Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:16
Static task
static1
Behavioral task
behavioral1
Sample
e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exe
Resource
win7-20230831-en
General
-
Target
e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exe
-
Size
1.0MB
-
MD5
29ce1619fb95321517a5850cb5408c45
-
SHA1
63abe86cf730acf42091ada26f3c60c196cce92e
-
SHA256
e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32
-
SHA512
ef0ce41d8b3747473bf24f3177ad68f2fef9a33cd88e1b3aa015b697726b219ab7ef3d22b8d9facc198eb64a92c097b1687fa1740fb58399654d11ac36e70f6e
-
SSDEEP
24576:3yN1hM2nCvgyah4RW5ZonW9yRFTz/+P3:CqaaSaRoZd9yR1/
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2640-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2640-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2640-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2640-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4692-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explonde.exeu0292593.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation u0292593.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z5740436.exez8614331.exez2418566.exez6053692.exeq1823341.exer1866637.exes3778753.exemousocoreworker.exeexplonde.exeu0292593.exelegota.exew6490317.exeexplonde.exelegota.exeexplonde.exelegota.exepid process 5064 z5740436.exe 3328 z8614331.exe 4700 z2418566.exe 532 z6053692.exe 1208 q1823341.exe 3940 r1866637.exe 4980 s3778753.exe 3148 mousocoreworker.exe 3844 explonde.exe 972 u0292593.exe 1268 legota.exe 1360 w6490317.exe 4772 explonde.exe 392 legota.exe 4144 explonde.exe 808 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 5028 rundll32.exe 3224 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z2418566.exez6053692.exee8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exez5740436.exez8614331.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z2418566.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z6053692.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z5740436.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z8614331.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q1823341.exer1866637.exes3778753.exedescription pid process target process PID 1208 set thread context of 4692 1208 q1823341.exe AppLaunch.exe PID 3940 set thread context of 2640 3940 r1866637.exe AppLaunch.exe PID 4980 set thread context of 2556 4980 s3778753.exe AppLaunch.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3308 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3668 1208 WerFault.exe q1823341.exe 1800 3940 WerFault.exe r1866637.exe 316 2640 WerFault.exe 1684 4980 WerFault.exe s3778753.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3924 schtasks.exe 2108 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 4692 AppLaunch.exe 4692 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4692 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exez5740436.exez8614331.exez2418566.exez6053692.exeq1823341.exer1866637.exes3778753.exemousocoreworker.exeexplonde.exeu0292593.exedescription pid process target process PID 5020 wrote to memory of 5064 5020 e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exe z5740436.exe PID 5020 wrote to memory of 5064 5020 e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exe z5740436.exe PID 5020 wrote to memory of 5064 5020 e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exe z5740436.exe PID 5064 wrote to memory of 3328 5064 z5740436.exe z8614331.exe PID 5064 wrote to memory of 3328 5064 z5740436.exe z8614331.exe PID 5064 wrote to memory of 3328 5064 z5740436.exe z8614331.exe PID 3328 wrote to memory of 4700 3328 z8614331.exe z2418566.exe PID 3328 wrote to memory of 4700 3328 z8614331.exe z2418566.exe PID 3328 wrote to memory of 4700 3328 z8614331.exe z2418566.exe PID 4700 wrote to memory of 532 4700 z2418566.exe z6053692.exe PID 4700 wrote to memory of 532 4700 z2418566.exe z6053692.exe PID 4700 wrote to memory of 532 4700 z2418566.exe z6053692.exe PID 532 wrote to memory of 1208 532 z6053692.exe q1823341.exe PID 532 wrote to memory of 1208 532 z6053692.exe q1823341.exe PID 532 wrote to memory of 1208 532 z6053692.exe q1823341.exe PID 1208 wrote to memory of 4692 1208 q1823341.exe AppLaunch.exe PID 1208 wrote to memory of 4692 1208 q1823341.exe AppLaunch.exe PID 1208 wrote to memory of 4692 1208 q1823341.exe AppLaunch.exe PID 1208 wrote to memory of 4692 1208 q1823341.exe AppLaunch.exe PID 1208 wrote to memory of 4692 1208 q1823341.exe AppLaunch.exe PID 1208 wrote to memory of 4692 1208 q1823341.exe AppLaunch.exe PID 1208 wrote to memory of 4692 1208 q1823341.exe AppLaunch.exe PID 1208 wrote to memory of 4692 1208 q1823341.exe AppLaunch.exe PID 532 wrote to memory of 3940 532 z6053692.exe r1866637.exe PID 532 wrote to memory of 3940 532 z6053692.exe r1866637.exe PID 532 wrote to memory of 3940 532 z6053692.exe r1866637.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 3940 wrote to memory of 2640 3940 r1866637.exe AppLaunch.exe PID 4700 wrote to memory of 4980 4700 z2418566.exe s3778753.exe PID 4700 wrote to memory of 4980 4700 z2418566.exe s3778753.exe PID 4700 wrote to memory of 4980 4700 z2418566.exe s3778753.exe PID 4980 wrote to memory of 2556 4980 s3778753.exe AppLaunch.exe PID 4980 wrote to memory of 2556 4980 s3778753.exe AppLaunch.exe PID 4980 wrote to memory of 2556 4980 s3778753.exe AppLaunch.exe PID 4980 wrote to memory of 2556 4980 s3778753.exe AppLaunch.exe PID 4980 wrote to memory of 2556 4980 s3778753.exe AppLaunch.exe PID 4980 wrote to memory of 2556 4980 s3778753.exe AppLaunch.exe PID 4980 wrote to memory of 2556 4980 s3778753.exe AppLaunch.exe PID 4980 wrote to memory of 2556 4980 s3778753.exe AppLaunch.exe PID 3328 wrote to memory of 3148 3328 z8614331.exe mousocoreworker.exe PID 3328 wrote to memory of 3148 3328 z8614331.exe mousocoreworker.exe PID 3328 wrote to memory of 3148 3328 z8614331.exe mousocoreworker.exe PID 3148 wrote to memory of 3844 3148 mousocoreworker.exe explonde.exe PID 3148 wrote to memory of 3844 3148 mousocoreworker.exe explonde.exe PID 3148 wrote to memory of 3844 3148 mousocoreworker.exe explonde.exe PID 5064 wrote to memory of 972 5064 z5740436.exe u0292593.exe PID 5064 wrote to memory of 972 5064 z5740436.exe u0292593.exe PID 5064 wrote to memory of 972 5064 z5740436.exe u0292593.exe PID 3844 wrote to memory of 2108 3844 explonde.exe schtasks.exe PID 3844 wrote to memory of 2108 3844 explonde.exe schtasks.exe PID 3844 wrote to memory of 2108 3844 explonde.exe schtasks.exe PID 972 wrote to memory of 1268 972 u0292593.exe legota.exe PID 972 wrote to memory of 1268 972 u0292593.exe legota.exe PID 972 wrote to memory of 1268 972 u0292593.exe legota.exe PID 3844 wrote to memory of 2116 3844 explonde.exe cmd.exe PID 3844 wrote to memory of 2116 3844 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exe"C:\Users\Admin\AppData\Local\Temp\e8ccf6c68b6deecf354b7c901ef54ce538fe4d1400b95bacf6489a4de5aeee32_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5740436.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5740436.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8614331.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8614331.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2418566.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2418566.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6053692.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6053692.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1823341.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1823341.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 2007⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1866637.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1866637.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 5527⤵
- Program crash
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3778753.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3778753.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 5526⤵
- Program crash
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5061818.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5061818.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0292593.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0292593.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6490317.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6490317.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1208 -ip 12081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3940 -ip 39401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2640 -ip 26401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 5401⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F1⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"1⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit1⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E2⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E2⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"1⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E1⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"1⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F1⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6490317.exeFilesize
22KB
MD5f2796907ef9577d20993f15a4a3fb8c6
SHA1eb159cc32ac8abc849c6d8fce00a99ed8dca5cea
SHA25673937f8d44cae997319d28aebaa613196382b83802533b81eb613ad302f8b8d6
SHA51247f60a1cb43f985bb62be7de78a1e3bca2aac9846e68d2db70facd7834013ecddfe9938d338877f319d42ef18f4b562fc50463f7924e74d5242d086dee3eb4db
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6490317.exeFilesize
22KB
MD5f2796907ef9577d20993f15a4a3fb8c6
SHA1eb159cc32ac8abc849c6d8fce00a99ed8dca5cea
SHA25673937f8d44cae997319d28aebaa613196382b83802533b81eb613ad302f8b8d6
SHA51247f60a1cb43f985bb62be7de78a1e3bca2aac9846e68d2db70facd7834013ecddfe9938d338877f319d42ef18f4b562fc50463f7924e74d5242d086dee3eb4db
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5740436.exeFilesize
961KB
MD565bc7c22f407bc2599a22818fc688b02
SHA11edc8eab6227b7e323264d36201f78c5c36eeb5a
SHA256b31ca60da1fb3cba3602478786b356416fb25805a53cd77f0baaf8f235315de9
SHA512b96271e4ff1d79ff1bfd41d6300cf43164be19a48eda08c9ad0d5da525f8e62a284061f818a6059e5687979634e9e708cf24b2a21fe5f819cec0052affaa3e5f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5740436.exeFilesize
961KB
MD565bc7c22f407bc2599a22818fc688b02
SHA11edc8eab6227b7e323264d36201f78c5c36eeb5a
SHA256b31ca60da1fb3cba3602478786b356416fb25805a53cd77f0baaf8f235315de9
SHA512b96271e4ff1d79ff1bfd41d6300cf43164be19a48eda08c9ad0d5da525f8e62a284061f818a6059e5687979634e9e708cf24b2a21fe5f819cec0052affaa3e5f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0292593.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0292593.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8614331.exeFilesize
779KB
MD52d803d6696251f8e4d329652685f5a6f
SHA1f955a5a41d392b8b26e4769c7f0c3ba1b89be060
SHA2564554fece4c099a8752975db2f02f2695db5e4cd04f5dfb9530258a9395e26732
SHA512eb93c5d4a1a2028df50aefd944cba2fcc673f4d0621a39a7ad4c3fa1483a80efa36fb89e2ae2318f0858dc8e6a20d683fb0e31294778a513dd112619ff2e06b8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8614331.exeFilesize
779KB
MD52d803d6696251f8e4d329652685f5a6f
SHA1f955a5a41d392b8b26e4769c7f0c3ba1b89be060
SHA2564554fece4c099a8752975db2f02f2695db5e4cd04f5dfb9530258a9395e26732
SHA512eb93c5d4a1a2028df50aefd944cba2fcc673f4d0621a39a7ad4c3fa1483a80efa36fb89e2ae2318f0858dc8e6a20d683fb0e31294778a513dd112619ff2e06b8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5061818.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5061818.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2418566.exeFilesize
596KB
MD5da20071b985a3f6b3a207772b23d9bc1
SHA152e087385a2b6cb2dd49a911a44371111a06b716
SHA2566a7600009850c312d9cd379effd3a50b2fcefc8aa386526ee0ebce5e294f39c7
SHA512e00d1970eb3317c9bbecd823144006b33f79c4108b3f3aeafcafbf3d09a451365606fa792435b9a077d7bc2136ed0c03934bf348457149522fa9ddbfe9a60aeb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2418566.exeFilesize
596KB
MD5da20071b985a3f6b3a207772b23d9bc1
SHA152e087385a2b6cb2dd49a911a44371111a06b716
SHA2566a7600009850c312d9cd379effd3a50b2fcefc8aa386526ee0ebce5e294f39c7
SHA512e00d1970eb3317c9bbecd823144006b33f79c4108b3f3aeafcafbf3d09a451365606fa792435b9a077d7bc2136ed0c03934bf348457149522fa9ddbfe9a60aeb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3778753.exeFilesize
384KB
MD57fd39439967a5144a9c841b1aebfd224
SHA192727cb8453a025ec767b38fcadbaf4d52846a4f
SHA2568b63729d1194789cde9e72e449660a42884ddcd232ecc622cf8da99d5620976f
SHA512fd29383b60f5e637908bcf18ae46d3d5b4ee04402933d43287b89f5b54ad66ab352132313f20eb3c6030ca50bd669d68794e82eb1c68a0830a7e180e86b1cabb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3778753.exeFilesize
384KB
MD57fd39439967a5144a9c841b1aebfd224
SHA192727cb8453a025ec767b38fcadbaf4d52846a4f
SHA2568b63729d1194789cde9e72e449660a42884ddcd232ecc622cf8da99d5620976f
SHA512fd29383b60f5e637908bcf18ae46d3d5b4ee04402933d43287b89f5b54ad66ab352132313f20eb3c6030ca50bd669d68794e82eb1c68a0830a7e180e86b1cabb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6053692.exeFilesize
336KB
MD53ab2abc0235dfee9ea32e20209995e5a
SHA10ef36aa3be516403a3a0e230d70d60937eaceb09
SHA25696e34a34ccaf24497247410b6d2fb8c30ffe12199b594c56691cd2557dff5267
SHA512be1f0a0b625b29a7033f5c6d40ad6b5f1e067be68282bb910541a6678f64077b0e7bce301a51e18f76e9a5ac7d64d2d4384568c7ba647918b5e66eae4bd959c2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6053692.exeFilesize
336KB
MD53ab2abc0235dfee9ea32e20209995e5a
SHA10ef36aa3be516403a3a0e230d70d60937eaceb09
SHA25696e34a34ccaf24497247410b6d2fb8c30ffe12199b594c56691cd2557dff5267
SHA512be1f0a0b625b29a7033f5c6d40ad6b5f1e067be68282bb910541a6678f64077b0e7bce301a51e18f76e9a5ac7d64d2d4384568c7ba647918b5e66eae4bd959c2
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1823341.exeFilesize
221KB
MD555db718a8ae24ef253f183b0d49f7a61
SHA16f2303441030793bcd09271b65027701b2971d04
SHA256731bc12e2afa6a730fba2c24464cf0d013b7cc3494117c8e94c7868f23967111
SHA5122d785b495f2752f9687d53094b53b38195962c968d4dafc76854dab523c451285dbb334bfac38ba9a3a9c1814ad52a72059fe2da337662dd255739f532e6f9a8
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1823341.exeFilesize
221KB
MD555db718a8ae24ef253f183b0d49f7a61
SHA16f2303441030793bcd09271b65027701b2971d04
SHA256731bc12e2afa6a730fba2c24464cf0d013b7cc3494117c8e94c7868f23967111
SHA5122d785b495f2752f9687d53094b53b38195962c968d4dafc76854dab523c451285dbb334bfac38ba9a3a9c1814ad52a72059fe2da337662dd255739f532e6f9a8
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1866637.exeFilesize
350KB
MD55615ededb975df6f80cc07cd90e71aa5
SHA1f28ac848791b528ddab2e099d377c48831089101
SHA2562544829b6bb4814f498bfdea54d760c50e3338d276694fde9b4c3a5cc932c6c9
SHA51254477a5bf035eafd06d4fe4c1182221c73e7f295c383527487406d9d40b9900d3520df2b21042fb00d68dc4b35769ccf8da552a9e8c554eda5df937944705abc
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1866637.exeFilesize
350KB
MD55615ededb975df6f80cc07cd90e71aa5
SHA1f28ac848791b528ddab2e099d377c48831089101
SHA2562544829b6bb4814f498bfdea54d760c50e3338d276694fde9b4c3a5cc932c6c9
SHA51254477a5bf035eafd06d4fe4c1182221c73e7f295c383527487406d9d40b9900d3520df2b21042fb00d68dc4b35769ccf8da552a9e8c554eda5df937944705abc
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2556-61-0x0000000004E70000-0x0000000004EAC000-memory.dmpFilesize
240KB
-
memory/2556-71-0x0000000004FF0000-0x000000000503C000-memory.dmpFilesize
304KB
-
memory/2556-50-0x0000000073E20000-0x00000000745D0000-memory.dmpFilesize
7.7MB
-
memory/2556-49-0x0000000004D70000-0x0000000004D76000-memory.dmpFilesize
24KB
-
memory/2556-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2556-87-0x0000000073E20000-0x00000000745D0000-memory.dmpFilesize
7.7MB
-
memory/2556-88-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/2556-59-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/2556-58-0x0000000004E10000-0x0000000004E22000-memory.dmpFilesize
72KB
-
memory/2556-57-0x0000000004EE0000-0x0000000004FEA000-memory.dmpFilesize
1.0MB
-
memory/2556-56-0x00000000053E0000-0x00000000059F8000-memory.dmpFilesize
6.1MB
-
memory/2640-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2640-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2640-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2640-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4692-86-0x0000000073E20000-0x00000000745D0000-memory.dmpFilesize
7.7MB
-
memory/4692-84-0x0000000073E20000-0x00000000745D0000-memory.dmpFilesize
7.7MB
-
memory/4692-36-0x0000000073E20000-0x00000000745D0000-memory.dmpFilesize
7.7MB
-
memory/4692-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB