Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:55
Static task
static1
Behavioral task
behavioral1
Sample
af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exe
Resource
win7-20230831-en
General
-
Target
af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exe
-
Size
1.3MB
-
MD5
8650fbb431bbb8fd9722647c9d99b3fd
-
SHA1
3764ab87d15242cffa1b2a041b5c3f2d97680470
-
SHA256
af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01
-
SHA512
6d060ebc27843644ae53e9cc6d85e171fc36b173d778eb2828f5fd6f5b77346241c3592dc8a396ce5a0c32e79f35215be604176d1a6615f93f024cde8d505a60
-
SSDEEP
24576:5yF7EPaNTTkxvS0HwX7Mmmxgm9cC8TCsaIDWnc37Rb8Ilcva5Ag9rtmbb:sFwPaoS+wLzmCmK731Imcva7vmb
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4460-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4460-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4460-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4460-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3764-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet5702343.exeexplonde.exeu5262012.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t5702343.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u5262012.exe -
Executes dropped EXE 16 IoCs
Processes:
z0303155.exez6688640.exez8491160.exez8058700.exeq5471207.exer5303337.exes8682188.exet5702343.exeexplonde.exeu5262012.exelegota.exew3276343.exelegota.exeexplonde.exelegota.exeexplonde.exepid process 2632 z0303155.exe 4384 z6688640.exe 2544 z8491160.exe 3456 z8058700.exe 2276 q5471207.exe 2540 r5303337.exe 740 s8682188.exe 3632 t5702343.exe 3784 explonde.exe 744 u5262012.exe 3780 legota.exe 3952 w3276343.exe 4452 legota.exe 640 explonde.exe 4316 legota.exe 4704 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2724 rundll32.exe 1684 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exez0303155.exez6688640.exez8491160.exez8058700.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z0303155.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z6688640.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z8491160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z8058700.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q5471207.exer5303337.exes8682188.exedescription pid process target process PID 2276 set thread context of 3764 2276 q5471207.exe AppLaunch.exe PID 2540 set thread context of 4460 2540 r5303337.exe AppLaunch.exe PID 740 set thread context of 4152 740 s8682188.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3560 2276 WerFault.exe q5471207.exe 4952 2540 WerFault.exe r5303337.exe 4872 4460 WerFault.exe AppLaunch.exe 3476 740 WerFault.exe s8682188.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4060 schtasks.exe 2020 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3764 AppLaunch.exe 3764 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3764 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exez0303155.exez6688640.exez8491160.exez8058700.exeq5471207.exer5303337.exes8682188.exet5702343.exeexplonde.exedescription pid process target process PID 2784 wrote to memory of 2632 2784 af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exe z0303155.exe PID 2784 wrote to memory of 2632 2784 af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exe z0303155.exe PID 2784 wrote to memory of 2632 2784 af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exe z0303155.exe PID 2632 wrote to memory of 4384 2632 z0303155.exe z6688640.exe PID 2632 wrote to memory of 4384 2632 z0303155.exe z6688640.exe PID 2632 wrote to memory of 4384 2632 z0303155.exe z6688640.exe PID 4384 wrote to memory of 2544 4384 z6688640.exe z8491160.exe PID 4384 wrote to memory of 2544 4384 z6688640.exe z8491160.exe PID 4384 wrote to memory of 2544 4384 z6688640.exe z8491160.exe PID 2544 wrote to memory of 3456 2544 z8491160.exe z8058700.exe PID 2544 wrote to memory of 3456 2544 z8491160.exe z8058700.exe PID 2544 wrote to memory of 3456 2544 z8491160.exe z8058700.exe PID 3456 wrote to memory of 2276 3456 z8058700.exe q5471207.exe PID 3456 wrote to memory of 2276 3456 z8058700.exe q5471207.exe PID 3456 wrote to memory of 2276 3456 z8058700.exe q5471207.exe PID 2276 wrote to memory of 3764 2276 q5471207.exe AppLaunch.exe PID 2276 wrote to memory of 3764 2276 q5471207.exe AppLaunch.exe PID 2276 wrote to memory of 3764 2276 q5471207.exe AppLaunch.exe PID 2276 wrote to memory of 3764 2276 q5471207.exe AppLaunch.exe PID 2276 wrote to memory of 3764 2276 q5471207.exe AppLaunch.exe PID 2276 wrote to memory of 3764 2276 q5471207.exe AppLaunch.exe PID 2276 wrote to memory of 3764 2276 q5471207.exe AppLaunch.exe PID 2276 wrote to memory of 3764 2276 q5471207.exe AppLaunch.exe PID 3456 wrote to memory of 2540 3456 z8058700.exe r5303337.exe PID 3456 wrote to memory of 2540 3456 z8058700.exe r5303337.exe PID 3456 wrote to memory of 2540 3456 z8058700.exe r5303337.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2540 wrote to memory of 4460 2540 r5303337.exe AppLaunch.exe PID 2544 wrote to memory of 740 2544 z8491160.exe s8682188.exe PID 2544 wrote to memory of 740 2544 z8491160.exe s8682188.exe PID 2544 wrote to memory of 740 2544 z8491160.exe s8682188.exe PID 740 wrote to memory of 3684 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 3684 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 3684 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 4152 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 4152 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 4152 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 4152 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 4152 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 4152 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 4152 740 s8682188.exe AppLaunch.exe PID 740 wrote to memory of 4152 740 s8682188.exe AppLaunch.exe PID 4384 wrote to memory of 3632 4384 z6688640.exe t5702343.exe PID 4384 wrote to memory of 3632 4384 z6688640.exe t5702343.exe PID 4384 wrote to memory of 3632 4384 z6688640.exe t5702343.exe PID 3632 wrote to memory of 3784 3632 t5702343.exe explonde.exe PID 3632 wrote to memory of 3784 3632 t5702343.exe explonde.exe PID 3632 wrote to memory of 3784 3632 t5702343.exe explonde.exe PID 2632 wrote to memory of 744 2632 z0303155.exe u5262012.exe PID 2632 wrote to memory of 744 2632 z0303155.exe u5262012.exe PID 2632 wrote to memory of 744 2632 z0303155.exe u5262012.exe PID 3784 wrote to memory of 4060 3784 explonde.exe schtasks.exe PID 3784 wrote to memory of 4060 3784 explonde.exe schtasks.exe PID 3784 wrote to memory of 4060 3784 explonde.exe schtasks.exe PID 3784 wrote to memory of 464 3784 explonde.exe cmd.exe PID 3784 wrote to memory of 464 3784 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exe"C:\Users\Admin\AppData\Local\Temp\af7bf95cea03dc9300228b678fcd178c8a0a84bc9d761149cfcb254d8606dd01.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0303155.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0303155.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6688640.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6688640.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8491160.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8491160.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8058700.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8058700.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5471207.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5471207.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1527⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5303337.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5303337.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8682188.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8682188.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1566⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5702343.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5702343.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5262012.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5262012.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3276343.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3276343.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2276 -ip 22761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2540 -ip 25401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4460 -ip 44601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 740 -ip 7401⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3276343.exeFilesize
22KB
MD556276666b3863fe94fc7f343e1da4aa3
SHA1d4c3ab0ddd017c349d3ad6d181d968d4b0b59cf0
SHA256330d3464524337c47ed580206a0967be592bc01d9c37da8185ed780a364aaebb
SHA5125763bc5243c774192cbd59cfc4a97293a8285d91a9bf2de971277c969c9ca1cbfab6ef4678f7fcade171d25a064a1685eca1386193c1ccb9b2ff69a9f71d2e26
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3276343.exeFilesize
22KB
MD556276666b3863fe94fc7f343e1da4aa3
SHA1d4c3ab0ddd017c349d3ad6d181d968d4b0b59cf0
SHA256330d3464524337c47ed580206a0967be592bc01d9c37da8185ed780a364aaebb
SHA5125763bc5243c774192cbd59cfc4a97293a8285d91a9bf2de971277c969c9ca1cbfab6ef4678f7fcade171d25a064a1685eca1386193c1ccb9b2ff69a9f71d2e26
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0303155.exeFilesize
1.2MB
MD5a6e47e90dc096145769ba8399fb1ed52
SHA15edfdabc9f7368c4e7873ba245b6d44ea42ced35
SHA256c93842a85f5258f5e4d986f8d3ced2245376092a1014ef6c3611c9309a781f5b
SHA5120c08a2b18d9c33ecb42900302d5eabc68076ceb55a0c8529ccf54c7e7b745e57220ca8c57283b8759a039c8397505c2234fa7ce201003c49e76a198909b02a6b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0303155.exeFilesize
1.2MB
MD5a6e47e90dc096145769ba8399fb1ed52
SHA15edfdabc9f7368c4e7873ba245b6d44ea42ced35
SHA256c93842a85f5258f5e4d986f8d3ced2245376092a1014ef6c3611c9309a781f5b
SHA5120c08a2b18d9c33ecb42900302d5eabc68076ceb55a0c8529ccf54c7e7b745e57220ca8c57283b8759a039c8397505c2234fa7ce201003c49e76a198909b02a6b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5262012.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5262012.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6688640.exeFilesize
1.0MB
MD51257ada7a79873797e5e251a353d937b
SHA1802c16c2b54c4c2467ebd53ed123cb3416e32cf1
SHA256667d3ad7e83daddfbdbbcd4c1d5c5ce5c320f12a60a12abd101210ab210f4274
SHA51202fda47e7e339354db8f4d61d8f971cc82b803fde6e92e3e10dbf7cdd69012f38e8244b9fd873b85eab54dd31dda6cacaaa35ed8d1fb0e306621d8b3e1950728
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6688640.exeFilesize
1.0MB
MD51257ada7a79873797e5e251a353d937b
SHA1802c16c2b54c4c2467ebd53ed123cb3416e32cf1
SHA256667d3ad7e83daddfbdbbcd4c1d5c5ce5c320f12a60a12abd101210ab210f4274
SHA51202fda47e7e339354db8f4d61d8f971cc82b803fde6e92e3e10dbf7cdd69012f38e8244b9fd873b85eab54dd31dda6cacaaa35ed8d1fb0e306621d8b3e1950728
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5702343.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5702343.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8491160.exeFilesize
884KB
MD57298ee11c7aaea421a3512925837f60e
SHA1550213603782ce2df42c768476482e63f5b9410a
SHA25674b44460ad4242eb934def0ceb256a280a78d1d6978f85a9bfec26ee0860688f
SHA5127881c229a8c9b366a00c65c41ada16f2017728623071c7f085d36054a83aa8812d5050bb6386a70153e1e4b757d088bcaa0363d8cebe4daa715b634e8b9472ef
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8491160.exeFilesize
884KB
MD57298ee11c7aaea421a3512925837f60e
SHA1550213603782ce2df42c768476482e63f5b9410a
SHA25674b44460ad4242eb934def0ceb256a280a78d1d6978f85a9bfec26ee0860688f
SHA5127881c229a8c9b366a00c65c41ada16f2017728623071c7f085d36054a83aa8812d5050bb6386a70153e1e4b757d088bcaa0363d8cebe4daa715b634e8b9472ef
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8682188.exeFilesize
1.0MB
MD511d4f0218862b17ed9e9963d7ac82dbf
SHA1c6a87bd46758a2ec3cd5b323e601485b7cbf9e62
SHA256144abb9b5a4a4276449113b2f3bf92484061ee0081ea6adf973d33bcd0797941
SHA5125a0b6946844536ce0e64bd2b1c7f6559926d52c15ce4d4bb78d3f20ecdfae844558255299e976b64141c2ea8ba868ce71d8481ea9d00888bbc0c3041d415ef2f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8682188.exeFilesize
1.0MB
MD511d4f0218862b17ed9e9963d7ac82dbf
SHA1c6a87bd46758a2ec3cd5b323e601485b7cbf9e62
SHA256144abb9b5a4a4276449113b2f3bf92484061ee0081ea6adf973d33bcd0797941
SHA5125a0b6946844536ce0e64bd2b1c7f6559926d52c15ce4d4bb78d3f20ecdfae844558255299e976b64141c2ea8ba868ce71d8481ea9d00888bbc0c3041d415ef2f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8058700.exeFilesize
493KB
MD5d0ec410d91a940ea048d6e7cf966b867
SHA19caab8bb552f21c20ae4063bdda584722fbbdbac
SHA256aa94cf37206c5b27db7c1bf06e88e52b72a3853cfa5de99c050132052a840977
SHA5126aa9dcc89b20914afcae63b72a4bf532163af5818e8b834ef6ad5ff17c3ccad724f13a0a50925a0d07a231628698a45157e5d41af3f5196e461dc89e1d7486d1
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8058700.exeFilesize
493KB
MD5d0ec410d91a940ea048d6e7cf966b867
SHA19caab8bb552f21c20ae4063bdda584722fbbdbac
SHA256aa94cf37206c5b27db7c1bf06e88e52b72a3853cfa5de99c050132052a840977
SHA5126aa9dcc89b20914afcae63b72a4bf532163af5818e8b834ef6ad5ff17c3ccad724f13a0a50925a0d07a231628698a45157e5d41af3f5196e461dc89e1d7486d1
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5471207.exeFilesize
860KB
MD58b5342b55da36612e0ff9071e8e02c0d
SHA19318152e8c0a4eda188c97500ade7d8bbc8f19f8
SHA256c36be42bf88b2dfd7835dd8e8b2a2b1217a035959d123cd00b97b1c14b2c4cba
SHA512738af5b4eb475e78a4b564f214cf743822cfde3309ecdff78a71bffebe560b4da3c91f66645e6a6072e3ad09d5db23a744ef368fbd4c03d8c983371fea678c67
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5471207.exeFilesize
860KB
MD58b5342b55da36612e0ff9071e8e02c0d
SHA19318152e8c0a4eda188c97500ade7d8bbc8f19f8
SHA256c36be42bf88b2dfd7835dd8e8b2a2b1217a035959d123cd00b97b1c14b2c4cba
SHA512738af5b4eb475e78a4b564f214cf743822cfde3309ecdff78a71bffebe560b4da3c91f66645e6a6072e3ad09d5db23a744ef368fbd4c03d8c983371fea678c67
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5303337.exeFilesize
1016KB
MD5ee6b1cc519dcab8707feca149b96e793
SHA1f54736d5f19fc66532545d982818cdb9efdfcb27
SHA25646590916cde037ba9e9f15b839d0ede63a4394c89fdf3107987b5a6824fd4bc8
SHA512f30827b80d0ec0052093498ded61c3fb29d1fdd000fab085241892eeb43817278f488e29052265ca4e3a6e64b842964a361d3675f5811b8d3fc4586353250e14
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5303337.exeFilesize
1016KB
MD5ee6b1cc519dcab8707feca149b96e793
SHA1f54736d5f19fc66532545d982818cdb9efdfcb27
SHA25646590916cde037ba9e9f15b839d0ede63a4394c89fdf3107987b5a6824fd4bc8
SHA512f30827b80d0ec0052093498ded61c3fb29d1fdd000fab085241892eeb43817278f488e29052265ca4e3a6e64b842964a361d3675f5811b8d3fc4586353250e14
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/3764-86-0x0000000073FC0000-0x0000000074770000-memory.dmpFilesize
7.7MB
-
memory/3764-36-0x0000000073FC0000-0x0000000074770000-memory.dmpFilesize
7.7MB
-
memory/3764-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3764-84-0x0000000073FC0000-0x0000000074770000-memory.dmpFilesize
7.7MB
-
memory/4152-63-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/4152-87-0x0000000073FC0000-0x0000000074770000-memory.dmpFilesize
7.7MB
-
memory/4152-88-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/4152-73-0x0000000005250000-0x000000000529C000-memory.dmpFilesize
304KB
-
memory/4152-64-0x0000000005210000-0x000000000524C000-memory.dmpFilesize
240KB
-
memory/4152-62-0x0000000005190000-0x00000000051A2000-memory.dmpFilesize
72KB
-
memory/4152-58-0x00000000052E0000-0x00000000053EA000-memory.dmpFilesize
1.0MB
-
memory/4152-56-0x00000000057F0000-0x0000000005E08000-memory.dmpFilesize
6.1MB
-
memory/4152-50-0x0000000002AB0000-0x0000000002AB6000-memory.dmpFilesize
24KB
-
memory/4152-49-0x0000000073FC0000-0x0000000074770000-memory.dmpFilesize
7.7MB
-
memory/4152-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4460-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4460-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4460-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4460-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB