Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 08:26
Static task
static1
Behavioral task
behavioral1
Sample
51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exe
Resource
win7-20230831-en
General
-
Target
51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exe
-
Size
1.3MB
-
MD5
e580c269c5229c4a300a69d2c42c7b99
-
SHA1
a74f330e9def26f6aa62a7702bf6b9212ac15ec9
-
SHA256
51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7
-
SHA512
9ac0931e89e74ab4adc0dd08bd51818f1566b2fcee62b7ccb52b3456b73dec01310ec1dbfcfb06869b85a0094ab292219fa5b96625c4e818e3b31a131a43f476
-
SSDEEP
24576:pyKxoJyUHA4WoKGxpY2BC9BUaU0G4s4A51vrVZAzuuYaz/nQeFLOoSpGmc7OvMtz:cKOJybbGxaLBxU02l5J8zuuftIoUcUKU
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4968-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4968-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4968-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4968-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4048-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t2965582.exeexplonde.exeu4541961.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation t2965582.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation u4541961.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z6993783.exez3099348.exez4340539.exez2047740.exeq2264416.exer3130330.exes2738208.exet2965582.exeexplonde.exeu4541961.exelegota.exew9634526.exeexplonde.exelegota.exeexplonde.exelegota.exepid process 4824 z6993783.exe 668 z3099348.exe 4908 z4340539.exe 2512 z2047740.exe 3392 q2264416.exe 3668 r3130330.exe 864 s2738208.exe 2468 t2965582.exe 1916 explonde.exe 4660 u4541961.exe 1644 legota.exe 4864 w9634526.exe 4696 explonde.exe 4856 legota.exe 4480 explonde.exe 3144 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1372 rundll32.exe 1576 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exez6993783.exez3099348.exez4340539.exez2047740.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z6993783.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3099348.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z4340539.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z2047740.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q2264416.exer3130330.exes2738208.exedescription pid process target process PID 3392 set thread context of 4048 3392 q2264416.exe AppLaunch.exe PID 3668 set thread context of 4968 3668 r3130330.exe AppLaunch.exe PID 864 set thread context of 3364 864 s2738208.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 536 3392 WerFault.exe q2264416.exe 3812 3668 WerFault.exe r3130330.exe 2440 4968 WerFault.exe AppLaunch.exe 3920 864 WerFault.exe s2738208.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4288 schtasks.exe 1816 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 4048 AppLaunch.exe 4048 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4048 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exez6993783.exez3099348.exez4340539.exez2047740.exeq2264416.exer3130330.exes2738208.exet2965582.exeexplonde.exeu4541961.exedescription pid process target process PID 2808 wrote to memory of 4824 2808 51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exe z6993783.exe PID 2808 wrote to memory of 4824 2808 51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exe z6993783.exe PID 2808 wrote to memory of 4824 2808 51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exe z6993783.exe PID 4824 wrote to memory of 668 4824 z6993783.exe z3099348.exe PID 4824 wrote to memory of 668 4824 z6993783.exe z3099348.exe PID 4824 wrote to memory of 668 4824 z6993783.exe z3099348.exe PID 668 wrote to memory of 4908 668 z3099348.exe z4340539.exe PID 668 wrote to memory of 4908 668 z3099348.exe z4340539.exe PID 668 wrote to memory of 4908 668 z3099348.exe z4340539.exe PID 4908 wrote to memory of 2512 4908 z4340539.exe z2047740.exe PID 4908 wrote to memory of 2512 4908 z4340539.exe z2047740.exe PID 4908 wrote to memory of 2512 4908 z4340539.exe z2047740.exe PID 2512 wrote to memory of 3392 2512 z2047740.exe q2264416.exe PID 2512 wrote to memory of 3392 2512 z2047740.exe q2264416.exe PID 2512 wrote to memory of 3392 2512 z2047740.exe q2264416.exe PID 3392 wrote to memory of 4048 3392 q2264416.exe AppLaunch.exe PID 3392 wrote to memory of 4048 3392 q2264416.exe AppLaunch.exe PID 3392 wrote to memory of 4048 3392 q2264416.exe AppLaunch.exe PID 3392 wrote to memory of 4048 3392 q2264416.exe AppLaunch.exe PID 3392 wrote to memory of 4048 3392 q2264416.exe AppLaunch.exe PID 3392 wrote to memory of 4048 3392 q2264416.exe AppLaunch.exe PID 3392 wrote to memory of 4048 3392 q2264416.exe AppLaunch.exe PID 3392 wrote to memory of 4048 3392 q2264416.exe AppLaunch.exe PID 2512 wrote to memory of 3668 2512 z2047740.exe r3130330.exe PID 2512 wrote to memory of 3668 2512 z2047740.exe r3130330.exe PID 2512 wrote to memory of 3668 2512 z2047740.exe r3130330.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 3668 wrote to memory of 4968 3668 r3130330.exe AppLaunch.exe PID 4908 wrote to memory of 864 4908 z4340539.exe s2738208.exe PID 4908 wrote to memory of 864 4908 z4340539.exe s2738208.exe PID 4908 wrote to memory of 864 4908 z4340539.exe s2738208.exe PID 864 wrote to memory of 3364 864 s2738208.exe AppLaunch.exe PID 864 wrote to memory of 3364 864 s2738208.exe AppLaunch.exe PID 864 wrote to memory of 3364 864 s2738208.exe AppLaunch.exe PID 864 wrote to memory of 3364 864 s2738208.exe AppLaunch.exe PID 864 wrote to memory of 3364 864 s2738208.exe AppLaunch.exe PID 864 wrote to memory of 3364 864 s2738208.exe AppLaunch.exe PID 864 wrote to memory of 3364 864 s2738208.exe AppLaunch.exe PID 864 wrote to memory of 3364 864 s2738208.exe AppLaunch.exe PID 668 wrote to memory of 2468 668 z3099348.exe t2965582.exe PID 668 wrote to memory of 2468 668 z3099348.exe t2965582.exe PID 668 wrote to memory of 2468 668 z3099348.exe t2965582.exe PID 2468 wrote to memory of 1916 2468 t2965582.exe explonde.exe PID 2468 wrote to memory of 1916 2468 t2965582.exe explonde.exe PID 2468 wrote to memory of 1916 2468 t2965582.exe explonde.exe PID 4824 wrote to memory of 4660 4824 z6993783.exe u4541961.exe PID 4824 wrote to memory of 4660 4824 z6993783.exe u4541961.exe PID 4824 wrote to memory of 4660 4824 z6993783.exe u4541961.exe PID 1916 wrote to memory of 4288 1916 explonde.exe schtasks.exe PID 1916 wrote to memory of 4288 1916 explonde.exe schtasks.exe PID 1916 wrote to memory of 4288 1916 explonde.exe schtasks.exe PID 4660 wrote to memory of 1644 4660 u4541961.exe legota.exe PID 4660 wrote to memory of 1644 4660 u4541961.exe legota.exe PID 4660 wrote to memory of 1644 4660 u4541961.exe legota.exe PID 1916 wrote to memory of 3612 1916 explonde.exe cmd.exe PID 1916 wrote to memory of 3612 1916 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exe"C:\Users\Admin\AppData\Local\Temp\51126d3a362fb7dd4eca4b86b8832fa8f062e925095243262d97da38f84b33c7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6993783.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6993783.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3099348.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3099348.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4340539.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4340539.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2047740.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2047740.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2264416.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2264416.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 5927⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3130330.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3130330.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 2248⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 1527⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2738208.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2738208.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 1526⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2965582.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2965582.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4541961.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4541961.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9634526.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9634526.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3392 -ip 33921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3668 -ip 36681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 49681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 864 -ip 8641⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9634526.exeFilesize
22KB
MD5f9df885b1c462bfe7d3100323973fe95
SHA1e29b22d5000598f7c920d648c2b73503d6d6be94
SHA25640a2d4169a487118f51ec5a2b6d2c7b10e361d99ed0dfb15de58c52b953cc875
SHA5128a632accca06a5badc32fb2cdc25f9ef3ea1ad459552df55fe817b7188e76ec39dad0a3171d57953d187d4475be498afebcf5bd73e80ca31ddd4362ef8d5c153
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9634526.exeFilesize
22KB
MD5f9df885b1c462bfe7d3100323973fe95
SHA1e29b22d5000598f7c920d648c2b73503d6d6be94
SHA25640a2d4169a487118f51ec5a2b6d2c7b10e361d99ed0dfb15de58c52b953cc875
SHA5128a632accca06a5badc32fb2cdc25f9ef3ea1ad459552df55fe817b7188e76ec39dad0a3171d57953d187d4475be498afebcf5bd73e80ca31ddd4362ef8d5c153
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6993783.exeFilesize
1.2MB
MD5e8f7ae5dde056ddb3f7d4cf2d0286ac4
SHA1e99bfcae061158f4ade08509a06cd8693174567a
SHA256b860d74a086870234757476d7cf5724f754289010ed2479cd12fd2e61abfd1d3
SHA512b765b0c491c22b45914834095af1e20f3d5d625f7a94ebf7daa37893267bb3758b422c2a3bf559f960795c03814db9d738e00edb8bc6a28950d1310e60ad92fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6993783.exeFilesize
1.2MB
MD5e8f7ae5dde056ddb3f7d4cf2d0286ac4
SHA1e99bfcae061158f4ade08509a06cd8693174567a
SHA256b860d74a086870234757476d7cf5724f754289010ed2479cd12fd2e61abfd1d3
SHA512b765b0c491c22b45914834095af1e20f3d5d625f7a94ebf7daa37893267bb3758b422c2a3bf559f960795c03814db9d738e00edb8bc6a28950d1310e60ad92fd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4541961.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4541961.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3099348.exeFilesize
1.0MB
MD57e4d3445465d9c9b6e4aa6ef43d36a78
SHA121720892e49c5b7ef339c29056252eb463bc22bc
SHA256f02d5a86032645ad86bba236c73a0b4c0e008cbe8d4ba8ed1106a385c8ee7a7d
SHA512a750c82ab53d4dc8d852e793ca89bc3ba5322ed45b4a53c5b0420b9e676428015a6ad06ac8b4a9fcbbe21633c5bd7912a225e8cbe027c09570c3d02175eb8095
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3099348.exeFilesize
1.0MB
MD57e4d3445465d9c9b6e4aa6ef43d36a78
SHA121720892e49c5b7ef339c29056252eb463bc22bc
SHA256f02d5a86032645ad86bba236c73a0b4c0e008cbe8d4ba8ed1106a385c8ee7a7d
SHA512a750c82ab53d4dc8d852e793ca89bc3ba5322ed45b4a53c5b0420b9e676428015a6ad06ac8b4a9fcbbe21633c5bd7912a225e8cbe027c09570c3d02175eb8095
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2965582.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2965582.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4340539.exeFilesize
891KB
MD5165e0481323f313cbc446a367a25447e
SHA1334cc51ab47abc4b9d685d9b1640b7f4be828c37
SHA25632c0dfdf518b47181d205e64a8e1f93584d94d44b6943d6d77a3254f09321e42
SHA512be05490cf6ba292c1e1b5cdbe2d84df17a6dfcc873b895a132d29b01ea7b54f52c25ff5fbc6a5066cf9b5b16565cad0b36c63b71898ec8a320965e8553d4406d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4340539.exeFilesize
891KB
MD5165e0481323f313cbc446a367a25447e
SHA1334cc51ab47abc4b9d685d9b1640b7f4be828c37
SHA25632c0dfdf518b47181d205e64a8e1f93584d94d44b6943d6d77a3254f09321e42
SHA512be05490cf6ba292c1e1b5cdbe2d84df17a6dfcc873b895a132d29b01ea7b54f52c25ff5fbc6a5066cf9b5b16565cad0b36c63b71898ec8a320965e8553d4406d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2738208.exeFilesize
1.0MB
MD5dc0b76f0d7cfb51199f99c9cc8cce566
SHA14f905aa41c7aad7d99100ad1644590ec1cdc1d26
SHA2564579a57d128868c529f682c82ed858ec617a2acf0f5dcfa6ea9ddcf41b86fdbf
SHA512400491d66e8443933adf62e812ff513953aae1b3ec77d5acb1a4bb83d669495c9907ee185f3fd7ef8809d76f7d729494dd8c7ffbc0499e16a46c839ac49d8900
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2738208.exeFilesize
1.0MB
MD5dc0b76f0d7cfb51199f99c9cc8cce566
SHA14f905aa41c7aad7d99100ad1644590ec1cdc1d26
SHA2564579a57d128868c529f682c82ed858ec617a2acf0f5dcfa6ea9ddcf41b86fdbf
SHA512400491d66e8443933adf62e812ff513953aae1b3ec77d5acb1a4bb83d669495c9907ee185f3fd7ef8809d76f7d729494dd8c7ffbc0499e16a46c839ac49d8900
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2047740.exeFilesize
501KB
MD5f34a210afdd016ae66adf66403e755de
SHA16dd592497c2bb5b0397bebb5d9a3bb85f9c047eb
SHA25613b09cb04c7bae429e1c95acd57e63767a90314363636795fd5ddb57fe961eb2
SHA5121c58bd3abb72436078df7c4b1572eacc58442ff652cffa32fa26558f78239ec5a66df726c806f72ba18bd45372e5b2c5416e64c601ef2f0546a71cc869a46413
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2047740.exeFilesize
501KB
MD5f34a210afdd016ae66adf66403e755de
SHA16dd592497c2bb5b0397bebb5d9a3bb85f9c047eb
SHA25613b09cb04c7bae429e1c95acd57e63767a90314363636795fd5ddb57fe961eb2
SHA5121c58bd3abb72436078df7c4b1572eacc58442ff652cffa32fa26558f78239ec5a66df726c806f72ba18bd45372e5b2c5416e64c601ef2f0546a71cc869a46413
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2264416.exeFilesize
860KB
MD58d5244f2317f036f4ce7015cdf19f6e2
SHA195dd7e939938de7d9c485ac417b74a88955eb0cf
SHA256e40d718612e3c80d606f060d28a0d5a95d782900c388c5f497f55f59f98232f9
SHA51277e2df9a1b1b7b377b23765d3db928f400aad565f4f8fb49e4e41b19b45e9cd6da29be55e53026018a529fcc4984a1f2757fded65ea5a8b10215ffd78354867a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2264416.exeFilesize
860KB
MD58d5244f2317f036f4ce7015cdf19f6e2
SHA195dd7e939938de7d9c485ac417b74a88955eb0cf
SHA256e40d718612e3c80d606f060d28a0d5a95d782900c388c5f497f55f59f98232f9
SHA51277e2df9a1b1b7b377b23765d3db928f400aad565f4f8fb49e4e41b19b45e9cd6da29be55e53026018a529fcc4984a1f2757fded65ea5a8b10215ffd78354867a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3130330.exeFilesize
1016KB
MD5177c4301b30d096e28d829b17c6b598e
SHA17c4a02c3b70498a47c96a9ca46cf008c4611b4c4
SHA2564c56191c35b8f879055ae17ba5ca48e67f95fe04f0f86a9773d88ee8578cdaa2
SHA512af287a1329ab7635ffee9f550aaca641b67a9d371ae86de0db204d1eabf8d23ecd33f256f0df2df9e99cc7e1809a387b5a98e4031e0e7bd3e567aeed5f6be906
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3130330.exeFilesize
1016KB
MD5177c4301b30d096e28d829b17c6b598e
SHA17c4a02c3b70498a47c96a9ca46cf008c4611b4c4
SHA2564c56191c35b8f879055ae17ba5ca48e67f95fe04f0f86a9773d88ee8578cdaa2
SHA512af287a1329ab7635ffee9f550aaca641b67a9d371ae86de0db204d1eabf8d23ecd33f256f0df2df9e99cc7e1809a387b5a98e4031e0e7bd3e567aeed5f6be906
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/3364-58-0x0000000005650000-0x000000000575A000-memory.dmpFilesize
1.0MB
-
memory/3364-51-0x0000000074190000-0x0000000074940000-memory.dmpFilesize
7.7MB
-
memory/3364-66-0x0000000005760000-0x00000000057AC000-memory.dmpFilesize
304KB
-
memory/3364-61-0x00000000055E0000-0x000000000561C000-memory.dmpFilesize
240KB
-
memory/3364-59-0x0000000005580000-0x0000000005592000-memory.dmpFilesize
72KB
-
memory/3364-87-0x0000000074190000-0x0000000074940000-memory.dmpFilesize
7.7MB
-
memory/3364-88-0x00000000053F0000-0x0000000005400000-memory.dmpFilesize
64KB
-
memory/3364-60-0x00000000053F0000-0x0000000005400000-memory.dmpFilesize
64KB
-
memory/3364-55-0x0000000005B20000-0x0000000006138000-memory.dmpFilesize
6.1MB
-
memory/3364-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3364-49-0x00000000053E0000-0x00000000053E6000-memory.dmpFilesize
24KB
-
memory/4048-50-0x0000000074190000-0x0000000074940000-memory.dmpFilesize
7.7MB
-
memory/4048-71-0x0000000074190000-0x0000000074940000-memory.dmpFilesize
7.7MB
-
memory/4048-36-0x0000000074190000-0x0000000074940000-memory.dmpFilesize
7.7MB
-
memory/4048-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4968-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4968-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4968-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4968-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB