Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:21
Static task
static1
Behavioral task
behavioral1
Sample
b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exe
Resource
win7-20230831-en
General
-
Target
b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exe
-
Size
1.0MB
-
MD5
81fe9b196dfd200fac039ab5c5c446e9
-
SHA1
9778b12c16846c25f4a3f068a44a7369ad49b2e0
-
SHA256
b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a
-
SHA512
b9938694bfd326767cf46476aac747c0dfd0742e874ccc30bda224b6cf40781c2396c65e70d4d9ceff6fdd983101c2f8a59d4db5140e88a62862097f4c865a33
-
SSDEEP
24576:kyWeVllONS8CpoHgbV23ssXl6jbLYI2vtEW2z/MSJF:znlz8C2B806j/YI2CW2zU
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3016-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3016-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3016-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3016-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4284-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t9271471.exeexplonde.exeu6916323.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation t9271471.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation u6916323.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z2624870.exez0458869.exez2857626.exez4348830.exeq6317268.exer5179810.exes6775493.exet9271471.exeexplonde.exeu6916323.exelegota.exew6004923.exeexplonde.exelegota.exeexplonde.exelegota.exepid process 2836 z2624870.exe 4276 z0458869.exe 628 z2857626.exe 3104 z4348830.exe 3868 q6317268.exe 4684 r5179810.exe 2128 s6775493.exe 3240 t9271471.exe 3544 explonde.exe 4996 u6916323.exe 4948 legota.exe 3648 w6004923.exe 5080 explonde.exe 4100 legota.exe 4432 explonde.exe 3920 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4684 rundll32.exe 3336 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z4348830.exeb050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exez2624870.exez0458869.exez2857626.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z4348830.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z2624870.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z0458869.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z2857626.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q6317268.exer5179810.exes6775493.exedescription pid process target process PID 3868 set thread context of 4284 3868 q6317268.exe AppLaunch.exe PID 4684 set thread context of 3016 4684 r5179810.exe AppLaunch.exe PID 2128 set thread context of 2100 2128 s6775493.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1644 3868 WerFault.exe q6317268.exe 1976 4684 WerFault.exe r5179810.exe 2524 3016 WerFault.exe AppLaunch.exe 2088 2128 WerFault.exe s6775493.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2356 schtasks.exe 3128 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 4284 AppLaunch.exe 4284 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4284 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exez2624870.exez0458869.exez2857626.exez4348830.exeq6317268.exer5179810.exes6775493.exet9271471.exeexplonde.exeu6916323.exedescription pid process target process PID 2936 wrote to memory of 2836 2936 b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exe z2624870.exe PID 2936 wrote to memory of 2836 2936 b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exe z2624870.exe PID 2936 wrote to memory of 2836 2936 b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exe z2624870.exe PID 2836 wrote to memory of 4276 2836 z2624870.exe z0458869.exe PID 2836 wrote to memory of 4276 2836 z2624870.exe z0458869.exe PID 2836 wrote to memory of 4276 2836 z2624870.exe z0458869.exe PID 4276 wrote to memory of 628 4276 z0458869.exe z2857626.exe PID 4276 wrote to memory of 628 4276 z0458869.exe z2857626.exe PID 4276 wrote to memory of 628 4276 z0458869.exe z2857626.exe PID 628 wrote to memory of 3104 628 z2857626.exe z4348830.exe PID 628 wrote to memory of 3104 628 z2857626.exe z4348830.exe PID 628 wrote to memory of 3104 628 z2857626.exe z4348830.exe PID 3104 wrote to memory of 3868 3104 z4348830.exe q6317268.exe PID 3104 wrote to memory of 3868 3104 z4348830.exe q6317268.exe PID 3104 wrote to memory of 3868 3104 z4348830.exe q6317268.exe PID 3868 wrote to memory of 4284 3868 q6317268.exe AppLaunch.exe PID 3868 wrote to memory of 4284 3868 q6317268.exe AppLaunch.exe PID 3868 wrote to memory of 4284 3868 q6317268.exe AppLaunch.exe PID 3868 wrote to memory of 4284 3868 q6317268.exe AppLaunch.exe PID 3868 wrote to memory of 4284 3868 q6317268.exe AppLaunch.exe PID 3868 wrote to memory of 4284 3868 q6317268.exe AppLaunch.exe PID 3868 wrote to memory of 4284 3868 q6317268.exe AppLaunch.exe PID 3868 wrote to memory of 4284 3868 q6317268.exe AppLaunch.exe PID 3104 wrote to memory of 4684 3104 z4348830.exe r5179810.exe PID 3104 wrote to memory of 4684 3104 z4348830.exe r5179810.exe PID 3104 wrote to memory of 4684 3104 z4348830.exe r5179810.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 4684 wrote to memory of 3016 4684 r5179810.exe AppLaunch.exe PID 628 wrote to memory of 2128 628 z2857626.exe s6775493.exe PID 628 wrote to memory of 2128 628 z2857626.exe s6775493.exe PID 628 wrote to memory of 2128 628 z2857626.exe s6775493.exe PID 2128 wrote to memory of 2100 2128 s6775493.exe AppLaunch.exe PID 2128 wrote to memory of 2100 2128 s6775493.exe AppLaunch.exe PID 2128 wrote to memory of 2100 2128 s6775493.exe AppLaunch.exe PID 2128 wrote to memory of 2100 2128 s6775493.exe AppLaunch.exe PID 2128 wrote to memory of 2100 2128 s6775493.exe AppLaunch.exe PID 2128 wrote to memory of 2100 2128 s6775493.exe AppLaunch.exe PID 2128 wrote to memory of 2100 2128 s6775493.exe AppLaunch.exe PID 2128 wrote to memory of 2100 2128 s6775493.exe AppLaunch.exe PID 4276 wrote to memory of 3240 4276 z0458869.exe t9271471.exe PID 4276 wrote to memory of 3240 4276 z0458869.exe t9271471.exe PID 4276 wrote to memory of 3240 4276 z0458869.exe t9271471.exe PID 3240 wrote to memory of 3544 3240 t9271471.exe explonde.exe PID 3240 wrote to memory of 3544 3240 t9271471.exe explonde.exe PID 3240 wrote to memory of 3544 3240 t9271471.exe explonde.exe PID 2836 wrote to memory of 4996 2836 z2624870.exe u6916323.exe PID 2836 wrote to memory of 4996 2836 z2624870.exe u6916323.exe PID 2836 wrote to memory of 4996 2836 z2624870.exe u6916323.exe PID 3544 wrote to memory of 2356 3544 explonde.exe schtasks.exe PID 3544 wrote to memory of 2356 3544 explonde.exe schtasks.exe PID 3544 wrote to memory of 2356 3544 explonde.exe schtasks.exe PID 3544 wrote to memory of 4888 3544 explonde.exe cmd.exe PID 3544 wrote to memory of 4888 3544 explonde.exe cmd.exe PID 3544 wrote to memory of 4888 3544 explonde.exe cmd.exe PID 4996 wrote to memory of 4948 4996 u6916323.exe legota.exe PID 4996 wrote to memory of 4948 4996 u6916323.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exe"C:\Users\Admin\AppData\Local\Temp\b050c9617f0af1d2326463f6be0a83a74604729f9af54c7f1645a417fce2f37a_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2624870.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2624870.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0458869.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0458869.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2857626.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2857626.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4348830.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4348830.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6317268.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6317268.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 5927⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5179810.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5179810.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 1968⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 1527⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6775493.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6775493.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 1486⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9271471.