Analysis
-
max time kernel
161s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 08:22
Static task
static1
Behavioral task
behavioral1
Sample
d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exe
Resource
win7-20230831-en
General
-
Target
d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exe
-
Size
1.3MB
-
MD5
cb7883a163e68bdf5522d399d04ea789
-
SHA1
3435fa2734d619f52c3287df8d07953de13984f4
-
SHA256
d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989
-
SHA512
7ffcdc27b85960514a4fc2dba6e8a03a4f43ef222fedbc7cc95a778d2137a70589ca3fc40985be06fe6201130920a2e79b6ace84dc32f3539dd80c54c1b8da2f
-
SSDEEP
24576:0yhQwMdf3mraLaNZBng3AG2N9/Yk7K/s8RQccjBaL/TrQeXXu4t36scX:DOwmfaNm2NGk7S1xeBaDXVusKs
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3640-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3640-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3640-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3640-47-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2608-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t6329120.exeexplonde.exeu2540807.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation t6329120.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation u2540807.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 14 IoCs
Processes:
z3611277.exez8270642.exez7734092.exez7567906.exeq9246195.exer4801935.exes0769285.exet6329120.exeexplonde.exeu2540807.exelegota.exew3684532.exeexplonde.exelegota.exepid process 5024 z3611277.exe 2140 z8270642.exe 4232 z7734092.exe 4948 z7567906.exe 3752 q9246195.exe 3352 r4801935.exe 4500 s0769285.exe 3412 t6329120.exe 2812 explonde.exe 3756 u2540807.exe 2884 legota.exe 4180 w3684532.exe 3420 explonde.exe 2912 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 992 rundll32.exe 1976 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exez3611277.exez8270642.exez7734092.exez7567906.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3611277.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z8270642.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z7734092.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z7567906.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q9246195.exer4801935.exes0769285.exedescription pid process target process PID 3752 set thread context of 2608 3752 q9246195.exe AppLaunch.exe PID 3352 set thread context of 3640 3352 r4801935.exe AppLaunch.exe PID 4500 set thread context of 4908 4500 s0769285.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3328 3752 WerFault.exe q9246195.exe 4732 3352 WerFault.exe r4801935.exe 2116 3640 WerFault.exe AppLaunch.exe 1540 4500 WerFault.exe s0769285.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2368 schtasks.exe 4860 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2608 AppLaunch.exe 2608 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2608 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exez3611277.exez8270642.exez7734092.exez7567906.exeq9246195.exer4801935.exes0769285.exet6329120.exeexplonde.exedescription pid process target process PID 4576 wrote to memory of 5024 4576 d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exe z3611277.exe PID 4576 wrote to memory of 5024 4576 d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exe z3611277.exe PID 4576 wrote to memory of 5024 4576 d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exe z3611277.exe PID 5024 wrote to memory of 2140 5024 z3611277.exe z8270642.exe PID 5024 wrote to memory of 2140 5024 z3611277.exe z8270642.exe PID 5024 wrote to memory of 2140 5024 z3611277.exe z8270642.exe PID 2140 wrote to memory of 4232 2140 z8270642.exe z7734092.exe PID 2140 wrote to memory of 4232 2140 z8270642.exe z7734092.exe PID 2140 wrote to memory of 4232 2140 z8270642.exe z7734092.exe PID 4232 wrote to memory of 4948 4232 z7734092.exe z7567906.exe PID 4232 wrote to memory of 4948 4232 z7734092.exe z7567906.exe PID 4232 wrote to memory of 4948 4232 z7734092.exe z7567906.exe PID 4948 wrote to memory of 3752 4948 z7567906.exe q9246195.exe PID 4948 wrote to memory of 3752 4948 z7567906.exe q9246195.exe PID 4948 wrote to memory of 3752 4948 z7567906.exe q9246195.exe PID 3752 wrote to memory of 4268 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 4268 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 4268 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 2608 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 2608 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 2608 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 2608 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 2608 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 2608 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 2608 3752 q9246195.exe AppLaunch.exe PID 3752 wrote to memory of 2608 3752 q9246195.exe AppLaunch.exe PID 4948 wrote to memory of 3352 4948 z7567906.exe r4801935.exe PID 4948 wrote to memory of 3352 4948 z7567906.exe r4801935.exe PID 4948 wrote to memory of 3352 4948 z7567906.exe r4801935.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 3352 wrote to memory of 3640 3352 r4801935.exe AppLaunch.exe PID 4232 wrote to memory of 4500 4232 z7734092.exe s0769285.exe PID 4232 wrote to memory of 4500 4232 z7734092.exe s0769285.exe PID 4232 wrote to memory of 4500 4232 z7734092.exe s0769285.exe PID 4500 wrote to memory of 4908 4500 s0769285.exe AppLaunch.exe PID 4500 wrote to memory of 4908 4500 s0769285.exe AppLaunch.exe PID 4500 wrote to memory of 4908 4500 s0769285.exe AppLaunch.exe PID 4500 wrote to memory of 4908 4500 s0769285.exe AppLaunch.exe PID 4500 wrote to memory of 4908 4500 s0769285.exe AppLaunch.exe PID 4500 wrote to memory of 4908 4500 s0769285.exe AppLaunch.exe PID 4500 wrote to memory of 4908 4500 s0769285.exe AppLaunch.exe PID 4500 wrote to memory of 4908 4500 s0769285.exe AppLaunch.exe PID 2140 wrote to memory of 3412 2140 z8270642.exe t6329120.exe PID 2140 wrote to memory of 3412 2140 z8270642.exe t6329120.exe PID 2140 wrote to memory of 3412 2140 z8270642.exe t6329120.exe PID 3412 wrote to memory of 2812 3412 t6329120.exe explonde.exe PID 3412 wrote to memory of 2812 3412 t6329120.exe explonde.exe PID 3412 wrote to memory of 2812 3412 t6329120.exe explonde.exe PID 5024 wrote to memory of 3756 5024 z3611277.exe u2540807.exe PID 5024 wrote to memory of 3756 5024 z3611277.exe u2540807.exe PID 5024 wrote to memory of 3756 5024 z3611277.exe u2540807.exe PID 2812 wrote to memory of 2368 2812 explonde.exe schtasks.exe PID 2812 wrote to memory of 2368 2812 explonde.exe schtasks.exe PID 2812 wrote to memory of 2368 2812 explonde.exe schtasks.exe PID 2812 wrote to memory of 4352 2812 explonde.exe cmd.exe PID 2812 wrote to memory of 4352 2812 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exe"C:\Users\Admin\AppData\Local\Temp\d1df9aea2664b786929aee860b08a94a57503db46567a3aa7ed7a364f0c07989.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3611277.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3611277.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8270642.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8270642.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7734092.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7734092.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7567906.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7567906.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9246195.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9246195.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 5847⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4801935.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4801935.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 1487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0769285.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0769285.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 5926⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6329120.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6329120.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2540807.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2540807.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3684532.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3684532.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3752 -ip 37521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3352 -ip 33521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3640 -ip 36401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4500 -ip 45001⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3684532.exeFilesize
22KB
MD560871ca8ea81b3cd038ee2be9e0cedb4
SHA1408802aed3eea444649952b3a7bb02b46276599c
SHA256e1e5e2db950ff8fb178dab59aa037f119f1958f04eb1e11065b994cc09fdb69f
SHA5129905a1e0ed701f1e360ee75a09f71a0ac56054d4adbca6bebec3d925a43e6657eb233ee854123d1da442de7233dd6764e3184391d3d1e9658a2950cb78d1a6f4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3684532.exeFilesize
22KB
MD560871ca8ea81b3cd038ee2be9e0cedb4
SHA1408802aed3eea444649952b3a7bb02b46276599c
SHA256e1e5e2db950ff8fb178dab59aa037f119f1958f04eb1e11065b994cc09fdb69f
SHA5129905a1e0ed701f1e360ee75a09f71a0ac56054d4adbca6bebec3d925a43e6657eb233ee854123d1da442de7233dd6764e3184391d3d1e9658a2950cb78d1a6f4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3611277.exeFilesize
1.2MB
MD584ea8f09577444427f9a2a677fcee31a
SHA126b6838468d9163e5c830f4d6c68eb24f76ccfeb
SHA2564624137d23978608092f2dd2f9bed1d43269f1717acf0769f9c0a9169e9f6319
SHA512b2458095282196695e3751a7c0dc11d96f42695b0a79465a20b21fd75061b59ab90e8028e13914a51fe6a03c5298cfae63965de6bb2e11137151437fc203980f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3611277.exeFilesize
1.2MB
MD584ea8f09577444427f9a2a677fcee31a
SHA126b6838468d9163e5c830f4d6c68eb24f76ccfeb
SHA2564624137d23978608092f2dd2f9bed1d43269f1717acf0769f9c0a9169e9f6319
SHA512b2458095282196695e3751a7c0dc11d96f42695b0a79465a20b21fd75061b59ab90e8028e13914a51fe6a03c5298cfae63965de6bb2e11137151437fc203980f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2540807.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2540807.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8270642.exeFilesize
1.0MB
MD57db615f744de540dbe4940542e000e69
SHA1f927fca74699507d4d410e9dfbe64fa741d3923c
SHA2564801983f22c459d56d87d6ee8b4c88ef315e13246e97020c3e513eed416a476c
SHA512adae5bffbba74cf8717955fe00864d9f8cf97389cb0d9009815f6b6ab64a7f0e29fdf035a4aa1ee6cdf64605fb0487396893d2f543344b3f8823f233b78078b0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8270642.exeFilesize
1.0MB
MD57db615f744de540dbe4940542e000e69
SHA1f927fca74699507d4d410e9dfbe64fa741d3923c
SHA2564801983f22c459d56d87d6ee8b4c88ef315e13246e97020c3e513eed416a476c
SHA512adae5bffbba74cf8717955fe00864d9f8cf97389cb0d9009815f6b6ab64a7f0e29fdf035a4aa1ee6cdf64605fb0487396893d2f543344b3f8823f233b78078b0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6329120.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6329120.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7734092.exeFilesize
882KB
MD5b037288f3df1968e63ec708a755c1cdd
SHA1095651f4e4a401f40668961fd21c82eaf577068d
SHA256da90a69a82909f5d93583b2f3dba91283450faeda16408558da2662526b541bb
SHA512744e98c00726685b1fbcb3ab526fa2b1566528fa0c1b6ac12ba7bcab9829f471bdc1f7e2ba9a54316f53819da5bb325900130f88fd9d79462200fd18804c2392
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7734092.exeFilesize
882KB
MD5b037288f3df1968e63ec708a755c1cdd
SHA1095651f4e4a401f40668961fd21c82eaf577068d
SHA256da90a69a82909f5d93583b2f3dba91283450faeda16408558da2662526b541bb
SHA512744e98c00726685b1fbcb3ab526fa2b1566528fa0c1b6ac12ba7bcab9829f471bdc1f7e2ba9a54316f53819da5bb325900130f88fd9d79462200fd18804c2392
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0769285.exeFilesize
1.0MB
MD52478aeaf36f831afa1db6367dd39b651
SHA1b0caf0596a9594e41f7bf64cd03718d2113793b3
SHA2566327bf8e0a5ccb13aa64cdd9142aca57fc65f4be04f89d70b71f56d99dad940e
SHA5121d76678c7738b064babb54eaa2324b95cb32873e82c8639c8d9f1d3b20ef30dd302ff0c648001d5e84987a3cf97cf88a8704b575c66b6a108a2b9f1147d2e024
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s0769285.exeFilesize
1.0MB
MD52478aeaf36f831afa1db6367dd39b651
SHA1b0caf0596a9594e41f7bf64cd03718d2113793b3
SHA2566327bf8e0a5ccb13aa64cdd9142aca57fc65f4be04f89d70b71f56d99dad940e
SHA5121d76678c7738b064babb54eaa2324b95cb32873e82c8639c8d9f1d3b20ef30dd302ff0c648001d5e84987a3cf97cf88a8704b575c66b6a108a2b9f1147d2e024
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7567906.exeFilesize
491KB
MD5254df30b9d6a51fc05cb8838a6cbb728
SHA1ee4cdc6fb470007f6ef49f09d1ff864d4abe21a3
SHA256bef922b17fc5a70813f5c7760644b40e691f0e830bf0550831d25d8912796d57
SHA512d7f05f742ebcb227d3479a69aaa5dc8cf628bbf57b2baa63c31d28b85c1bbe7709ed42898eda076410da361d434f7c5de0e7cf3ca549527ffc6cf0557c3ae7a3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7567906.exeFilesize
491KB
MD5254df30b9d6a51fc05cb8838a6cbb728
SHA1ee4cdc6fb470007f6ef49f09d1ff864d4abe21a3
SHA256bef922b17fc5a70813f5c7760644b40e691f0e830bf0550831d25d8912796d57
SHA512d7f05f742ebcb227d3479a69aaa5dc8cf628bbf57b2baa63c31d28b85c1bbe7709ed42898eda076410da361d434f7c5de0e7cf3ca549527ffc6cf0557c3ae7a3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9246195.exeFilesize
860KB
MD5e873a34283b2180176a588b416957171
SHA128ddd1a2e01bb703bf655a2b9bb387ff6d810a4c
SHA256a51d5834ac9402e4823ff6e3a5488de67b01ac0030429bb25751c2186cb74989
SHA512e9f414bfe6fbc86c2f33b817d9b8d214c0680446d1fc258a23c3c6a62d5b6db9c033f003703fb6a5269bcac7f7287a30ff570ab13461bb1c2b5420d04526fa7b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9246195.exeFilesize
860KB
MD5e873a34283b2180176a588b416957171
SHA128ddd1a2e01bb703bf655a2b9bb387ff6d810a4c
SHA256a51d5834ac9402e4823ff6e3a5488de67b01ac0030429bb25751c2186cb74989
SHA512e9f414bfe6fbc86c2f33b817d9b8d214c0680446d1fc258a23c3c6a62d5b6db9c033f003703fb6a5269bcac7f7287a30ff570ab13461bb1c2b5420d04526fa7b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4801935.exeFilesize
1016KB
MD59766a65076dcfcacb636099c745ca624
SHA11dac388aac218f94cb52588867b08643efc045ac
SHA2566fe39288b6345c398d157f00a8984c12234be360d534ebaeb1d8538e6d4b27e9
SHA512965087d9926761bf523518ec28e254f445dce6736d096aa0c53f3e2e013a55cdf4962ccf3d9fe671c22216a205a0847e43cb04ea0c8bf1239bbea5b48f359e52
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4801935.exeFilesize
1016KB
MD59766a65076dcfcacb636099c745ca624
SHA11dac388aac218f94cb52588867b08643efc045ac
SHA2566fe39288b6345c398d157f00a8984c12234be360d534ebaeb1d8538e6d4b27e9
SHA512965087d9926761bf523518ec28e254f445dce6736d096aa0c53f3e2e013a55cdf4962ccf3d9fe671c22216a205a0847e43cb04ea0c8bf1239bbea5b48f359e52
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2608-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2608-36-0x0000000073CC0000-0x0000000074470000-memory.dmpFilesize
7.7MB
-
memory/2608-39-0x0000000073CC0000-0x0000000074470000-memory.dmpFilesize
7.7MB
-
memory/2608-37-0x0000000073CC0000-0x0000000074470000-memory.dmpFilesize
7.7MB
-
memory/3640-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3640-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3640-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3640-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4908-89-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB
-
memory/4908-58-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/4908-65-0x00000000051F0000-0x000000000523C000-memory.dmpFilesize
304KB
-
memory/4908-88-0x0000000073820000-0x0000000073FD0000-memory.dmpFilesize
7.7MB
-
memory/4908-57-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB
-
memory/4908-56-0x00000000050E0000-0x00000000051EA000-memory.dmpFilesize
1.0MB
-
memory/4908-55-0x00000000055F0000-0x0000000005C08000-memory.dmpFilesize
6.1MB
-
memory/4908-54-0x0000000002700000-0x0000000002706000-memory.dmpFilesize
24KB
-
memory/4908-53-0x0000000073820000-0x0000000073FD0000-memory.dmpFilesize
7.7MB
-
memory/4908-64-0x0000000005070000-0x00000000050AC000-memory.dmpFilesize
240KB
-
memory/4908-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB