Analysis
-
max time kernel
169s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:16
Static task
static1
Behavioral task
behavioral1
Sample
c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exe
Resource
win7-20230831-en
General
-
Target
c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exe
-
Size
1.1MB
-
MD5
22b437aa13107163236f6a01c5e870b5
-
SHA1
ef363e1c6caf686d350b4d58ef805001ab9e0733
-
SHA256
c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef
-
SHA512
0e62f0f40e6a7c066186ba86d0b9df436686815bac07c3112cbcbba82194ecd3cbfc777c2196cad9c846ac7de77fcfe804a3b02f1ef0180ff15d1b6b19d82c82
-
SSDEEP
24576:pyEN6z26qAgoHdFP8LzPg9sPjhIkRua0ATrR5F:cE96djEHYgjq83x
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4884-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4884-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4884-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4884-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4620-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t6661504.exeexplonde.exeu7118821.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation t6661504.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation u7118821.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 14 IoCs
Processes:
z6328533.exez7253493.exez8051540.exez8497352.exeq6486953.exer1850685.exes1643562.exet6661504.exeexplonde.exeu7118821.exelegota.exew7515182.exeexplonde.exelegota.exepid process 2732 z6328533.exe 2012 z7253493.exe 3336 z8051540.exe 1776 z8497352.exe 1656 q6486953.exe 4040 r1850685.exe 4740 s1643562.exe 2808 t6661504.exe 2588 explonde.exe 4668 u7118821.exe 3280 legota.exe 2884 w7515182.exe 468 explonde.exe 1704 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2732 rundll32.exe 2000 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z8051540.exez8497352.exec188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exez6328533.exez7253493.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z8051540.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z8497352.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z6328533.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7253493.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q6486953.exer1850685.exes1643562.exedescription pid process target process PID 1656 set thread context of 4620 1656 q6486953.exe AppLaunch.exe PID 4040 set thread context of 4884 4040 r1850685.exe AppLaunch.exe PID 4740 set thread context of 1864 4740 s1643562.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4448 1656 WerFault.exe q6486953.exe 1748 4040 WerFault.exe r1850685.exe 4388 4884 WerFault.exe AppLaunch.exe 4928 4740 WerFault.exe s1643562.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3828 schtasks.exe 2208 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 4620 AppLaunch.exe 4620 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4620 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exez6328533.exez7253493.exez8051540.exez8497352.exeq6486953.exer1850685.exes1643562.exet6661504.exeexplonde.exedescription pid process target process PID 928 wrote to memory of 2732 928 c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exe z6328533.exe PID 928 wrote to memory of 2732 928 c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exe z6328533.exe PID 928 wrote to memory of 2732 928 c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exe z6328533.exe PID 2732 wrote to memory of 2012 2732 z6328533.exe z7253493.exe PID 2732 wrote to memory of 2012 2732 z6328533.exe z7253493.exe PID 2732 wrote to memory of 2012 2732 z6328533.exe z7253493.exe PID 2012 wrote to memory of 3336 2012 z7253493.exe z8051540.exe PID 2012 wrote to memory of 3336 2012 z7253493.exe z8051540.exe PID 2012 wrote to memory of 3336 2012 z7253493.exe z8051540.exe PID 3336 wrote to memory of 1776 3336 z8051540.exe z8497352.exe PID 3336 wrote to memory of 1776 3336 z8051540.exe z8497352.exe PID 3336 wrote to memory of 1776 3336 z8051540.exe z8497352.exe PID 1776 wrote to memory of 1656 1776 z8497352.exe q6486953.exe PID 1776 wrote to memory of 1656 1776 z8497352.exe q6486953.exe PID 1776 wrote to memory of 1656 1776 z8497352.exe q6486953.exe PID 1656 wrote to memory of 1584 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 1584 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 1584 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 4620 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 4620 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 4620 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 4620 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 4620 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 4620 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 4620 1656 q6486953.exe AppLaunch.exe PID 1656 wrote to memory of 4620 1656 q6486953.exe AppLaunch.exe PID 1776 wrote to memory of 4040 1776 z8497352.exe r1850685.exe PID 1776 wrote to memory of 4040 1776 z8497352.exe r1850685.exe PID 1776 wrote to memory of 4040 1776 z8497352.exe r1850685.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 4040 wrote to memory of 4884 4040 r1850685.exe AppLaunch.exe PID 3336 wrote to memory of 4740 3336 z8051540.exe s1643562.exe PID 3336 wrote to memory of 4740 3336 z8051540.exe s1643562.exe PID 3336 wrote to memory of 4740 3336 z8051540.exe s1643562.exe PID 4740 wrote to memory of 1864 4740 s1643562.exe AppLaunch.exe PID 4740 wrote to memory of 1864 4740 s1643562.exe AppLaunch.exe PID 4740 wrote to memory of 1864 4740 s1643562.exe AppLaunch.exe PID 4740 wrote to memory of 1864 4740 s1643562.exe AppLaunch.exe PID 4740 wrote to memory of 1864 4740 s1643562.exe AppLaunch.exe PID 4740 wrote to memory of 1864 4740 s1643562.exe AppLaunch.exe PID 4740 wrote to memory of 1864 4740 s1643562.exe AppLaunch.exe PID 4740 wrote to memory of 1864 4740 s1643562.exe AppLaunch.exe PID 2012 wrote to memory of 2808 2012 z7253493.exe t6661504.exe PID 2012 wrote to memory of 2808 2012 z7253493.exe t6661504.exe PID 2012 wrote to memory of 2808 2012 z7253493.exe t6661504.exe PID 2808 wrote to memory of 2588 2808 t6661504.exe explonde.exe PID 2808 wrote to memory of 2588 2808 t6661504.exe explonde.exe PID 2808 wrote to memory of 2588 2808 t6661504.exe explonde.exe PID 2732 wrote to memory of 4668 2732 z6328533.exe u7118821.exe PID 2732 wrote to memory of 4668 2732 z6328533.exe u7118821.exe PID 2732 wrote to memory of 4668 2732 z6328533.exe u7118821.exe PID 2588 wrote to memory of 3828 2588 explonde.exe schtasks.exe PID 2588 wrote to memory of 3828 2588 explonde.exe schtasks.exe PID 2588 wrote to memory of 3828 2588 explonde.exe schtasks.exe PID 2588 wrote to memory of 2244 2588 explonde.exe cmd.exe PID 2588 wrote to memory of 2244 2588 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exe"C:\Users\Admin\AppData\Local\Temp\c188d8b61704913f9c174a3aeb4dc8527a3527776a78c4c7fc27f03994cb4bef.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6328533.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6328533.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7253493.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7253493.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8051540.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8051540.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8497352.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8497352.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6486953.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6486953.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1584
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 5887⤵
- Program crash
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1850685.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1850685.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 5408⤵
- Program crash
PID:4388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 5847⤵
- Program crash
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1643562.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1643562.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:1864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 1406⤵
- Program crash
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6661504.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6661504.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
PID:3828 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:2244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1684
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵PID:2000
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵PID:212
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:4932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3192
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:2060
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u7118821.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u7118821.exe3⤵
- Checks computer location settings
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3280 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:2208 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:1276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4820
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:208
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:2232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4160
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:1980
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:180
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7515182.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7515182.exe2⤵
- Executes dropped EXE
PID:2884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1656 -ip 16561⤵PID:2604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4040 -ip 40401⤵PID:4432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4884 -ip 48841⤵PID:4980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4740 -ip 47401⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:468
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:1704
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7515182.exeFilesize
23KB
MD5c7c04be96f5eeb23ff66349c33a941c3
SHA190cb6899fe8c19468c157b04005b2ef567cd6f8e
SHA2568c0ae23994c5031354e4271a4006a68293f10d71107d8b3b1511a9f3aeffb346
SHA5121d4387bec509904b78ea7dfebed499c891821f664d12ff9ecebfb17fb3f2c8e5d55c3a671f485075ebc469d7ac88c77be8debf988388d9541a6073157473e7ea
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7515182.exeFilesize
23KB
MD5c7c04be96f5eeb23ff66349c33a941c3
SHA190cb6899fe8c19468c157b04005b2ef567cd6f8e
SHA2568c0ae23994c5031354e4271a4006a68293f10d71107d8b3b1511a9f3aeffb346
SHA5121d4387bec509904b78ea7dfebed499c891821f664d12ff9ecebfb17fb3f2c8e5d55c3a671f485075ebc469d7ac88c77be8debf988388d9541a6073157473e7ea
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6328533.exeFilesize
983KB
MD55d8e4fe392f5fae0733d63b27d3f7c1e
SHA1fbe54a0b1a9d64e831c9fbd258e77de82897f1ef
SHA256fd7e36e6fc96e53182ccf1cfe5785f22e033d6c437a857df699a1a8c1bd642cc
SHA51247b44c7dda27c87ad7ea10bb90653a5f9e6561388cfbf83a314db992c57eb9c947e3afde272921ec938704e4c74b6f603343e523edb1c49022a61794a7c65584
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6328533.exeFilesize
983KB
MD55d8e4fe392f5fae0733d63b27d3f7c1e
SHA1fbe54a0b1a9d64e831c9fbd258e77de82897f1ef
SHA256fd7e36e6fc96e53182ccf1cfe5785f22e033d6c437a857df699a1a8c1bd642cc
SHA51247b44c7dda27c87ad7ea10bb90653a5f9e6561388cfbf83a314db992c57eb9c947e3afde272921ec938704e4c74b6f603343e523edb1c49022a61794a7c65584
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u7118821.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u7118821.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7253493.exeFilesize
800KB
MD5954c6481cf1c8cb8e108d24ef458143e
SHA192d076c86facaebaa19cc496fc64ec07ff60a80f
SHA2568c744c10165a87e012cbcb30d687a909bc8bc4cc075779187ef836c076e75cc6
SHA5125b5df0c2b5ed38c7b9d1df19a34f68c62e9e6ad6e964e6a8dd6538bc2925e5b84f17d7ad5ed6e82f93dc30bb7cf24adc2cbcdd885b05598217386f15551e357a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7253493.exeFilesize
800KB
MD5954c6481cf1c8cb8e108d24ef458143e
SHA192d076c86facaebaa19cc496fc64ec07ff60a80f
SHA2568c744c10165a87e012cbcb30d687a909bc8bc4cc075779187ef836c076e75cc6
SHA5125b5df0c2b5ed38c7b9d1df19a34f68c62e9e6ad6e964e6a8dd6538bc2925e5b84f17d7ad5ed6e82f93dc30bb7cf24adc2cbcdd885b05598217386f15551e357a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6661504.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6661504.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8051540.exeFilesize
616KB
MD58bb7fb99328f4899bb554ec567328ffd
SHA18d5939a9f2fcb4b88625965023c32939b9368c75
SHA256d6efcb9e677e49be855c8729f5e67e1b9946291308657bb6141b8789b4b70ed5
SHA51224d0932e46a4a801627552718b3cb6ff7deae41595549e3fb473de3107c8ab46056677f2493fe88d85bcbc2b9c647054301bcc436ba9435421c2200b6d020c6a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8051540.exeFilesize
616KB
MD58bb7fb99328f4899bb554ec567328ffd
SHA18d5939a9f2fcb4b88625965023c32939b9368c75
SHA256d6efcb9e677e49be855c8729f5e67e1b9946291308657bb6141b8789b4b70ed5
SHA51224d0932e46a4a801627552718b3cb6ff7deae41595549e3fb473de3107c8ab46056677f2493fe88d85bcbc2b9c647054301bcc436ba9435421c2200b6d020c6a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1643562.exeFilesize
390KB
MD5a40d8bb7599dbb09c43532b17c361291
SHA18b254e40310fc717a4173fe3040b729d07c27447
SHA2560b370bdbfe1c5b8fe3391c39ba7ca54ea270598c0bd559198b2e3dbe21c7f28d
SHA5123a884312af81017d36f739bf8fa1a6b1323e7f4ae6fd095eb79bdd841c2f6ba9acab6520cb2cbaf0350f5f567ee17c39aa0d09bba2ffcb58896ca1c902e8a5fa
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1643562.exeFilesize
390KB
MD5a40d8bb7599dbb09c43532b17c361291
SHA18b254e40310fc717a4173fe3040b729d07c27447
SHA2560b370bdbfe1c5b8fe3391c39ba7ca54ea270598c0bd559198b2e3dbe21c7f28d
SHA5123a884312af81017d36f739bf8fa1a6b1323e7f4ae6fd095eb79bdd841c2f6ba9acab6520cb2cbaf0350f5f567ee17c39aa0d09bba2ffcb58896ca1c902e8a5fa
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8497352.exeFilesize
345KB
MD55538d093e5bb8c65caa6364e538c755f
SHA1126e6dca2d7f577252c9af2e0742544b654432ae
SHA2564e9af08a9ffb1a7c5dea77a6782fc0318e08f2b56e6b97814e0f782fd3d45050
SHA512bed9461485dc3761e79948bbfd80efe3ef0bebd8c1918d4abea166fd780e847d24fdb9a4ae975b3767085663bdd864dad8b58765ed7ece24f2147265584fa2d6
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8497352.exeFilesize
345KB
MD55538d093e5bb8c65caa6364e538c755f
SHA1126e6dca2d7f577252c9af2e0742544b654432ae
SHA2564e9af08a9ffb1a7c5dea77a6782fc0318e08f2b56e6b97814e0f782fd3d45050
SHA512bed9461485dc3761e79948bbfd80efe3ef0bebd8c1918d4abea166fd780e847d24fdb9a4ae975b3767085663bdd864dad8b58765ed7ece24f2147265584fa2d6
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6486953.exeFilesize
227KB
MD5275cb2ddb9b5b80e89a15c50ca07e01d
SHA1e7fd135d7b205417b3b13a882a9f0be1b52ef81e
SHA2565c97bf847030800bb38e800d86b1b3f2782ff87a11bc2e6eb0fd12d32a9d41e8
SHA5129c14569302a0e5a6d4c9e7b1de5b26cd3ea56f914f116103af9c8b23ebc06bdeda347760959be808653ad3d01bfc790e625065b306299c9072f3fa91b7ba72e4
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6486953.exeFilesize
227KB
MD5275cb2ddb9b5b80e89a15c50ca07e01d
SHA1e7fd135d7b205417b3b13a882a9f0be1b52ef81e
SHA2565c97bf847030800bb38e800d86b1b3f2782ff87a11bc2e6eb0fd12d32a9d41e8
SHA5129c14569302a0e5a6d4c9e7b1de5b26cd3ea56f914f116103af9c8b23ebc06bdeda347760959be808653ad3d01bfc790e625065b306299c9072f3fa91b7ba72e4
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1850685.exeFilesize
356KB
MD5271645897461777a743988164105e5bd
SHA1c98846d2de6c17325c91744d33e18e0d746231dd
SHA256d4676f38eb1ebf3a8c63153234e9c5805f76d0c8d9411c50a6da71a414e6f831
SHA512d927baf94f6726d32c5cfd95261c5f90549ced9c4616cb326616dd5200e2643d2c2a9bd6211446588899da2a975b36a028ed6b027cf6d0cb5b2c0ab4720e627c
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1850685.exeFilesize
356KB
MD5271645897461777a743988164105e5bd
SHA1c98846d2de6c17325c91744d33e18e0d746231dd
SHA256d4676f38eb1ebf3a8c63153234e9c5805f76d0c8d9411c50a6da71a414e6f831
SHA512d927baf94f6726d32c5cfd95261c5f90549ced9c4616cb326616dd5200e2643d2c2a9bd6211446588899da2a975b36a028ed6b027cf6d0cb5b2c0ab4720e627c
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1864-62-0x00000000055A0000-0x00000000055B2000-memory.dmpFilesize
72KB
-
memory/1864-63-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/1864-54-0x0000000002ED0000-0x0000000002ED6000-memory.dmpFilesize
24KB
-
memory/1864-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1864-60-0x0000000005B70000-0x0000000006188000-memory.dmpFilesize
6.1MB
-
memory/1864-84-0x0000000074450000-0x0000000074C00000-memory.dmpFilesize
7.7MB
-
memory/1864-61-0x0000000005670000-0x000000000577A000-memory.dmpFilesize
1.0MB
-
memory/1864-53-0x0000000074450000-0x0000000074C00000-memory.dmpFilesize
7.7MB
-
memory/1864-89-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/1864-64-0x0000000005600000-0x000000000563C000-memory.dmpFilesize
240KB
-
memory/1864-65-0x0000000005780000-0x00000000057CC000-memory.dmpFilesize
304KB
-
memory/4620-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4620-36-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/4620-37-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/4620-39-0x0000000074490000-0x0000000074C40000-memory.dmpFilesize
7.7MB
-
memory/4884-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB