Analysis Overview
SHA256
9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd
Threat Level: Known bad
The file a70d541152f32fc0d3eb5651fc3bf5c6.exe was found to be: Known bad.
Malicious Activity Summary
RedLine
Detect Mystic stealer payload
Detects Healer an antivirus disabler dropper
Healer
Mystic
Modifies Windows Defender Real-time Protection settings
Amadey
Windows security modification
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
Program crash
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 21:01
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 21:01
Reported
2023-10-10 21:50
Platform
win7-20230831-en
Max time kernel
121s
Max time network
127s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\a70d541152f32fc0d3eb5651fc3bf5c6.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2492 set thread context of 2460 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a70d541152f32fc0d3eb5651fc3bf5c6.exe
"C:\Users\Admin\AppData\Local\Temp\a70d541152f32fc0d3eb5651fc3bf5c6.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 36
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
| MD5 | 4e73ccef7d9aa675b7ccb7869711800c |
| SHA1 | 2d4597b27d085de1c58d9118dfd12ad694a734d7 |
| SHA256 | 03f1e9609e21fcdde9c73e60caba236caa3ef7c7030f9da334f812b59052fa67 |
| SHA512 | 50ee84ada4b892f4f13a85e1e508562d7d5079ac121a0a1843e9ac28f571120b63b23360a8a20e3ff42e366899a523ade941acdd8b2429074d0c17e0799506da |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
| MD5 | 4e73ccef7d9aa675b7ccb7869711800c |
| SHA1 | 2d4597b27d085de1c58d9118dfd12ad694a734d7 |
| SHA256 | 03f1e9609e21fcdde9c73e60caba236caa3ef7c7030f9da334f812b59052fa67 |
| SHA512 | 50ee84ada4b892f4f13a85e1e508562d7d5079ac121a0a1843e9ac28f571120b63b23360a8a20e3ff42e366899a523ade941acdd8b2429074d0c17e0799506da |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
| MD5 | 4e73ccef7d9aa675b7ccb7869711800c |
| SHA1 | 2d4597b27d085de1c58d9118dfd12ad694a734d7 |
| SHA256 | 03f1e9609e21fcdde9c73e60caba236caa3ef7c7030f9da334f812b59052fa67 |
| SHA512 | 50ee84ada4b892f4f13a85e1e508562d7d5079ac121a0a1843e9ac28f571120b63b23360a8a20e3ff42e366899a523ade941acdd8b2429074d0c17e0799506da |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
| MD5 | 4e73ccef7d9aa675b7ccb7869711800c |
| SHA1 | 2d4597b27d085de1c58d9118dfd12ad694a734d7 |
| SHA256 | 03f1e9609e21fcdde9c73e60caba236caa3ef7c7030f9da334f812b59052fa67 |
| SHA512 | 50ee84ada4b892f4f13a85e1e508562d7d5079ac121a0a1843e9ac28f571120b63b23360a8a20e3ff42e366899a523ade941acdd8b2429074d0c17e0799506da |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
| MD5 | 079d0c841d105714c945ad750d025b62 |
| SHA1 | a08becfb2244bf643e4501c0512e0ded4817a849 |
| SHA256 | 43325d68ea5947079ce2b363f9038239916ddbd557ace6c43fa0ebcb77c7be95 |
| SHA512 | fbff803c28af02b4964a61b027417bdbd43210430c871584029a9db99f6f0b1bf8daeaca7afcc383791a91169f87feead2b20f77147eccd803840acd1bd3411c |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
| MD5 | 079d0c841d105714c945ad750d025b62 |
| SHA1 | a08becfb2244bf643e4501c0512e0ded4817a849 |
| SHA256 | 43325d68ea5947079ce2b363f9038239916ddbd557ace6c43fa0ebcb77c7be95 |
| SHA512 | fbff803c28af02b4964a61b027417bdbd43210430c871584029a9db99f6f0b1bf8daeaca7afcc383791a91169f87feead2b20f77147eccd803840acd1bd3411c |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
| MD5 | 079d0c841d105714c945ad750d025b62 |
| SHA1 | a08becfb2244bf643e4501c0512e0ded4817a849 |
| SHA256 | 43325d68ea5947079ce2b363f9038239916ddbd557ace6c43fa0ebcb77c7be95 |
| SHA512 | fbff803c28af02b4964a61b027417bdbd43210430c871584029a9db99f6f0b1bf8daeaca7afcc383791a91169f87feead2b20f77147eccd803840acd1bd3411c |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
| MD5 | 079d0c841d105714c945ad750d025b62 |
| SHA1 | a08becfb2244bf643e4501c0512e0ded4817a849 |
| SHA256 | 43325d68ea5947079ce2b363f9038239916ddbd557ace6c43fa0ebcb77c7be95 |
| SHA512 | fbff803c28af02b4964a61b027417bdbd43210430c871584029a9db99f6f0b1bf8daeaca7afcc383791a91169f87feead2b20f77147eccd803840acd1bd3411c |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
| MD5 | 8a3c205772e7e6002fbe94e887175faa |
| SHA1 | f2c9ff609d53582876767c37f0430067e7d6f755 |
| SHA256 | 2b03f15c9bdd3022bb2dc2b8a1975368f9d5125cf358774457f0aff3850ac570 |
| SHA512 | 9f64ea2a049eddeeabc7aa4028caff90ee2d9da9b8421aa71a0dae1cd887a1127ac2792c815919345a8e8bc7c2b03c626ac786a17e99a7bdd375407632c0570c |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
| MD5 | 8a3c205772e7e6002fbe94e887175faa |
| SHA1 | f2c9ff609d53582876767c37f0430067e7d6f755 |
| SHA256 | 2b03f15c9bdd3022bb2dc2b8a1975368f9d5125cf358774457f0aff3850ac570 |
| SHA512 | 9f64ea2a049eddeeabc7aa4028caff90ee2d9da9b8421aa71a0dae1cd887a1127ac2792c815919345a8e8bc7c2b03c626ac786a17e99a7bdd375407632c0570c |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
| MD5 | 8a3c205772e7e6002fbe94e887175faa |
| SHA1 | f2c9ff609d53582876767c37f0430067e7d6f755 |
| SHA256 | 2b03f15c9bdd3022bb2dc2b8a1975368f9d5125cf358774457f0aff3850ac570 |
| SHA512 | 9f64ea2a049eddeeabc7aa4028caff90ee2d9da9b8421aa71a0dae1cd887a1127ac2792c815919345a8e8bc7c2b03c626ac786a17e99a7bdd375407632c0570c |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
| MD5 | 8a3c205772e7e6002fbe94e887175faa |
| SHA1 | f2c9ff609d53582876767c37f0430067e7d6f755 |
| SHA256 | 2b03f15c9bdd3022bb2dc2b8a1975368f9d5125cf358774457f0aff3850ac570 |
| SHA512 | 9f64ea2a049eddeeabc7aa4028caff90ee2d9da9b8421aa71a0dae1cd887a1127ac2792c815919345a8e8bc7c2b03c626ac786a17e99a7bdd375407632c0570c |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
| MD5 | 445caeb7d99a6ea8d5ba7886fdef7567 |
| SHA1 | 4133e9612b0a87c3b426a66542492df0b281f8a0 |
| SHA256 | 5220b91ce9e1abb658c498d4eca7428a2a1751e533d82179805f02ac43ddfa64 |
| SHA512 | a815d37fb3952a6d8164a9cb916d14c91d650d99f284796422428f5ec729cb9ece03ca155e2641177d35d611b9df0a4746df2fa2a004c9a2fe788deec30f35df |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
| MD5 | 445caeb7d99a6ea8d5ba7886fdef7567 |
| SHA1 | 4133e9612b0a87c3b426a66542492df0b281f8a0 |
| SHA256 | 5220b91ce9e1abb658c498d4eca7428a2a1751e533d82179805f02ac43ddfa64 |
| SHA512 | a815d37fb3952a6d8164a9cb916d14c91d650d99f284796422428f5ec729cb9ece03ca155e2641177d35d611b9df0a4746df2fa2a004c9a2fe788deec30f35df |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
| MD5 | 445caeb7d99a6ea8d5ba7886fdef7567 |
| SHA1 | 4133e9612b0a87c3b426a66542492df0b281f8a0 |
| SHA256 | 5220b91ce9e1abb658c498d4eca7428a2a1751e533d82179805f02ac43ddfa64 |
| SHA512 | a815d37fb3952a6d8164a9cb916d14c91d650d99f284796422428f5ec729cb9ece03ca155e2641177d35d611b9df0a4746df2fa2a004c9a2fe788deec30f35df |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
| MD5 | 445caeb7d99a6ea8d5ba7886fdef7567 |
| SHA1 | 4133e9612b0a87c3b426a66542492df0b281f8a0 |
| SHA256 | 5220b91ce9e1abb658c498d4eca7428a2a1751e533d82179805f02ac43ddfa64 |
| SHA512 | a815d37fb3952a6d8164a9cb916d14c91d650d99f284796422428f5ec729cb9ece03ca155e2641177d35d611b9df0a4746df2fa2a004c9a2fe788deec30f35df |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe
| MD5 | e0233372fb5a978e424016b9233a3f95 |
| SHA1 | 5dbc3e695cbbb7c8d982fac7c330d199cb461141 |
| SHA256 | 111c507d7b970b8a17f2b1c7828b9dd35f14e73461ac9afa986c9f9dabeffba6 |
| SHA512 | 4e82c114e995bb3582ed1b478465eea994e478d64f5859bf45ab02452705b56865580f2feddba76ae550787b0d60920c8c984578977e7615060ab9cf1b955e9d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe
| MD5 | e0233372fb5a978e424016b9233a3f95 |
| SHA1 | 5dbc3e695cbbb7c8d982fac7c330d199cb461141 |
| SHA256 | 111c507d7b970b8a17f2b1c7828b9dd35f14e73461ac9afa986c9f9dabeffba6 |
| SHA512 | 4e82c114e995bb3582ed1b478465eea994e478d64f5859bf45ab02452705b56865580f2feddba76ae550787b0d60920c8c984578977e7615060ab9cf1b955e9d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe
| MD5 | e0233372fb5a978e424016b9233a3f95 |
| SHA1 | 5dbc3e695cbbb7c8d982fac7c330d199cb461141 |
| SHA256 | 111c507d7b970b8a17f2b1c7828b9dd35f14e73461ac9afa986c9f9dabeffba6 |
| SHA512 | 4e82c114e995bb3582ed1b478465eea994e478d64f5859bf45ab02452705b56865580f2feddba76ae550787b0d60920c8c984578977e7615060ab9cf1b955e9d |
memory/2472-48-0x00000000009A0000-0x00000000009AA000-memory.dmp
memory/2472-49-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp
memory/2472-50-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp
memory/2472-51-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
memory/2460-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2460-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2460-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2460-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2460-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2460-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2460-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2460-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2460-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2460-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 21:01
Reported
2023-10-10 21:51
Platform
win10v2004-20230915-en
Max time kernel
151s
Max time network
150s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2474679.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9669175.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\a70d541152f32fc0d3eb5651fc3bf5c6.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1836 set thread context of 4860 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3248 set thread context of 1392 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2305125.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a70d541152f32fc0d3eb5651fc3bf5c6.exe
"C:\Users\Admin\AppData\Local\Temp\a70d541152f32fc0d3eb5651fc3bf5c6.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1836 -ip 1836
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4860 -ip 4860
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 152
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2305125.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2305125.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3248 -ip 3248
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 156
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2474679.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2474679.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9669175.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9669175.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5379155.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5379155.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
| MD5 | 4e73ccef7d9aa675b7ccb7869711800c |
| SHA1 | 2d4597b27d085de1c58d9118dfd12ad694a734d7 |
| SHA256 | 03f1e9609e21fcdde9c73e60caba236caa3ef7c7030f9da334f812b59052fa67 |
| SHA512 | 50ee84ada4b892f4f13a85e1e508562d7d5079ac121a0a1843e9ac28f571120b63b23360a8a20e3ff42e366899a523ade941acdd8b2429074d0c17e0799506da |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9234197.exe
| MD5 | 4e73ccef7d9aa675b7ccb7869711800c |
| SHA1 | 2d4597b27d085de1c58d9118dfd12ad694a734d7 |
| SHA256 | 03f1e9609e21fcdde9c73e60caba236caa3ef7c7030f9da334f812b59052fa67 |
| SHA512 | 50ee84ada4b892f4f13a85e1e508562d7d5079ac121a0a1843e9ac28f571120b63b23360a8a20e3ff42e366899a523ade941acdd8b2429074d0c17e0799506da |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
| MD5 | 079d0c841d105714c945ad750d025b62 |
| SHA1 | a08becfb2244bf643e4501c0512e0ded4817a849 |
| SHA256 | 43325d68ea5947079ce2b363f9038239916ddbd557ace6c43fa0ebcb77c7be95 |
| SHA512 | fbff803c28af02b4964a61b027417bdbd43210430c871584029a9db99f6f0b1bf8daeaca7afcc383791a91169f87feead2b20f77147eccd803840acd1bd3411c |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8286662.exe
| MD5 | 079d0c841d105714c945ad750d025b62 |
| SHA1 | a08becfb2244bf643e4501c0512e0ded4817a849 |
| SHA256 | 43325d68ea5947079ce2b363f9038239916ddbd557ace6c43fa0ebcb77c7be95 |
| SHA512 | fbff803c28af02b4964a61b027417bdbd43210430c871584029a9db99f6f0b1bf8daeaca7afcc383791a91169f87feead2b20f77147eccd803840acd1bd3411c |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
| MD5 | 8a3c205772e7e6002fbe94e887175faa |
| SHA1 | f2c9ff609d53582876767c37f0430067e7d6f755 |
| SHA256 | 2b03f15c9bdd3022bb2dc2b8a1975368f9d5125cf358774457f0aff3850ac570 |
| SHA512 | 9f64ea2a049eddeeabc7aa4028caff90ee2d9da9b8421aa71a0dae1cd887a1127ac2792c815919345a8e8bc7c2b03c626ac786a17e99a7bdd375407632c0570c |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6530251.exe
| MD5 | 8a3c205772e7e6002fbe94e887175faa |
| SHA1 | f2c9ff609d53582876767c37f0430067e7d6f755 |
| SHA256 | 2b03f15c9bdd3022bb2dc2b8a1975368f9d5125cf358774457f0aff3850ac570 |
| SHA512 | 9f64ea2a049eddeeabc7aa4028caff90ee2d9da9b8421aa71a0dae1cd887a1127ac2792c815919345a8e8bc7c2b03c626ac786a17e99a7bdd375407632c0570c |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
| MD5 | 445caeb7d99a6ea8d5ba7886fdef7567 |
| SHA1 | 4133e9612b0a87c3b426a66542492df0b281f8a0 |
| SHA256 | 5220b91ce9e1abb658c498d4eca7428a2a1751e533d82179805f02ac43ddfa64 |
| SHA512 | a815d37fb3952a6d8164a9cb916d14c91d650d99f284796422428f5ec729cb9ece03ca155e2641177d35d611b9df0a4746df2fa2a004c9a2fe788deec30f35df |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8978094.exe
| MD5 | 445caeb7d99a6ea8d5ba7886fdef7567 |
| SHA1 | 4133e9612b0a87c3b426a66542492df0b281f8a0 |
| SHA256 | 5220b91ce9e1abb658c498d4eca7428a2a1751e533d82179805f02ac43ddfa64 |
| SHA512 | a815d37fb3952a6d8164a9cb916d14c91d650d99f284796422428f5ec729cb9ece03ca155e2641177d35d611b9df0a4746df2fa2a004c9a2fe788deec30f35df |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe
| MD5 | e0233372fb5a978e424016b9233a3f95 |
| SHA1 | 5dbc3e695cbbb7c8d982fac7c330d199cb461141 |
| SHA256 | 111c507d7b970b8a17f2b1c7828b9dd35f14e73461ac9afa986c9f9dabeffba6 |
| SHA512 | 4e82c114e995bb3582ed1b478465eea994e478d64f5859bf45ab02452705b56865580f2feddba76ae550787b0d60920c8c984578977e7615060ab9cf1b955e9d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3293235.exe
| MD5 | e0233372fb5a978e424016b9233a3f95 |
| SHA1 | 5dbc3e695cbbb7c8d982fac7c330d199cb461141 |
| SHA256 | 111c507d7b970b8a17f2b1c7828b9dd35f14e73461ac9afa986c9f9dabeffba6 |
| SHA512 | 4e82c114e995bb3582ed1b478465eea994e478d64f5859bf45ab02452705b56865580f2feddba76ae550787b0d60920c8c984578977e7615060ab9cf1b955e9d |
memory/2912-35-0x0000000000470000-0x000000000047A000-memory.dmp
memory/2912-36-0x00007FFCD2BA0000-0x00007FFCD3661000-memory.dmp
memory/2912-37-0x00007FFCD2BA0000-0x00007FFCD3661000-memory.dmp
memory/2912-39-0x00007FFCD2BA0000-0x00007FFCD3661000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2693585.exe
| MD5 | d62d05dd92da254457210a8977f6cb30 |
| SHA1 | e43d5ead9edcab3f8c2fed56375add23df59bddc |
| SHA256 | 70c628da3f5707b399e3b6988714c3553a72bbf5ea4a60f9d8a2cf17e273f74f |
| SHA512 | 0b362802bf3b95678baa874681773527f422082f04ffac472de85e7ad2e6327e36fdc194618c8dcfdcc230cb17107f113374ec1d97631e7032fc1731c85a7cac |
memory/4860-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4860-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4860-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4860-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2305125.exe
| MD5 | 6292c3193e4fd80fe9161ed4295795cc |
| SHA1 | 777df017c1e5b989474c68a0e831d0f111e93ac5 |
| SHA256 | 7166c6d9a2ae65f8a2ea54b2296d8af911e11300428b93ab2dc895c285c451bd |
| SHA512 | c453bce18c9b67cfc0c235a03f6dd5306160c6a7d2943ef814975bd19debc3a71f7e9429c1b038096d913baf11767234c2ade56a44f7b944c565751bb7759f5d |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2305125.exe
| MD5 | 6292c3193e4fd80fe9161ed4295795cc |
| SHA1 | 777df017c1e5b989474c68a0e831d0f111e93ac5 |
| SHA256 | 7166c6d9a2ae65f8a2ea54b2296d8af911e11300428b93ab2dc895c285c451bd |
| SHA512 | c453bce18c9b67cfc0c235a03f6dd5306160c6a7d2943ef814975bd19debc3a71f7e9429c1b038096d913baf11767234c2ade56a44f7b944c565751bb7759f5d |
memory/1392-51-0x0000000000400000-0x0000000000430000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2474679.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2474679.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/1392-57-0x0000000073FD0000-0x0000000074780000-memory.dmp
memory/1392-59-0x0000000002810000-0x0000000002816000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9669175.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9669175.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5379155.exe
| MD5 | 5410adf9b12a6cb78b0a81ef1873f717 |
| SHA1 | e5605b15b994f05bd2d55bb9e3a5278e72680dad |
| SHA256 | 4ca099b763660d07f19f2ee00a7130bf7eb52a70ed8feefd80202221f8593496 |
| SHA512 | e3abeb79a83a7a96145c4f4d7a63cce532676aae6485bbd8beba9b34285473842a76782385aa1598091591249b29c2be5cde269ad90b2255f68e353dfc801e93 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5379155.exe
| MD5 | 5410adf9b12a6cb78b0a81ef1873f717 |
| SHA1 | e5605b15b994f05bd2d55bb9e3a5278e72680dad |
| SHA256 | 4ca099b763660d07f19f2ee00a7130bf7eb52a70ed8feefd80202221f8593496 |
| SHA512 | e3abeb79a83a7a96145c4f4d7a63cce532676aae6485bbd8beba9b34285473842a76782385aa1598091591249b29c2be5cde269ad90b2255f68e353dfc801e93 |
memory/1392-81-0x0000000005590000-0x0000000005BA8000-memory.dmp
memory/1392-82-0x0000000005080000-0x000000000518A000-memory.dmp
memory/1392-84-0x0000000004E00000-0x0000000004E12000-memory.dmp
memory/1392-83-0x0000000004E60000-0x0000000004E70000-memory.dmp
memory/1392-85-0x0000000004F70000-0x0000000004FAC000-memory.dmp
memory/1392-86-0x0000000004FC0000-0x000000000500C000-memory.dmp
memory/1392-87-0x0000000073FD0000-0x0000000074780000-memory.dmp
memory/1392-88-0x0000000004E60000-0x0000000004E70000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |