Analysis
-
max time kernel
154s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:57
Static task
static1
Behavioral task
behavioral1
Sample
cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe
Resource
win7-20230831-en
General
-
Target
cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe
-
Size
1.3MB
-
MD5
b2e1f1bd23cd1f68d6da95e5682d459e
-
SHA1
74bfa943a8925fdf078b2d1b57b48cc909ae3837
-
SHA256
cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce
-
SHA512
c7b95c533ac186ecfa37aa508a1dc1dd909c5d2d96e50e6cfdcbcdc51775e7c8acdaff2935673b34195c512ba7778f32e510de523c828f788c37ea8ce76a11cf
-
SSDEEP
24576:3yIHNXn8re9wAY8p69P6PlJHLaqeCcCGQ9rqqZOaByM5VXvA0leNk7T:CO98y9JY8pDJca9r7ZL5xvA0l2k7
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3556-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3556-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3556-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3556-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2380-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
u5494280.exelegota.exet1771372.exeexplonde.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation u5494280.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation t1771372.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation explonde.exe -
Executes dropped EXE 14 IoCs
Processes:
z1905635.exez7736370.exez0107694.exez9990717.exeq6454909.exer5585753.exes0276955.exet1771372.exeexplonde.exeu5494280.exelegota.exew4692943.exeexplonde.exelegota.exepid process 4512 z1905635.exe 4840 z7736370.exe 1052 z0107694.exe 2268 z9990717.exe 4008 q6454909.exe 4144 r5585753.exe 2768 s0276955.exe 3552 t1771372.exe 1816 explonde.exe 4128 u5494280.exe 1524 legota.exe 4744 w4692943.exe 1196 explonde.exe 3320 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3980 rundll32.exe 3996 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exez1905635.exez7736370.exez0107694.exez9990717.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1905635.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7736370.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z0107694.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z9990717.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q6454909.exer5585753.exes0276955.exedescription pid process target process PID 4008 set thread context of 2380 4008 q6454909.exe AppLaunch.exe PID 4144 set thread context of 3556 4144 r5585753.exe AppLaunch.exe PID 2768 set thread context of 4444 2768 s0276955.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1676 4008 WerFault.exe q6454909.exe 3616 4144 WerFault.exe r5585753.exe 3620 3556 WerFault.exe AppLaunch.exe 4868 2768 WerFault.exe s0276955.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3672 schtasks.exe 4280 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2380 AppLaunch.exe 2380 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2380 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exez1905635.exez7736370.exez0107694.exez9990717.exeq6454909.exer5585753.exes0276955.exet1771372.exeexplonde.exeu5494280.exelegota.exedescription pid process target process PID 4712 wrote to memory of 4512 4712 cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe z1905635.exe PID 4712 wrote to memory of 4512 4712 cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe z1905635.exe PID 4712 wrote to memory of 4512 4712 cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe z1905635.exe PID 4512 wrote to memory of 4840 4512 z1905635.exe z7736370.exe PID 4512 wrote to memory of 4840 4512 z1905635.exe z7736370.exe PID 4512 wrote to memory of 4840 4512 z1905635.exe z7736370.exe PID 4840 wrote to memory of 1052 4840 z7736370.exe z0107694.exe PID 4840 wrote to memory of 1052 4840 z7736370.exe z0107694.exe PID 4840 wrote to memory of 1052 4840 z7736370.exe z0107694.exe PID 1052 wrote to memory of 2268 1052 z0107694.exe z9990717.exe PID 1052 wrote to memory of 2268 1052 z0107694.exe z9990717.exe PID 1052 wrote to memory of 2268 1052 z0107694.exe z9990717.exe PID 2268 wrote to memory of 4008 2268 z9990717.exe q6454909.exe PID 2268 wrote to memory of 4008 2268 z9990717.exe q6454909.exe PID 2268 wrote to memory of 4008 2268 z9990717.exe q6454909.exe PID 4008 wrote to memory of 2380 4008 q6454909.exe AppLaunch.exe PID 4008 wrote to memory of 2380 4008 q6454909.exe AppLaunch.exe PID 4008 wrote to memory of 2380 4008 q6454909.exe AppLaunch.exe PID 4008 wrote to memory of 2380 4008 q6454909.exe AppLaunch.exe PID 4008 wrote to memory of 2380 4008 q6454909.exe AppLaunch.exe PID 4008 wrote to memory of 2380 4008 q6454909.exe AppLaunch.exe PID 4008 wrote to memory of 2380 4008 q6454909.exe AppLaunch.exe PID 4008 wrote to memory of 2380 4008 q6454909.exe AppLaunch.exe PID 2268 wrote to memory of 4144 2268 z9990717.exe r5585753.exe PID 2268 wrote to memory of 4144 2268 z9990717.exe r5585753.exe PID 2268 wrote to memory of 4144 2268 z9990717.exe r5585753.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 4144 wrote to memory of 3556 4144 r5585753.exe AppLaunch.exe PID 1052 wrote to memory of 2768 1052 z0107694.exe s0276955.exe PID 1052 wrote to memory of 2768 1052 z0107694.exe s0276955.exe PID 1052 wrote to memory of 2768 1052 z0107694.exe s0276955.exe PID 2768 wrote to memory of 4444 2768 s0276955.exe AppLaunch.exe PID 2768 wrote to memory of 4444 2768 s0276955.exe AppLaunch.exe PID 2768 wrote to memory of 4444 2768 s0276955.exe AppLaunch.exe PID 2768 wrote to memory of 4444 2768 s0276955.exe AppLaunch.exe PID 2768 wrote to memory of 4444 2768 s0276955.exe AppLaunch.exe PID 2768 wrote to memory of 4444 2768 s0276955.exe AppLaunch.exe PID 2768 wrote to memory of 4444 2768 s0276955.exe AppLaunch.exe PID 2768 wrote to memory of 4444 2768 s0276955.exe AppLaunch.exe PID 4840 wrote to memory of 3552 4840 z7736370.exe t1771372.exe PID 4840 wrote to memory of 3552 4840 z7736370.exe t1771372.exe PID 4840 wrote to memory of 3552 4840 z7736370.exe t1771372.exe PID 3552 wrote to memory of 1816 3552 t1771372.exe explonde.exe PID 3552 wrote to memory of 1816 3552 t1771372.exe explonde.exe PID 3552 wrote to memory of 1816 3552 t1771372.exe explonde.exe PID 4512 wrote to memory of 4128 4512 z1905635.exe u5494280.exe PID 4512 wrote to memory of 4128 4512 z1905635.exe u5494280.exe PID 4512 wrote to memory of 4128 4512 z1905635.exe u5494280.exe PID 1816 wrote to memory of 3672 1816 explonde.exe schtasks.exe PID 1816 wrote to memory of 3672 1816 explonde.exe schtasks.exe PID 1816 wrote to memory of 3672 1816 explonde.exe schtasks.exe PID 4128 wrote to memory of 1524 4128 u5494280.exe legota.exe PID 4128 wrote to memory of 1524 4128 u5494280.exe legota.exe PID 4128 wrote to memory of 1524 4128 u5494280.exe legota.exe PID 1524 wrote to memory of 4280 1524 legota.exe schtasks.exe PID 1524 wrote to memory of 4280 1524 legota.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe"C:\Users\Admin\AppData\Local\Temp\cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1407⤵
- Program crash
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5585753.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5585753.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 5408⤵
- Program crash
PID:3620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 5927⤵
- Program crash
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0276955.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0276955.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:4444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 1526⤵
- Program crash
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1771372.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1771372.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
PID:3672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:3724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2296
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵PID:716
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵PID:3736
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:4904
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:3936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1672
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5494280.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5494280.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:4280 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:5052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2668
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:4720
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:1600
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:3804
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:4264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:5016
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4692943.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4692943.exe2⤵
- Executes dropped EXE
PID:4744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4008 -ip 40081⤵PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4144 -ip 41441⤵PID:4708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3556 -ip 35561⤵PID:2680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2768 -ip 27681⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:1196
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:3320
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4692943.exeFilesize
22KB
MD586b719323ea66779e8e1ad2e89051c56
SHA1b716bcd6ececf501a2979a12eaf3b18409441ad7
SHA25679b2218d2db081f7931b87504905e7776649ded57b80d52c3ba547573ef1b250
SHA512b025244e9879d8d4dae210712dfb84615401e0b21c0a3ab07d381700c736d9fb73c132dab78fd9e10d73313eb0228eccb78196d48fe7f84574a7eac246be94a6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4692943.exeFilesize
22KB
MD586b719323ea66779e8e1ad2e89051c56
SHA1b716bcd6ececf501a2979a12eaf3b18409441ad7
SHA25679b2218d2db081f7931b87504905e7776649ded57b80d52c3ba547573ef1b250
SHA512b025244e9879d8d4dae210712dfb84615401e0b21c0a3ab07d381700c736d9fb73c132dab78fd9e10d73313eb0228eccb78196d48fe7f84574a7eac246be94a6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exeFilesize
1.2MB
MD5b199acaa8b22647f7b729661f94b58d9
SHA1d27a58335e8aee061f60f8c5e31804e1a080efb5
SHA256f5668e26afdc9e4c092ad0300ae695b1427cccd896d7aa93936e52b2b54cb357
SHA512e7b07bbc489f62e93d7209e3ad6eec282f255dde3abcd623d0778041b5f9e16bc7d57ce9c12ccf153cc3f15924e9d9c79cbc95e2d275a677db950d523a4b2a79
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exeFilesize
1.2MB
MD5b199acaa8b22647f7b729661f94b58d9
SHA1d27a58335e8aee061f60f8c5e31804e1a080efb5
SHA256f5668e26afdc9e4c092ad0300ae695b1427cccd896d7aa93936e52b2b54cb357
SHA512e7b07bbc489f62e93d7209e3ad6eec282f255dde3abcd623d0778041b5f9e16bc7d57ce9c12ccf153cc3f15924e9d9c79cbc95e2d275a677db950d523a4b2a79
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5494280.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5494280.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exeFilesize
1.0MB
MD5627b3d44cad6ab301149c6e6bbd06c81
SHA1ac7d684ddc10c2f3039068b18f0c7036c445d7f4
SHA2560eed858c5793d246e2db45b06c749164dbbf349d9d42b7d828b8f59ec19e1ee6
SHA51262ab2bc3b37d74ee23fb24800493acc600505754abd3b0b53d2c3865bb6c92dd63e4479a7923957736a7b8850af9e08f3912f7ab8058f97ceaad529d3ee71bcc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exeFilesize
1.0MB
MD5627b3d44cad6ab301149c6e6bbd06c81
SHA1ac7d684ddc10c2f3039068b18f0c7036c445d7f4
SHA2560eed858c5793d246e2db45b06c749164dbbf349d9d42b7d828b8f59ec19e1ee6
SHA51262ab2bc3b37d74ee23fb24800493acc600505754abd3b0b53d2c3865bb6c92dd63e4479a7923957736a7b8850af9e08f3912f7ab8058f97ceaad529d3ee71bcc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1771372.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1771372.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exeFilesize
887KB
MD5081974903672b949fd1c6a9dd217c9ef
SHA1919b221d95be7c89edf4f281cc2b4d903ffae076
SHA2567cd01f63b72173aed81a7155909f7c304fef2d81ffe07ee5f2d476f46285e0ce
SHA5124a87df9aa33708d7e2df2ff3b91730df42c7f92d306ab1110c5a4cab25091728d443871745df08a4cee2116140a953ba45fa12abdb4f6d405d1b3fd463ce2d06
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exeFilesize
887KB
MD5081974903672b949fd1c6a9dd217c9ef
SHA1919b221d95be7c89edf4f281cc2b4d903ffae076
SHA2567cd01f63b72173aed81a7155909f7c304fef2d81ffe07ee5f2d476f46285e0ce
SHA5124a87df9aa33708d7e2df2ff3b91730df42c7f92d306ab1110c5a4cab25091728d443871745df08a4cee2116140a953ba45fa12abdb4f6d405d1b3fd463ce2d06
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0276955.exeFilesize
1.0MB
MD53f11d40e7b7a8d8eac55343b9e69cc94
SHA189ccda560a9d3bd0b6b5a569c5886bc2175089cd
SHA2568290e98703120698025f379bedb2c5ab1ad3c7a8286b50e946d14f39f8627b6b
SHA512441c3eea152c14bd6707d5bb7c9b15bf963539b53fea142c61a67d38353b5cc7705288a64ed84ec3389a302978d0fd7dce4fde695cc48bea24bc32e9a5e8fbfe
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0276955.exeFilesize
1.0MB
MD53f11d40e7b7a8d8eac55343b9e69cc94
SHA189ccda560a9d3bd0b6b5a569c5886bc2175089cd
SHA2568290e98703120698025f379bedb2c5ab1ad3c7a8286b50e946d14f39f8627b6b
SHA512441c3eea152c14bd6707d5bb7c9b15bf963539b53fea142c61a67d38353b5cc7705288a64ed84ec3389a302978d0fd7dce4fde695cc48bea24bc32e9a5e8fbfe
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exeFilesize
496KB
MD560bf505062532bdcfad818a2d720154e
SHA175d8ce12af0f92cf4fce354d8a2ff432f6a01ff3
SHA256a1325db89cce6fa9e047538c748b32035a0238ca2ea380131cc1f1b06940f189
SHA5126609a0313e4226f0f005f104c1c34051afdf91b7e41fcba440ebf8dc562c0f635e17d322cea3695ffbc8580f222ec260f3762444b8a988f5e04a117817837859
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exeFilesize
496KB
MD560bf505062532bdcfad818a2d720154e
SHA175d8ce12af0f92cf4fce354d8a2ff432f6a01ff3
SHA256a1325db89cce6fa9e047538c748b32035a0238ca2ea380131cc1f1b06940f189
SHA5126609a0313e4226f0f005f104c1c34051afdf91b7e41fcba440ebf8dc562c0f635e17d322cea3695ffbc8580f222ec260f3762444b8a988f5e04a117817837859
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exeFilesize
860KB
MD59c368883f6dc1449981a858d914954bb
SHA13f385129151520af6f6edaacfc3795547a9eb045
SHA25609f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66
SHA512208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exeFilesize
860KB
MD59c368883f6dc1449981a858d914954bb
SHA13f385129151520af6f6edaacfc3795547a9eb045
SHA25609f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66
SHA512208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5585753.exeFilesize
1016KB
MD54523ceb8e7d703d1e8a82d0bb4a11a7d
SHA1b30bac0f987ba8d2b93dceff029e919316923afd
SHA256a07fbc888f48f281ed1e2692448d63b0c24b5710070304e081e078aa136a6967
SHA5122000fa31bf675b66321f456954e0aa588e6bffd7c5742a365d9bd2e6296d2184597a0fa760af41b9b9c833ad44ee111992c170c23e0b3c5d61ba30debbdef91a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5585753.exeFilesize
1016KB
MD54523ceb8e7d703d1e8a82d0bb4a11a7d
SHA1b30bac0f987ba8d2b93dceff029e919316923afd
SHA256a07fbc888f48f281ed1e2692448d63b0c24b5710070304e081e078aa136a6967
SHA5122000fa31bf675b66321f456954e0aa588e6bffd7c5742a365d9bd2e6296d2184597a0fa760af41b9b9c833ad44ee111992c170c23e0b3c5d61ba30debbdef91a
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2380-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2380-36-0x0000000073E70000-0x0000000074620000-memory.dmpFilesize
7.7MB
-
memory/2380-37-0x0000000073E70000-0x0000000074620000-memory.dmpFilesize
7.7MB
-
memory/2380-39-0x0000000073E70000-0x0000000074620000-memory.dmpFilesize
7.7MB
-
memory/3556-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3556-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3556-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3556-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4444-65-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/4444-69-0x0000000005060000-0x000000000509C000-memory.dmpFilesize
240KB
-
memory/4444-67-0x000000000A630000-0x000000000A642000-memory.dmpFilesize
72KB
-
memory/4444-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4444-64-0x000000000A700000-0x000000000A80A000-memory.dmpFilesize
1.0MB
-
memory/4444-62-0x000000000AC00000-0x000000000B218000-memory.dmpFilesize
6.1MB
-
memory/4444-60-0x0000000073CC0000-0x0000000074470000-memory.dmpFilesize
7.7MB
-
memory/4444-89-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/4444-70-0x00000000050E0000-0x000000000512C000-memory.dmpFilesize
304KB
-
memory/4444-54-0x0000000002A40000-0x0000000002A46000-memory.dmpFilesize
24KB
-
memory/4444-53-0x0000000073CC0000-0x0000000074470000-memory.dmpFilesize
7.7MB