 wrote to memory of 1184 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 1184 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 1184 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 4356 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 4356 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 4356 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 1112 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 1112 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 1112 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 2872 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 2872 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 2872 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 2872 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 2872 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 2872 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 2872 640 s2793810.exe AppLaunch.exe PID 640 wrote to memory of 2872 640 s2793810.exe AppLaunch.exe PID 1936 wrote to memory of 3028 1936 z0257859.exe t8451928.exe PID 1936 wrote to memory of 3028 1936 z0257859.exe t8451928.exe PID 1936 wrote to memory of 3028 1936 z0257859.exe t8451928.exe PID 3028 wrote to memory of 904 3028 t8451928.exe explothe.exe PID 3028 wrote to memory of 904 3028 t8451928.exe explothe.exe PID 3028 wrote to memory of 904 3028 t8451928.exe explothe.exe PID 2600 wrote to memory of 4708 2600 z4618426.exe u9459776.exe PID 2600 wrote to memory of 4708 2600 z4618426.exe u9459776.exe PID 2600 wrote to memory of 4708 2600 z4618426.exe u9459776.exe PID 4708 wrote to memory of 4164 4708 u9459776.exe legota.exe PID 4708 wrote to memory of 4164 4708 u9459776.exe legota.exe PID 4708 wrote to memory of 4164 4708 u9459776.exe legota.exe PID 904 wrote to memory of 3352 904 explothe.exe schtasks.exe PID 904 wrote to memory of 3352 904 explothe.exe schtasks.exe PID 904 wrote to memory of 3352 904 explothe.exe schtasks.exe PID 3244 wrote to memory of 1872 3244 a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe w5452985.exe PID 3244 wrote to memory of 1872 3244 a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe w5452985.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe"C:\Users\Admin\AppData\Local\Temp\a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4618426.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4618426.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0257859.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0257859.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0563267.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0563267.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5701879.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5701879.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6477603.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6477603.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8811528.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8811528.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 5807⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2793810.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2793810.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 1406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8451928.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8451928.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9459776.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9459776.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5452985.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5452985.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3348 -ip 33481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3108 -ip 31081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 640 -ip 6401⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5452985.exeFilesize