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9271471.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6916323.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6916323.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6004923.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6004923.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3868 -ip 38681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4684 -ip 46841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3016 -ip 30161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2128 -ip 21281⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6004923.exeFilesize
22KB
MD5fcf07b7ddd159ee6dfa7a85896c47b71
SHA1b0954f5b020d4d96202e16db9fd837ff464efddd
SHA256385dd36fd35db0e14483d932597c57279f9609a83e33f364de439074a177569d
SHA512d1daa26f1e08f7f2a593f8a9f59bf3e02a5f9e81819ec03ef030af5609731ed3995fcdb685b6177025fe868e221f467a7571c317ce3cc969c0a58b938497d1b2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6004923.exeFilesize
22KB
MD5fcf07b7ddd159ee6dfa7a85896c47b71
SHA1b0954f5b020d4d96202e16db9fd837ff464efddd
SHA256385dd36fd35db0e14483d932597c57279f9609a83e33f364de439074a177569d
SHA512d1daa26f1e08f7f2a593f8a9f59bf3e02a5f9e81819ec03ef030af5609731ed3995fcdb685b6177025fe868e221f467a7571c317ce3cc969c0a58b938497d1b2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2624870.exeFilesize
965KB
MD542cc72fd0724b47b064b2a153247ee7e
SHA17ba70a4ec5a01d7fa62f4c1ad372ad177df571d6
SHA25629281b2356c8b4bd54ab75a9fe36482a8e4c656aefa561568668382fea383332
SHA512d7e6c395853504d51079bb40b8d49f34aa92b4f3dffb24682e0c9f8a57a8fef3206ce551844747f714af80bed49c8c2899209e50e101bc00c147cd503706f974
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2624870.exeFilesize
965KB
MD542cc72fd0724b47b064b2a153247ee7e
SHA17ba70a4ec5a01d7fa62f4c1ad372ad177df571d6
SHA25629281b2356c8b4bd54ab75a9fe36482a8e4c656aefa561568668382fea383332
SHA512d7e6c395853504d51079bb40b8d49f34aa92b4f3dffb24682e0c9f8a57a8fef3206ce551844747f714af80bed49c8c2899209e50e101bc00c147cd503706f974
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6916323.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6916323.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0458869.exeFilesize
782KB
MD5fa451b33c49e51c62995c5d47d5a22d1
SHA1052ffa7fdda378ef90e3801035048b8c2f5b2883
SHA256eb882e160040d930f9a9e83c8e20a9ed8571968d40069548f87f322e823ec2b6
SHA512b9b2e24a0e37eb446d1ea127069428cba3996fc5fdf7a8ebd346847580ed32045678dae9b3a8443e3342c4e72a62bc8abdebb57232f25e5e110d92f1c2ff2b19
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0458869.exeFilesize
782KB
MD5fa451b33c49e51c62995c5d47d5a22d1
SHA1052ffa7fdda378ef90e3801035048b8c2f5b2883
SHA256eb882e160040d930f9a9e83c8e20a9ed8571968d40069548f87f322e823ec2b6
SHA512b9b2e24a0e37eb446d1ea127069428cba3996fc5fdf7a8ebd346847580ed32045678dae9b3a8443e3342c4e72a62bc8abdebb57232f25e5e110d92f1c2ff2b19
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9271471.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9271471.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2857626.exeFilesize
599KB
MD5be5542a6a3bda0494994e3dd4d0e4dbb
SHA17155aede7f8c9127f9b9a5a7b7b14eba5e3941c7
SHA2568c79de79c16805e08e9a4399401b71fb286a9f209af23065ab70c9a6207376ea
SHA512b6748c429bd3a13e439341a96f3d9eb9b1c10df9b8d20c13a018103d126d388e1b44c8f56cfc01cca744839ab4893dafd430c1eaee447be01376ac967e040737
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2857626.exeFilesize
599KB
MD5be5542a6a3bda0494994e3dd4d0e4dbb
SHA17155aede7f8c9127f9b9a5a7b7b14eba5e3941c7
SHA2568c79de79c16805e08e9a4399401b71fb286a9f209af23065ab70c9a6207376ea
SHA512b6748c429bd3a13e439341a96f3d9eb9b1c10df9b8d20c13a018103d126d388e1b44c8f56cfc01cca744839ab4893dafd430c1eaee447be01376ac967e040737
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6775493.exeFilesize
380KB
MD505e52a7d903900de476107dd0b7002f3
SHA1f405b892b239f6bdb5e5f63ea2adb7de984bbf92
SHA2562cf508b256683db1dd7726c3f069b8b8f5cccbeb1d6c85f6c68c16229e5e771c
SHA5122e7a71dfb14581039cc49bbd34acdb6715e60387e6971963d46c6bc83b80613ff6b1e8e34c9a8184d27c982af62c09d8032eb2102f419e8d7cf48703dd0ccbb6
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6775493.exeFilesize
380KB
MD505e52a7d903900de476107dd0b7002f3
SHA1f405b892b239f6bdb5e5f63ea2adb7de984bbf92
SHA2562cf508b256683db1dd7726c3f069b8b8f5cccbeb1d6c85f6c68c16229e5e771c
SHA5122e7a71dfb14581039cc49bbd34acdb6715e60387e6971963d46c6bc83b80613ff6b1e8e34c9a8184d27c982af62c09d8032eb2102f419e8d7cf48703dd0ccbb6
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4348830.exeFilesize
337KB
MD55a76d2b59619945f2358a26f4243e370
SHA1cff0b83021db9e627e892895b59410491ef0ffa9
SHA2566b6bcaebb9d8f3dc93b00d0838f88627c0ff62763de8ab70c5d8a5642f30b698
SHA512f8ab0a1d49b2dde9c3ba7654b2236250a6a7c6b8fca7351ec2b4f81094e567325d4107bfd28742ee4bc358132bd829edab03b942245cbda3e460de8ed6b75d3b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4348830.exeFilesize
337KB
MD55a76d2b59619945f2358a26f4243e370
SHA1cff0b83021db9e627e892895b59410491ef0ffa9
SHA2566b6bcaebb9d8f3dc93b00d0838f88627c0ff62763de8ab70c5d8a5642f30b698
SHA512f8ab0a1d49b2dde9c3ba7654b2236250a6a7c6b8fca7351ec2b4f81094e567325d4107bfd28742ee4bc358132bd829edab03b942245cbda3e460de8ed6b75d3b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6317268.exeFilesize
217KB
MD59e7b526c34995f49aa45f9117051cee8
SHA1b699dc5667d1c15326dfbcdadc340fc898fd79e7
SHA256b35f3b622a17e7bc70472e81f32794561ef6d53290026c0d46fb048c36b3919b
SHA51205c1f42999691be58749c6d6bbf7cb5d27bf93455d1ab420603665040ebcc4c758ba5b3491e0462c1736f4aed8218fb412f55acd04bcfb27451a312fe5c05d5f
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6317268.exeFilesize
217KB
MD59e7b526c34995f49aa45f9117051cee8
SHA1b699dc5667d1c15326dfbcdadc340fc898fd79e7
SHA256b35f3b622a17e7bc70472e81f32794561ef6d53290026c0d46fb048c36b3919b
SHA51205c1f42999691be58749c6d6bbf7cb5d27bf93455d1ab420603665040ebcc4c758ba5b3491e0462c1736f4aed8218fb412f55acd04bcfb27451a312fe5c05d5f
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5179810.exeFilesize
346KB
MD52f8b6052f33361009f4e5795f48f9173
SHA1b81ff72a6489eb3fecc6f72671a879d4691104ad
SHA25678b8f928904d1e4665828fda48e5aa602590ad57f2f7fb68bc482bba08bcaf21
SHA512e526d10b744284d7efee124aa7dde23e3134a12d1b517a162295a40854a513a60ca7f1ece5b8672193b051d8af775d85fe59b19630849c88cecefb26b1acc534
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5179810.exeFilesize
346KB
MD52f8b6052f33361009f4e5795f48f9173
SHA1b81ff72a6489eb3fecc6f72671a879d4691104ad
SHA25678b8f928904d1e4665828fda48e5aa602590ad57f2f7fb68bc482bba08bcaf21
SHA512e526d10b744284d7efee124aa7dde23e3134a12d1b517a162295a40854a513a60ca7f1ece5b8672193b051d8af775d85fe59b19630849c88cecefb26b1acc534
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2100-87-0x0000000073D30000-0x00000000744E0000-memory.dmpFilesize
7.7MB
-
memory/2100-49-0x0000000005250000-0x0000000005256000-memory.dmpFilesize
24KB
-
memory/2100-61-0x0000000005350000-0x000000000538C000-memory.dmpFilesize
240KB
-
memory/2100-60-0x00000000052B0000-0x00000000052C0000-memory.dmpFilesize
64KB
-
memory/2100-64-0x00000000054E0000-0x000000000552C000-memory.dmpFilesize
304KB
-
memory/2100-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2100-88-0x00000000052B0000-0x00000000052C0000-memory.dmpFilesize
64KB
-
memory/2100-58-0x00000000052F0000-0x0000000005302000-memory.dmpFilesize
72KB
-
memory/2100-55-0x00000000053D0000-0x00000000054DA000-memory.dmpFilesize
1.0MB
-
memory/2100-52-0x00000000058E0000-0x0000000005EF8000-memory.dmpFilesize
6.1MB
-
memory/2100-50-0x0000000073D30000-0x00000000744E0000-memory.dmpFilesize
7.7MB
-
memory/3016-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3016-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3016-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3016-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4284-59-0x0000000073D30000-0x00000000744E0000-memory.dmpFilesize
7.7MB
-
memory/4284-86-0x0000000073D30000-0x00000000744E0000-memory.dmpFilesize
7.7MB
-
memory/4284-36-0x0000000073D30000-0x00000000744E0000-memory.dmpFilesize
7.7MB
-
memory/4284-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB