Analysis
-
max time kernel
152s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:04
Static task
static1
Behavioral task
behavioral1
Sample
1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe
Resource
win7-20230831-en
General
-
Target
1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe
-
Size
994KB
-
MD5
0772cab2878fbb0bdf9d3d43bd7ea026
-
SHA1
2c0aaff02b2174fe03f593fcc56c079566633f15
-
SHA256
1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476
-
SHA512
67021076ae1d76c9faf462d94b5afe1fcd059cafeb58ac6f034f61b7531c77ece869df9450d14e1daa3dd829824d27ddc5498561b8ca35a1092f7efd35a868f8
-
SSDEEP
12288:CMrQy90PUfaJil8Hm6VMyUOkmGGUDS2GCA6wUGbxskzIVtGOGTKTU08sVJrYFme/:GyVryDUBS2B9wlx+/ETKwnmeXJt51
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/744-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/744-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/744-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/744-46-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2954184.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2954184.exe healer behavioral2/memory/2240-35-0x0000000000A30000-0x0000000000A3A000-memory.dmp healer -
Processes:
q2954184.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q2954184.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q2954184.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q2954184.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q2954184.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q2954184.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q2954184.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet0487320.exeexplothe.exeu1470056.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation t0487320.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation u1470056.exe -
Executes dropped EXE 16 IoCs
Processes:
z4431154.exez5677642.exez1731211.exez6074240.exeq2954184.exer4823272.exes1676978.exet0487320.exeexplothe.exeu1470056.exelegota.exew7310159.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 4184 z4431154.exe 1260 z5677642.exe 4200 z1731211.exe 1232 z6074240.exe 2240 q2954184.exe 3352 r4823272.exe 3876 s1676978.exe 2780 t0487320.exe 3904 explothe.exe 4364 u1470056.exe 3412 legota.exe 3524 w7310159.exe 2056 explothe.exe 4692 legota.exe 2864 explothe.exe 4912 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3616 rundll32.exe 4256 rundll32.exe -
Processes:
q2954184.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q2954184.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exez4431154.exez5677642.exez1731211.exez6074240.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4431154.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z5677642.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z1731211.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z6074240.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r4823272.exes1676978.exedescription pid process target process PID 3352 set thread context of 744 3352 r4823272.exe AppLaunch.exe PID 3876 set thread context of 2556 3876 s1676978.exe AppLaunch.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4468 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3288 3352 WerFault.exe r4823272.exe 4808 744 WerFault.exe AppLaunch.exe 5024 3876 WerFault.exe s1676978.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4380 schtasks.exe 816 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q2954184.exepid process 2240 q2954184.exe 2240 q2954184.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q2954184.exedescription pid process Token: SeDebugPrivilege 2240 q2954184.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exez4431154.exez5677642.exez1731211.exez6074240.exer4823272.exes1676978.exet0487320.exeexplothe.exeu1470056.execmd.exedescription pid process target process PID 32 wrote to memory of 4184 32 1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe z4431154.exe PID 32 wrote to memory of 4184 32 1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe z4431154.exe PID 32 wrote to memory of 4184 32 1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe z4431154.exe PID 4184 wrote to memory of 1260 4184 z4431154.exe z5677642.exe PID 4184 wrote to memory of 1260 4184 z4431154.exe z5677642.exe PID 4184 wrote to memory of 1260 4184 z4431154.exe z5677642.exe PID 1260 wrote to memory of 4200 1260 z5677642.exe z1731211.exe PID 1260 wrote to memory of 4200 1260 z5677642.exe z1731211.exe PID 1260 wrote to memory of 4200 1260 z5677642.exe z1731211.exe PID 4200 wrote to memory of 1232 4200 z1731211.exe z6074240.exe PID 4200 wrote to memory of 1232 4200 z1731211.exe z6074240.exe PID 4200 wrote to memory of 1232 4200 z1731211.exe z6074240.exe PID 1232 wrote to memory of 2240 1232 z6074240.exe q2954184.exe PID 1232 wrote to memory of 2240 1232 z6074240.exe q2954184.exe PID 1232 wrote to memory of 3352 1232 z6074240.exe r4823272.exe PID 1232 wrote to memory of 3352 1232 z6074240.exe r4823272.exe PID 1232 wrote to memory of 3352 1232 z6074240.exe r4823272.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 3352 wrote to memory of 744 3352 r4823272.exe AppLaunch.exe PID 4200 wrote to memory of 3876 4200 z1731211.exe s1676978.exe PID 4200 wrote to memory of 3876 4200 z1731211.exe s1676978.exe PID 4200 wrote to memory of 3876 4200 z1731211.exe s1676978.exe PID 3876 wrote to memory of 2556 3876 s1676978.exe AppLaunch.exe PID 3876 wrote to memory of 2556 3876 s1676978.exe AppLaunch.exe PID 3876 wrote to memory of 2556 3876 s1676978.exe AppLaunch.exe PID 3876 wrote to memory of 2556 3876 s1676978.exe AppLaunch.exe PID 3876 wrote to memory of 2556 3876 s1676978.exe AppLaunch.exe PID 3876 wrote to memory of 2556 3876 s1676978.exe AppLaunch.exe PID 3876 wrote to memory of 2556 3876 s1676978.exe AppLaunch.exe PID 3876 wrote to memory of 2556 3876 s1676978.exe AppLaunch.exe PID 1260 wrote to memory of 2780 1260 z5677642.exe t0487320.exe PID 1260 wrote to memory of 2780 1260 z5677642.exe t0487320.exe PID 1260 wrote to memory of 2780 1260 z5677642.exe t0487320.exe PID 2780 wrote to memory of 3904 2780 t0487320.exe explothe.exe PID 2780 wrote to memory of 3904 2780 t0487320.exe explothe.exe PID 2780 wrote to memory of 3904 2780 t0487320.exe explothe.exe PID 4184 wrote to memory of 4364 4184 z4431154.exe u1470056.exe PID 4184 wrote to memory of 4364 4184 z4431154.exe u1470056.exe PID 4184 wrote to memory of 4364 4184 z4431154.exe u1470056.exe PID 3904 wrote to memory of 4380 3904 explothe.exe schtasks.exe PID 3904 wrote to memory of 4380 3904 explothe.exe schtasks.exe PID 3904 wrote to memory of 4380 3904 explothe.exe schtasks.exe PID 3904 wrote to memory of 2928 3904 explothe.exe cmd.exe PID 3904 wrote to memory of 2928 3904 explothe.exe cmd.exe PID 3904 wrote to memory of 2928 3904 explothe.exe cmd.exe PID 4364 wrote to memory of 3412 4364 u1470056.exe legota.exe PID 4364 wrote to memory of 3412 4364 u1470056.exe legota.exe PID 4364 wrote to memory of 3412 4364 u1470056.exe legota.exe PID 2928 wrote to memory of 3024 2928 cmd.exe cmd.exe PID 2928 wrote to memory of 3024 2928 cmd.exe cmd.exe PID 2928 wrote to memory of 3024 2928 cmd.exe cmd.exe PID 32 wrote to memory of 3524 32 1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe w7310159.exe PID 32 wrote to memory of 3524 32 1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe w7310159.exe PID 32 wrote to memory of 3524 32 1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe w7310159.exe PID 2928 wrote to memory of 4296 2928 cmd.exe cacls.exe PID 2928 wrote to memory of 4296 2928 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe"C:\Users\Admin\AppData\Local\Temp\1c57ff8016f5331f7586cf6dc845fd9a317de010f81f11859dd55f20c73f5476.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4431154.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4431154.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5677642.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5677642.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1731211.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1731211.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6074240.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6074240.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2954184.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2954184.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4823272.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4823272.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 5448⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 1487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1676978.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1676978.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 1566⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0487320.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0487320.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1470056.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1470056.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7310159.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7310159.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3352 -ip 33521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 744 -ip 7441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3876 -ip 38761⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7310159.exeFilesize
23KB
MD56d28571ae5056520b7b3feb6efa5b12d
SHA1b28fbed8081ccd1c9ce0e6fb720ea1a57366f1c2
SHA2565aa2494d3ed80f1119549287cf329daabe8842f01ed458f9ac84f00adf668fe2
SHA512323ba17497407c9a927a7b50cdcf58df88107584509483cde57d15e19bcee125ba36ffe064e95bbd310f13babc9738c71209026153415573d9d21b1e1b29ece7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7310159.exeFilesize
23KB
MD56d28571ae5056520b7b3feb6efa5b12d
SHA1b28fbed8081ccd1c9ce0e6fb720ea1a57366f1c2
SHA2565aa2494d3ed80f1119549287cf329daabe8842f01ed458f9ac84f00adf668fe2
SHA512323ba17497407c9a927a7b50cdcf58df88107584509483cde57d15e19bcee125ba36ffe064e95bbd310f13babc9738c71209026153415573d9d21b1e1b29ece7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4431154.exeFilesize
892KB
MD5a6c01986d1111b6a964dc05e4dc6dc80
SHA1124b725e7dab4da1b1a3286c534ab77f4a7b2cb7
SHA256cdf742e9f9a2f567abfb1400d6eec16c82eb62ea05320c4c6f88b8ee0f14d7e3
SHA512517e752b68059ee621502d200a42ee76972d50d85538fa09bbf4d0f54efa0fba6faf42883bace1f506a69be59f90d22e0b3367bc9062e6f517ba416eedc0d248
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4431154.exeFilesize
892KB
MD5a6c01986d1111b6a964dc05e4dc6dc80
SHA1124b725e7dab4da1b1a3286c534ab77f4a7b2cb7
SHA256cdf742e9f9a2f567abfb1400d6eec16c82eb62ea05320c4c6f88b8ee0f14d7e3
SHA512517e752b68059ee621502d200a42ee76972d50d85538fa09bbf4d0f54efa0fba6faf42883bace1f506a69be59f90d22e0b3367bc9062e6f517ba416eedc0d248
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1470056.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1470056.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5677642.exeFilesize
709KB
MD5ea85a59c2f8420cdc5efd6e94e7de8e6
SHA1df6869c8901838422d2ea20b35a5d7b7a3781d1a
SHA256d844c0359ddd6fe0fecee373760f32ef02bdd014ad4fa8a5f8dee57410b2233d
SHA5128a1150d174e3a79608961f84b80c85b41df75b707c462fc8150b8365ed269829c10e89ae23e3a4933764fa94eaa5b920ffd1ad67803b5234bd012c6b23996d00
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5677642.exeFilesize
709KB
MD5ea85a59c2f8420cdc5efd6e94e7de8e6
SHA1df6869c8901838422d2ea20b35a5d7b7a3781d1a
SHA256d844c0359ddd6fe0fecee373760f32ef02bdd014ad4fa8a5f8dee57410b2233d
SHA5128a1150d174e3a79608961f84b80c85b41df75b707c462fc8150b8365ed269829c10e89ae23e3a4933764fa94eaa5b920ffd1ad67803b5234bd012c6b23996d00
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0487320.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0487320.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1731211.exeFilesize
527KB
MD5fec480a1cdccee2b1d96a973a385ed31
SHA1622a31f84e73a64427c1cb29d56bb8a0e1994fce
SHA256ba3ab59e8588e67b1612e6f2ce1b2a9d06158bef4ab37f635484e9ec69c945dd
SHA5126eb1bda0e3213ada48db4903ca073d42d3d5600ccedae0ba773b32f98a10d0565c37ce3488e3e44f5854172dd45814f0d112940964136b4551f3bb87c08fbad8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1731211.exeFilesize
527KB
MD5fec480a1cdccee2b1d96a973a385ed31
SHA1622a31f84e73a64427c1cb29d56bb8a0e1994fce
SHA256ba3ab59e8588e67b1612e6f2ce1b2a9d06158bef4ab37f635484e9ec69c945dd
SHA5126eb1bda0e3213ada48db4903ca073d42d3d5600ccedae0ba773b32f98a10d0565c37ce3488e3e44f5854172dd45814f0d112940964136b4551f3bb87c08fbad8
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1676978.exeFilesize
310KB
MD5396e44ee6c48d86c39248956d509a76e
SHA13c190901d1dcf237c3e83c68d0646dc08cc5f393
SHA256ff39c63a648ab76e8c2589df0b8bcb5c347c620920305c301443707d0d4a6d3f
SHA5126f05539772f859e472ebb32ecc7428f030debb64d5aee2272948b79e3369e950badf448dc6b5c592e7e43e59e5ad115f2b45bbe2abe4ce913a0590e0a3bb4812
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1676978.exeFilesize
310KB
MD5396e44ee6c48d86c39248956d509a76e
SHA13c190901d1dcf237c3e83c68d0646dc08cc5f393
SHA256ff39c63a648ab76e8c2589df0b8bcb5c347c620920305c301443707d0d4a6d3f
SHA5126f05539772f859e472ebb32ecc7428f030debb64d5aee2272948b79e3369e950badf448dc6b5c592e7e43e59e5ad115f2b45bbe2abe4ce913a0590e0a3bb4812
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6074240.exeFilesize
296KB
MD545eecc9ec87a4031a380438afbe781bf
SHA18d2a929fe5cf77b275ed53aaf88cb65533e48f94
SHA256843d22d92518558ab552047fa563478ccd46de423cc32afd9b6f2af9cec511b6
SHA51277010b394b7fe12e2f9a44f66fbe892cf651a61ebfccac8567b454f3480621a882596ee17b009d8ad1342da0e3e43680b164bc02891d07d4f81bb50db34645cd
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6074240.exeFilesize
296KB
MD545eecc9ec87a4031a380438afbe781bf
SHA18d2a929fe5cf77b275ed53aaf88cb65533e48f94
SHA256843d22d92518558ab552047fa563478ccd46de423cc32afd9b6f2af9cec511b6
SHA51277010b394b7fe12e2f9a44f66fbe892cf651a61ebfccac8567b454f3480621a882596ee17b009d8ad1342da0e3e43680b164bc02891d07d4f81bb50db34645cd
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2954184.exeFilesize
11KB
MD5179dfe20eed8716bed652ec6155f24b3
SHA1e29e9f01a7aa55b280b10a0f301c849bf6b628bc
SHA25643673fb9bdcb45a322abc892f585f3223d1705f2c14a1565b849627c0f6ce81e
SHA512b56e8f4e905c4a87ff6e3df69d212000e433d0c466b2eed463aa79bf6d2d745b8cb5d11d0c753064b28415ce8e6d0afb90573948558f5b1210061e161c4f57c3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2954184.exeFilesize
11KB
MD5179dfe20eed8716bed652ec6155f24b3
SHA1e29e9f01a7aa55b280b10a0f301c849bf6b628bc
SHA25643673fb9bdcb45a322abc892f585f3223d1705f2c14a1565b849627c0f6ce81e
SHA512b56e8f4e905c4a87ff6e3df69d212000e433d0c466b2eed463aa79bf6d2d745b8cb5d11d0c753064b28415ce8e6d0afb90573948558f5b1210061e161c4f57c3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4823272.exeFilesize
276KB
MD5ca660c0133457fb2aaf4856d35d847fc
SHA1ed20ec7e711b0c9a56a49972e2d9f25652a92169
SHA2560c4e74dd22107b03cd18ba62ea79230bb103b01a8a60c34f942aee5ec628e0b2
SHA51205465e07fe456b5080db526f6fcfa96cb9ccd8e0cb9211dd801c1049e7f35fc7e67e4cfc9de999be256ee66a2a657461b8496e78c661b5fe382523ee6edce9ef
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4823272.exeFilesize
276KB
MD5ca660c0133457fb2aaf4856d35d847fc
SHA1ed20ec7e711b0c9a56a49972e2d9f25652a92169
SHA2560c4e74dd22107b03cd18ba62ea79230bb103b01a8a60c34f942aee5ec628e0b2
SHA51205465e07fe456b5080db526f6fcfa96cb9ccd8e0cb9211dd801c1049e7f35fc7e67e4cfc9de999be256ee66a2a657461b8496e78c661b5fe382523ee6edce9ef
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/744-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/744-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/744-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/744-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2240-35-0x0000000000A30000-0x0000000000A3A000-memory.dmpFilesize
40KB
-
memory/2240-36-0x00007FFD5EEB0000-0x00007FFD5F971000-memory.dmpFilesize
10.8MB
-
memory/2240-38-0x00007FFD5EEB0000-0x00007FFD5F971000-memory.dmpFilesize
10.8MB
-
memory/2556-59-0x00000000054A0000-0x00000000055AA000-memory.dmpFilesize
1.0MB
-
memory/2556-87-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/2556-86-0x0000000073870000-0x0000000074020000-memory.dmpFilesize
7.7MB
-
memory/2556-71-0x00000000053A0000-0x00000000053EC000-memory.dmpFilesize
304KB
-
memory/2556-63-0x0000000005340000-0x000000000537C000-memory.dmpFilesize
240KB
-
memory/2556-61-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/2556-60-0x00000000052E0000-0x00000000052F2000-memory.dmpFilesize
72KB
-
memory/2556-58-0x00000000059B0000-0x0000000005FC8000-memory.dmpFilesize
6.1MB
-
memory/2556-52-0x0000000002C00000-0x0000000002C06000-memory.dmpFilesize
24KB
-
memory/2556-51-0x0000000073870000-0x0000000074020000-memory.dmpFilesize
7.7MB
-
memory/2556-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB