Analysis
-
max time kernel
166s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:22
Static task
static1
Behavioral task
behavioral1
Sample
a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe
Resource
win7-20230831-en
General
-
Target
a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe
-
Size
1.0MB
-
MD5
b2b1c29935851f07ebd3feaa052b544a
-
SHA1
f8ca761b11bb1649db852b3f472a4c68a236dea4
-
SHA256
a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9
-
SHA512
b42bf627ceeb6531bad47bdaedaabc2e0da3381a71da1be82552ec199b11cc9856925bd270201be25d180554694b37c0382c41803f4fbb9cd84cc7c1d7def17a
-
SSDEEP
24576:4yRwCOkAte0CNeFLRHbCWxfcIFDS51iOr2w:/RVOkA6Ned1uIFKfr
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1616-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1616-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1616-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1616-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/492-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explonde.exeu9569238.exelegota.exet1980237.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation u9569238.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation t1980237.exe -
Executes dropped EXE 14 IoCs
Processes:
z4168110.exez4699137.exez2673295.exez6998987.exeq7440141.exer7976049.exes0156258.exet1980237.exeexplonde.exeu9569238.exelegota.exew0847275.exelegota.exeexplonde.exepid process 4712 z4168110.exe 3944 z4699137.exe 4764 z2673295.exe 4624 z6998987.exe 2544 q7440141.exe 1504 r7976049.exe 820 s0156258.exe 2184 t1980237.exe 1824 explonde.exe 3820 u9569238.exe 4300 legota.exe 1016 w0847275.exe 4764 legota.exe 4276 explonde.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z2673295.exez6998987.exea4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exez4168110.exez4699137.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z2673295.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z6998987.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4168110.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4699137.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q7440141.exer7976049.exes0156258.exedescription pid process target process PID 2544 set thread context of 492 2544 q7440141.exe AppLaunch.exe PID 1504 set thread context of 1616 1504 r7976049.exe AppLaunch.exe PID 820 set thread context of 500 820 s0156258.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3380 2544 WerFault.exe q7440141.exe 1752 1504 WerFault.exe r7976049.exe 3788 1616 WerFault.exe AppLaunch.exe 2252 820 WerFault.exe s0156258.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1408 schtasks.exe 220 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 492 AppLaunch.exe 492 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 492 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exez4168110.exez4699137.exez2673295.exez6998987.exeq7440141.exer7976049.exes0156258.exet1980237.exeexplonde.exeu9569238.exedescription pid process target process PID 1392 wrote to memory of 4712 1392 a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe z4168110.exe PID 1392 wrote to memory of 4712 1392 a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe z4168110.exe PID 1392 wrote to memory of 4712 1392 a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe z4168110.exe PID 4712 wrote to memory of 3944 4712 z4168110.exe z4699137.exe PID 4712 wrote to memory of 3944 4712 z4168110.exe z4699137.exe PID 4712 wrote to memory of 3944 4712 z4168110.exe z4699137.exe PID 3944 wrote to memory of 4764 3944 z4699137.exe z2673295.exe PID 3944 wrote to memory of 4764 3944 z4699137.exe z2673295.exe PID 3944 wrote to memory of 4764 3944 z4699137.exe z2673295.exe PID 4764 wrote to memory of 4624 4764 z2673295.exe z6998987.exe PID 4764 wrote to memory of 4624 4764 z2673295.exe z6998987.exe PID 4764 wrote to memory of 4624 4764 z2673295.exe z6998987.exe PID 4624 wrote to memory of 2544 4624 z6998987.exe q7440141.exe PID 4624 wrote to memory of 2544 4624 z6998987.exe q7440141.exe PID 4624 wrote to memory of 2544 4624 z6998987.exe q7440141.exe PID 2544 wrote to memory of 492 2544 q7440141.exe AppLaunch.exe PID 2544 wrote to memory of 492 2544 q7440141.exe AppLaunch.exe PID 2544 wrote to memory of 492 2544 q7440141.exe AppLaunch.exe PID 2544 wrote to memory of 492 2544 q7440141.exe AppLaunch.exe PID 2544 wrote to memory of 492 2544 q7440141.exe AppLaunch.exe PID 2544 wrote to memory of 492 2544 q7440141.exe AppLaunch.exe PID 2544 wrote to memory of 492 2544 q7440141.exe AppLaunch.exe PID 2544 wrote to memory of 492 2544 q7440141.exe AppLaunch.exe PID 4624 wrote to memory of 1504 4624 z6998987.exe r7976049.exe PID 4624 wrote to memory of 1504 4624 z6998987.exe r7976049.exe PID 4624 wrote to memory of 1504 4624 z6998987.exe r7976049.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 1504 wrote to memory of 1616 1504 r7976049.exe AppLaunch.exe PID 4764 wrote to memory of 820 4764 z2673295.exe s0156258.exe PID 4764 wrote to memory of 820 4764 z2673295.exe s0156258.exe PID 4764 wrote to memory of 820 4764 z2673295.exe s0156258.exe PID 820 wrote to memory of 500 820 s0156258.exe AppLaunch.exe PID 820 wrote to memory of 500 820 s0156258.exe AppLaunch.exe PID 820 wrote to memory of 500 820 s0156258.exe AppLaunch.exe PID 820 wrote to memory of 500 820 s0156258.exe AppLaunch.exe PID 820 wrote to memory of 500 820 s0156258.exe AppLaunch.exe PID 820 wrote to memory of 500 820 s0156258.exe AppLaunch.exe PID 820 wrote to memory of 500 820 s0156258.exe AppLaunch.exe PID 820 wrote to memory of 500 820 s0156258.exe AppLaunch.exe PID 3944 wrote to memory of 2184 3944 z4699137.exe t1980237.exe PID 3944 wrote to memory of 2184 3944 z4699137.exe t1980237.exe PID 3944 wrote to memory of 2184 3944 z4699137.exe t1980237.exe PID 2184 wrote to memory of 1824 2184 t1980237.exe explonde.exe PID 2184 wrote to memory of 1824 2184 t1980237.exe explonde.exe PID 2184 wrote to memory of 1824 2184 t1980237.exe explonde.exe PID 4712 wrote to memory of 3820 4712 z4168110.exe u9569238.exe PID 4712 wrote to memory of 3820 4712 z4168110.exe u9569238.exe PID 4712 wrote to memory of 3820 4712 z4168110.exe u9569238.exe PID 1824 wrote to memory of 220 1824 explonde.exe schtasks.exe PID 1824 wrote to memory of 220 1824 explonde.exe schtasks.exe PID 1824 wrote to memory of 220 1824 explonde.exe schtasks.exe PID 3820 wrote to memory of 4300 3820 u9569238.exe legota.exe PID 3820 wrote to memory of 4300 3820 u9569238.exe legota.exe PID 3820 wrote to memory of 4300 3820 u9569238.exe legota.exe PID 1392 wrote to memory of 1016 1392 a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe w0847275.exe PID 1392 wrote to memory of 1016 1392 a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe w0847275.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe"C:\Users\Admin\AppData\Local\Temp\a4b82f919522f0078a8c8c87bc06902ca7a2c1cdfc74fc87dfe69641701534c9_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4168110.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4168110.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4699137.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4699137.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2673295.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2673295.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6998987.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6998987.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7440141.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7440141.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 5847⤵
- Program crash
PID:3380
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7976049.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7976049.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 5408⤵
- Program crash
PID:3788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1527⤵
- Program crash
PID:1752
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0156258.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0156258.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 1566⤵
- Program crash
PID:2252
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1980237.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1980237.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
PID:220
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:1740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:5076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵PID:4656
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵PID:776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4708
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:4164
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:1616
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9569238.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9569238.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4300 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:1408
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:5108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2976
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:2168
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:3728
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:860
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2972
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:4304
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0847275.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0847275.exe2⤵
- Executes dropped EXE
PID:1016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2544 -ip 25441⤵PID:4316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1504 -ip 15041⤵PID:784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1616 -ip 16161⤵PID:1164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 820 -ip 8201⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4764
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:4276
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD5a192ca4063d35140504b4b510264e11f
SHA14f2f488b8e040cbe5eb2167637dd166b11252042
SHA256c31ed89da7f67ac883ffb07eb3ef93d19c7babb6555876bba5fecf7ec519857d
SHA5128a4ac9f7044af21bbbf0328695ecf692cbc151ea47066e673ac41eb6795e17894316ae1557e2bac49fb495599d09aed56a736714db2ddafd528610ab4db727ac
-
Filesize
22KB
MD5a192ca4063d35140504b4b510264e11f
SHA14f2f488b8e040cbe5eb2167637dd166b11252042
SHA256c31ed89da7f67ac883ffb07eb3ef93d19c7babb6555876bba5fecf7ec519857d
SHA5128a4ac9f7044af21bbbf0328695ecf692cbc151ea47066e673ac41eb6795e17894316ae1557e2bac49fb495599d09aed56a736714db2ddafd528610ab4db727ac
-
Filesize
966KB
MD50358ecd4f90755ed5eb2aa469b2b57c0
SHA1cf4a2b13f4242ca59e84fd44e2b3e2e319573d41
SHA256e8fcdefd6402611303b94ffe0db171cbb639f29d948b4fe10737ef30f38a7e43
SHA5122b7d78ac61763dbd4f87e9fb2b0f8c9649ae83a29ac34135ce0e350e83987e5c88fd93c45fbdc226ef53e4082a9dd763ee61e42c626622b23a157a95e7bfe05e
-
Filesize
966KB
MD50358ecd4f90755ed5eb2aa469b2b57c0
SHA1cf4a2b13f4242ca59e84fd44e2b3e2e319573d41
SHA256e8fcdefd6402611303b94ffe0db171cbb639f29d948b4fe10737ef30f38a7e43
SHA5122b7d78ac61763dbd4f87e9fb2b0f8c9649ae83a29ac34135ce0e350e83987e5c88fd93c45fbdc226ef53e4082a9dd763ee61e42c626622b23a157a95e7bfe05e
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
783KB
MD5b215fa6f991c446219d80190abcb9525
SHA19ddce6d24bc10c90fc8da8b6fce7cfc108525f4a
SHA256f028d0e1539b47937ac3d1bd095d736b5222d4a19efbcd5a8f0896a5ead36553
SHA5124d41e5b9a835c3e2e066eb57307db94653a1bedf817cf2e78d6b861cb8293fb0becd3f97ed6c371ee82fae18a46be42af0d523b2939dc900d42b7cd398f72843
-
Filesize
783KB
MD5b215fa6f991c446219d80190abcb9525
SHA19ddce6d24bc10c90fc8da8b6fce7cfc108525f4a
SHA256f028d0e1539b47937ac3d1bd095d736b5222d4a19efbcd5a8f0896a5ead36553
SHA5124d41e5b9a835c3e2e066eb57307db94653a1bedf817cf2e78d6b861cb8293fb0becd3f97ed6c371ee82fae18a46be42af0d523b2939dc900d42b7cd398f72843
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
600KB
MD510ef65eafbfd69fb8dd1fb3c20dd95f5
SHA157122ff1039e9630bda55044e67e7bb7c7122d47
SHA25622b84edc4d4bc1884333453c5f2c7c07e539dd72e1216e6f77c9f16b5688ef61
SHA512c8d73367d32e5fe28345e4d843bb6aea3c952ac241e2fd1856740ebfc78396d9cfdd098881c4fc7a09b6b4126090184bf1536c6132e0e3e95b3d0d13fa300e99
-
Filesize
600KB
MD510ef65eafbfd69fb8dd1fb3c20dd95f5
SHA157122ff1039e9630bda55044e67e7bb7c7122d47
SHA25622b84edc4d4bc1884333453c5f2c7c07e539dd72e1216e6f77c9f16b5688ef61
SHA512c8d73367d32e5fe28345e4d843bb6aea3c952ac241e2fd1856740ebfc78396d9cfdd098881c4fc7a09b6b4126090184bf1536c6132e0e3e95b3d0d13fa300e99
-
Filesize
380KB
MD5832d49b976c89bf909f4a830a5ad3fd1
SHA181778b991e4a888494a8d424543f5a152afebcc6
SHA2562041c9d71390960557dfe37c5ac3742c3f9592882d9e32e1193e0b941c0661d3
SHA5124d7e4993cea9b61a6e06b7fb11689f37d5f1d2f1c1e514c9d9bd39467eb156129bb323fe562ace5370e49f48980b5260b36a79e29d1204a0fb13f4e9521bfb89
-
Filesize
380KB
MD5832d49b976c89bf909f4a830a5ad3fd1
SHA181778b991e4a888494a8d424543f5a152afebcc6
SHA2562041c9d71390960557dfe37c5ac3742c3f9592882d9e32e1193e0b941c0661d3
SHA5124d7e4993cea9b61a6e06b7fb11689f37d5f1d2f1c1e514c9d9bd39467eb156129bb323fe562ace5370e49f48980b5260b36a79e29d1204a0fb13f4e9521bfb89
-
Filesize
338KB
MD50e42f78696614919eb6da42008669094
SHA14e58231be5bcb55cdd57d64ded551c03be2f2b3e
SHA256a6f63fbadc3503dc2af5eb59272ada9544101444f8d4986ce19d87786e9f4f15
SHA512f12a1889243db10245ddfd0180ebd55a4bd9e790fd5b8874239ddb06337b76927dc3402d91f27db22da47f10e4efd7e511e0b608376219392843915900a99cfa
-
Filesize
338KB
MD50e42f78696614919eb6da42008669094
SHA14e58231be5bcb55cdd57d64ded551c03be2f2b3e
SHA256a6f63fbadc3503dc2af5eb59272ada9544101444f8d4986ce19d87786e9f4f15
SHA512f12a1889243db10245ddfd0180ebd55a4bd9e790fd5b8874239ddb06337b76927dc3402d91f27db22da47f10e4efd7e511e0b608376219392843915900a99cfa
-
Filesize
217KB
MD56c7f19a304773bf9d8aea8f48b9c93f6
SHA13afd5ec6d4c5489c65eaf7e84c077beba3983ce6
SHA256889f7fee7b958acdf6867ccef301f0ef0cbaf35422515b75073b4709af404de9
SHA5129cd8d8dc34b0688d8c10f7462c87925f175a4b369fa8671c68d9c47478a52fdeaabfdecbd1d97421750023f8f715f4da0e07a8c715b0b1e10f7d5fd22ba3ee01
-
Filesize
217KB
MD56c7f19a304773bf9d8aea8f48b9c93f6
SHA13afd5ec6d4c5489c65eaf7e84c077beba3983ce6
SHA256889f7fee7b958acdf6867ccef301f0ef0cbaf35422515b75073b4709af404de9
SHA5129cd8d8dc34b0688d8c10f7462c87925f175a4b369fa8671c68d9c47478a52fdeaabfdecbd1d97421750023f8f715f4da0e07a8c715b0b1e10f7d5fd22ba3ee01
-
Filesize
346KB
MD5f5545d39f46cdd014745743ee088b960
SHA1a77587f4b84ebeabc1081d08d3bfce15b52fa475
SHA2560dbee5379d6cb7d59f3881e2608c75503003efaf6203b355da765b30cd792497
SHA5121867caf3076ca3eb5c5c4703db9ed0ebf5112926b971cf86535363ce13c88a16d0bef09bb3820ff11f6a5f6f1fdc1512affb2da3a6e7cbd81692ce4d5964335b
-
Filesize
346KB
MD5f5545d39f46cdd014745743ee088b960
SHA1a77587f4b84ebeabc1081d08d3bfce15b52fa475
SHA2560dbee5379d6cb7d59f3881e2608c75503003efaf6203b355da765b30cd792497
SHA5121867caf3076ca3eb5c5c4703db9ed0ebf5112926b971cf86535363ce13c88a16d0bef09bb3820ff11f6a5f6f1fdc1512affb2da3a6e7cbd81692ce4d5964335b
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a