23KB
MD59e6368fe2d8d670dca19bfcd065e657c
SHA1f1c5b439df7f13d0e3f9dff8e57bf56f86304a56
SHA2568bcbfbad911b6a215aaf16049611dd1197a58d8cc0b3b98601136256243ab179
SHA512ff02054873d02d74e70e21fe3cfd68d0f1f5409156696a920d2d3797157686007aee937fca120f6c5ac153d337db438202040f614c2d1adb310cee27d96dbef9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5452985.exeFilesize
23KB
MD59e6368fe2d8d670dca19bfcd065e657c
SHA1f1c5b439df7f13d0e3f9dff8e57bf56f86304a56
SHA2568bcbfbad911b6a215aaf16049611dd1197a58d8cc0b3b98601136256243ab179
SHA512ff02054873d02d74e70e21fe3cfd68d0f1f5409156696a920d2d3797157686007aee937fca120f6c5ac153d337db438202040f614c2d1adb310cee27d96dbef9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4618426.exeFilesize
892KB
MD597f6c47ecaf3f55725c9ad696f72a72a
SHA186bd0ec212cae82a6e768aaa6b69db7f945098ed
SHA256ced2e28f83b48ffa092e642b0716b3912c7571c08621f11c6233fbed0dfb8051
SHA51286beaea604ad419e27fc6361d6f6d575e51012d6d18eac04225027ee9fe2c9a48d1bf6150f97740f0928db7c646c5733810532fce0b83a7901e417e22e8d3abf
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4618426.exeFilesize
892KB
MD597f6c47ecaf3f55725c9ad696f72a72a
SHA186bd0ec212cae82a6e768aaa6b69db7f945098ed
SHA256ced2e28f83b48ffa092e642b0716b3912c7571c08621f11c6233fbed0dfb8051
SHA51286beaea604ad419e27fc6361d6f6d575e51012d6d18eac04225027ee9fe2c9a48d1bf6150f97740f0928db7c646c5733810532fce0b83a7901e417e22e8d3abf
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9459776.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9459776.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0257859.exeFilesize
709KB
MD5e9fe5a501358e234b3e574e3abb0beb0
SHA157e61dc49d1c89f1df1fecf851138b14e729ff6a
SHA256887ff8767d8742aaf2c41a95a86a5aee1ff7f7b929b1c5cf3827ca53dfe27c7c
SHA512af92fcb7638829b07f774b869e05042b165ad845805695f2de1bce26d8ab50ae0745683fc1f902ae25ae2c6eb33a66d645faa549187ee74666473bc34540d3a1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0257859.exeFilesize
709KB
MD5e9fe5a501358e234b3e574e3abb0beb0
SHA157e61dc49d1c89f1df1fecf851138b14e729ff6a
SHA256887ff8767d8742aaf2c41a95a86a5aee1ff7f7b929b1c5cf3827ca53dfe27c7c
SHA512af92fcb7638829b07f774b869e05042b165ad845805695f2de1bce26d8ab50ae0745683fc1f902ae25ae2c6eb33a66d645faa549187ee74666473bc34540d3a1
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8451928.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8451928.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0563267.exeFilesize
527KB
MD548081a63063d51371aecc47231b3b219
SHA1ff0f6209331951fc610e2a288a0a1b17fd380d14
SHA25655509ddbdaf4a7a618859ce48e3d64bc614c9515a17da98b1eb698e24c01d829
SHA51266611c7cf4b855d70649c303876757bcbf33985438eb53019da7459ef10b4f34d0354021b49d812f0d0fd6a95807622caf1e2813999d580ec99502255e35e25f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0563267.exeFilesize
527KB
MD548081a63063d51371aecc47231b3b219
SHA1ff0f6209331951fc610e2a288a0a1b17fd380d14
SHA25655509ddbdaf4a7a618859ce48e3d64bc614c9515a17da98b1eb698e24c01d829
SHA51266611c7cf4b855d70649c303876757bcbf33985438eb53019da7459ef10b4f34d0354021b49d812f0d0fd6a95807622caf1e2813999d580ec99502255e35e25f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2793810.exeFilesize
310KB
MD52266599a0ade00b51bf129efdd1d1d76
SHA162effac9622822fb456d1bd8fa34968675f7299a
SHA256fd0c9f51614b5dccc3956308af1a481096c0f72716d4016549ded51863e7f4e2
SHA5120288139e67f0f1c115bb73419b5919df7b3133daed83eba56786e5e547dff463080e4463aeffed3a98aa2ade82cb9f5d02fd253aaae48c67655c89601bb4e0f9
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2793810.exeFilesize
310KB
MD52266599a0ade00b51bf129efdd1d1d76
SHA162effac9622822fb456d1bd8fa34968675f7299a
SHA256fd0c9f51614b5dccc3956308af1a481096c0f72716d4016549ded51863e7f4e2
SHA5120288139e67f0f1c115bb73419b5919df7b3133daed83eba56786e5e547dff463080e4463aeffed3a98aa2ade82cb9f5d02fd253aaae48c67655c89601bb4e0f9
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5701879.exeFilesize
296KB
MD55478a3ee40663037952a83cbf7aaf146
SHA1546a3dcb50748e91cb67208c5557a0d7d47a033b
SHA2568866579815667a149ae64e0c8ad6b097503fedf97c3380ada849dae40d6fcd0c
SHA5121b7c20f44b32223181850be62735745c622cb5c444bb8b34ec0517475b6d3b7428f242f3598e2f18227031cd4e9e1ac341c279b0fdc2e3edd25755dbd0b6ec6b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5701879.exeFilesize
296KB
MD55478a3ee40663037952a83cbf7aaf146
SHA1546a3dcb50748e91cb67208c5557a0d7d47a033b
SHA2568866579815667a149ae64e0c8ad6b097503fedf97c3380ada849dae40d6fcd0c
SHA5121b7c20f44b32223181850be62735745c622cb5c444bb8b34ec0517475b6d3b7428f242f3598e2f18227031cd4e9e1ac341c279b0fdc2e3edd25755dbd0b6ec6b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6477603.exeFilesize
11KB
MD54101dea1224767579fb8c7de4add5ec4
SHA122cbe66c236cbda35c3a4d4435960feb35a7eb63
SHA2565cf4117d060f45c45f514386b1f70a5b424eb110bd36bb393c401c56614309ae
SHA512b6fb7761a0cc9668766bcc24f1a894cff9f07dfa29eabbe7be9927aff88a723e81fa903821cfa8c488c6ebed825e6a6cd3f07ddd560d0425e59f0d38508b697e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6477603.exeFilesize
11KB
MD54101dea1224767579fb8c7de4add5ec4
SHA122cbe66c236cbda35c3a4d4435960feb35a7eb63
SHA2565cf4117d060f45c45f514386b1f70a5b424eb110bd36bb393c401c56614309ae
SHA512b6fb7761a0cc9668766bcc24f1a894cff9f07dfa29eabbe7be9927aff88a723e81fa903821cfa8c488c6ebed825e6a6cd3f07ddd560d0425e59f0d38508b697e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8811528.exeFilesize
276KB
MD5af9ab22f87d0e41cd6a84b15fc7fccd1
SHA12891fede9da7bb481689227d47feb6ad06d47f49
SHA256158ada56676c3a7c60f7b5f8e8f8c9f2fb1474167f5f1e8d90e802acc6080f1a
SHA5122017777e8ebe27f61431109609bbbc12306398bce94bd765d9ab67daec368ab3957fd3a670065f3871961c96a8509493495b23d8e11a884665471fa2efb1eb1c
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8811528.exeFilesize
276KB
MD5af9ab22f87d0e41cd6a84b15fc7fccd1
SHA12891fede9da7bb481689227d47feb6ad06d47f49
SHA256158ada56676c3a7c60f7b5f8e8f8c9f2fb1474167f5f1e8d90e802acc6080f1a
SHA5122017777e8ebe27f61431109609bbbc12306398bce94bd765d9ab67daec368ab3957fd3a670065f3871961c96a8509493495b23d8e11a884665471fa2efb1eb1c
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1268-35-0x00000000003C0000-0x00000000003CA000-memory.dmpFilesize
40KB
-
memory/1268-37-0x00007FFF4EA10000-0x00007FFF4F4D1000-memory.dmpFilesize
10.8MB
-
memory/1268-39-0x00007FFF4EA10000-0x00007FFF4F4D1000-memory.dmpFilesize
10.8MB
-
memory/1268-36-0x00007FFF4EA10000-0x00007FFF4F4D1000-memory.dmpFilesize
10.8MB
-
memory/2872-66-0x0000000004DD0000-0x0000000004DE2000-memory.dmpFilesize
72KB
-
memory/2872-64-0x0000000004F80000-0x000000000508A000-memory.dmpFilesize
1.0MB
-
memory/2872-88-0x0000000004E60000-0x0000000004E70000-memory.dmpFilesize
64KB
-
memory/2872-79-0x0000000004E70000-0x0000000004EAC000-memory.dmpFilesize
240KB
-
memory/2872-83-0x0000000074100000-0x00000000748B0000-memory.dmpFilesize
7.7MB
-
memory/2872-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2872-65-0x0000000004E60000-0x0000000004E70000-memory.dmpFilesize
64KB
-
memory/2872-87-0x0000000004EB0000-0x0000000004EFC000-memory.dmpFilesize
304KB
-
memory/2872-63-0x0000000005490000-0x0000000005AA8000-memory.dmpFilesize
6.1MB
-
memory/2872-52-0x0000000074100000-0x00000000748B0000-memory.dmpFilesize
7.7MB
-
memory/2872-53-0x0000000000AD0000-0x0000000000AD6000-memory.dmpFilesize
24KB
-
memory/3108-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3108-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3108-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3108-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB