Analysis
-
max time kernel
180s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 08:26
Static task
static1
Behavioral task
behavioral1
Sample
6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exe
Resource
win7-20230831-en
General
-
Target
6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exe
-
Size
1.1MB
-
MD5
8f76545c95d5421c9cc76eaacfb54034
-
SHA1
a17724fc958c28516de4a13961109ddcc8a58769
-
SHA256
6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18
-
SHA512
98795b3d6d51ee9ab0aeaef6ca3cc964a59304c16e77690d36ffe2ef9e7b1153ef2d9a0ff00c21ddb95fdc6ed27aa09aedd958916cb204bf699dcb9a707b9e7f
-
SSDEEP
24576:cyGumtqNdEgZnWLT1uXchISB+gLRHecvqS/0UAeRFyoJ3:LGwE0HXngtHecv//04Z
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4152-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4152-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4152-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4152-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/560-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t3195339.exeexplonde.exeu9288205.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t3195339.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u9288205.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z0862293.exez1348400.exez2404938.exez3360071.exeq1320179.exer9375435.exes3982906.exet3195339.exeexplonde.exeu9288205.exelegota.exew9926313.exelegota.exeexplonde.exelegota.exeexplonde.exepid process 3572 z0862293.exe 2984 z1348400.exe 2248 z2404938.exe 1636 z3360071.exe 4788 q1320179.exe 4716 r9375435.exe 4108 s3982906.exe 2440 t3195339.exe 1320 explonde.exe 1080 u9288205.exe 1264 legota.exe 3896 w9926313.exe 1060 legota.exe 1044 explonde.exe 4444 legota.exe 2104 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1908 rundll32.exe 4708 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z3360071.exe6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exez0862293.exez1348400.exez2404938.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z3360071.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z0862293.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z1348400.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z2404938.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q1320179.exer9375435.exes3982906.exedescription pid process target process PID 4788 set thread context of 560 4788 q1320179.exe AppLaunch.exe PID 4716 set thread context of 4152 4716 r9375435.exe AppLaunch.exe PID 4108 set thread context of 3312 4108 s3982906.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4580 4788 WerFault.exe q1320179.exe 2176 4716 WerFault.exe r9375435.exe 4808 4152 WerFault.exe AppLaunch.exe 4180 4108 WerFault.exe s3982906.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1484 schtasks.exe 4508 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 560 AppLaunch.exe 560 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 560 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exez0862293.exez1348400.exez2404938.exez3360071.exeq1320179.exer9375435.exes3982906.exet3195339.exeexplonde.exeu9288205.exedescription pid process target process PID 3520 wrote to memory of 3572 3520 6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exe z0862293.exe PID 3520 wrote to memory of 3572 3520 6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exe z0862293.exe PID 3520 wrote to memory of 3572 3520 6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exe z0862293.exe PID 3572 wrote to memory of 2984 3572 z0862293.exe z1348400.exe PID 3572 wrote to memory of 2984 3572 z0862293.exe z1348400.exe PID 3572 wrote to memory of 2984 3572 z0862293.exe z1348400.exe PID 2984 wrote to memory of 2248 2984 z1348400.exe z2404938.exe PID 2984 wrote to memory of 2248 2984 z1348400.exe z2404938.exe PID 2984 wrote to memory of 2248 2984 z1348400.exe z2404938.exe PID 2248 wrote to memory of 1636 2248 z2404938.exe z3360071.exe PID 2248 wrote to memory of 1636 2248 z2404938.exe z3360071.exe PID 2248 wrote to memory of 1636 2248 z2404938.exe z3360071.exe PID 1636 wrote to memory of 4788 1636 z3360071.exe q1320179.exe PID 1636 wrote to memory of 4788 1636 z3360071.exe q1320179.exe PID 1636 wrote to memory of 4788 1636 z3360071.exe q1320179.exe PID 4788 wrote to memory of 560 4788 q1320179.exe AppLaunch.exe PID 4788 wrote to memory of 560 4788 q1320179.exe AppLaunch.exe PID 4788 wrote to memory of 560 4788 q1320179.exe AppLaunch.exe PID 4788 wrote to memory of 560 4788 q1320179.exe AppLaunch.exe PID 4788 wrote to memory of 560 4788 q1320179.exe AppLaunch.exe PID 4788 wrote to memory of 560 4788 q1320179.exe AppLaunch.exe PID 4788 wrote to memory of 560 4788 q1320179.exe AppLaunch.exe PID 4788 wrote to memory of 560 4788 q1320179.exe AppLaunch.exe PID 1636 wrote to memory of 4716 1636 z3360071.exe r9375435.exe PID 1636 wrote to memory of 4716 1636 z3360071.exe r9375435.exe PID 1636 wrote to memory of 4716 1636 z3360071.exe r9375435.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 4716 wrote to memory of 4152 4716 r9375435.exe AppLaunch.exe PID 2248 wrote to memory of 4108 2248 z2404938.exe s3982906.exe PID 2248 wrote to memory of 4108 2248 z2404938.exe s3982906.exe PID 2248 wrote to memory of 4108 2248 z2404938.exe s3982906.exe PID 4108 wrote to memory of 3312 4108 s3982906.exe AppLaunch.exe PID 4108 wrote to memory of 3312 4108 s3982906.exe AppLaunch.exe PID 4108 wrote to memory of 3312 4108 s3982906.exe AppLaunch.exe PID 4108 wrote to memory of 3312 4108 s3982906.exe AppLaunch.exe PID 4108 wrote to memory of 3312 4108 s3982906.exe AppLaunch.exe PID 4108 wrote to memory of 3312 4108 s3982906.exe AppLaunch.exe PID 4108 wrote to memory of 3312 4108 s3982906.exe AppLaunch.exe PID 4108 wrote to memory of 3312 4108 s3982906.exe AppLaunch.exe PID 2984 wrote to memory of 2440 2984 z1348400.exe t3195339.exe PID 2984 wrote to memory of 2440 2984 z1348400.exe t3195339.exe PID 2984 wrote to memory of 2440 2984 z1348400.exe t3195339.exe PID 2440 wrote to memory of 1320 2440 t3195339.exe explonde.exe PID 2440 wrote to memory of 1320 2440 t3195339.exe explonde.exe PID 2440 wrote to memory of 1320 2440 t3195339.exe explonde.exe PID 3572 wrote to memory of 1080 3572 z0862293.exe u9288205.exe PID 3572 wrote to memory of 1080 3572 z0862293.exe u9288205.exe PID 3572 wrote to memory of 1080 3572 z0862293.exe u9288205.exe PID 1320 wrote to memory of 1484 1320 explonde.exe schtasks.exe PID 1320 wrote to memory of 1484 1320 explonde.exe schtasks.exe PID 1320 wrote to memory of 1484 1320 explonde.exe schtasks.exe PID 1320 wrote to memory of 3332 1320 explonde.exe cmd.exe PID 1320 wrote to memory of 3332 1320 explonde.exe cmd.exe PID 1320 wrote to memory of 3332 1320 explonde.exe cmd.exe PID 1080 wrote to memory of 1264 1080 u9288205.exe legota.exe PID 1080 wrote to memory of 1264 1080 u9288205.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exe"C:\Users\Admin\AppData\Local\Temp\6c6f1652a32d1c31d6b4823a4ee6d4fa12745140213041e5e204b6420c898b18_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0862293.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0862293.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1348400.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1348400.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2404938.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2404938.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3360071.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3360071.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1320179.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1320179.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 5687⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9375435.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9375435.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 5647⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3982906.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3982906.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 5726⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3195339.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3195339.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9288205.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9288205.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9926313.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9926313.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4788 -ip 47881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4716 -ip 47161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4152 -ip 41521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4108 -ip 41081⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9926313.exeFilesize
22KB
MD5968a3391a873db1e3d3d7479d3762096
SHA10133fbae50438adf17fd712031b6b770dc28826e
SHA256521676729639a3b6aff3904c03f582f5beedf6f522831973ff2c3e53de15970d
SHA512fb008d8ac09c5b5fb328e7bcc4802f31bcd42a2838be46386506d756cdb219a5055d5a7a414dec57a141e41451fcb144152859716d0c4b46f9f26ce44e2703ef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9926313.exeFilesize
22KB
MD5968a3391a873db1e3d3d7479d3762096
SHA10133fbae50438adf17fd712031b6b770dc28826e
SHA256521676729639a3b6aff3904c03f582f5beedf6f522831973ff2c3e53de15970d
SHA512fb008d8ac09c5b5fb328e7bcc4802f31bcd42a2838be46386506d756cdb219a5055d5a7a414dec57a141e41451fcb144152859716d0c4b46f9f26ce44e2703ef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0862293.exeFilesize
998KB
MD54a9990f5dba4d9082ab012adc4020f00
SHA1918befff59358c53613b96b1d367aca30c4f7547
SHA2562e2538a3bbad20fc54e3fd3aabdd059aa503a8c3a588949f9456875749899e2b
SHA5127463fdfd26109b902de91fcb86e5bf8df20a6c3b9b3f3645f041efb06e7ce0e79c8d129a6e610db1f2d8e33ead6e2ae8fdb6664791bd941cd4340d9731bf3db7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0862293.exeFilesize
998KB
MD54a9990f5dba4d9082ab012adc4020f00
SHA1918befff59358c53613b96b1d367aca30c4f7547
SHA2562e2538a3bbad20fc54e3fd3aabdd059aa503a8c3a588949f9456875749899e2b
SHA5127463fdfd26109b902de91fcb86e5bf8df20a6c3b9b3f3645f041efb06e7ce0e79c8d129a6e610db1f2d8e33ead6e2ae8fdb6664791bd941cd4340d9731bf3db7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9288205.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9288205.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1348400.exeFilesize
815KB
MD56f80829af21cee2f0722319f127f42bd
SHA1939e4df815100019c418a0d2aab8cefa1c76ec97
SHA256cf5f172c3e7f7138d28c008d78fac9083e0dc3acb0cd38d93f9237c2d65ccd0e
SHA5127cfc2cc5847b8b2d8b8033153b2c5a0e532442942973afc14b5a2b6483cd0636e886e61b64e560be7c09ed9c3439275a80f1e67fb87e0ec8cf4d14394957783a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1348400.exeFilesize
815KB
MD56f80829af21cee2f0722319f127f42bd
SHA1939e4df815100019c418a0d2aab8cefa1c76ec97
SHA256cf5f172c3e7f7138d28c008d78fac9083e0dc3acb0cd38d93f9237c2d65ccd0e
SHA5127cfc2cc5847b8b2d8b8033153b2c5a0e532442942973afc14b5a2b6483cd0636e886e61b64e560be7c09ed9c3439275a80f1e67fb87e0ec8cf4d14394957783a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3195339.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3195339.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2404938.exeFilesize
633KB
MD54fe67a0a0ed5e45f7d9d1cdb1e88f958
SHA1ea993d06c9493714cfeaf48d619e2f002394db80
SHA256bcdeb0efc2a88f21d50c2962a7e9625ccb63f55db37c5515067cf7abbeb9e17c
SHA512d3dc21cb6ec3765552c3e530d78e7102b5e95763b767754fed4a10ef31cd1603587e7d757084fb2535ba0f97c6322aae3456f2d4dca05a6352ff1a7936c1f8ae
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2404938.exeFilesize
633KB
MD54fe67a0a0ed5e45f7d9d1cdb1e88f958
SHA1ea993d06c9493714cfeaf48d619e2f002394db80
SHA256bcdeb0efc2a88f21d50c2962a7e9625ccb63f55db37c5515067cf7abbeb9e17c
SHA512d3dc21cb6ec3765552c3e530d78e7102b5e95763b767754fed4a10ef31cd1603587e7d757084fb2535ba0f97c6322aae3456f2d4dca05a6352ff1a7936c1f8ae
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3982906.exeFilesize
413KB
MD5e590753e6420b49604cd476392e3dd6c
SHA1f3e605b38f8d8d2c521afcd7ff7412d8e02e84b6
SHA2569767f72931065db295444992d5685b541cba4817fadbff44fb22b978cd455478
SHA5125bceb9157275d7ae7a8a0b88e0fa2b36354488dcab5e00ae26c6e7722bb853bdae91a6ab38b811490d8ebe518b930298b7f9d1830195554f34c6f61fd3dcea9f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3982906.exeFilesize
413KB
MD5e590753e6420b49604cd476392e3dd6c
SHA1f3e605b38f8d8d2c521afcd7ff7412d8e02e84b6
SHA2569767f72931065db295444992d5685b541cba4817fadbff44fb22b978cd455478
SHA5125bceb9157275d7ae7a8a0b88e0fa2b36354488dcab5e00ae26c6e7722bb853bdae91a6ab38b811490d8ebe518b930298b7f9d1830195554f34c6f61fd3dcea9f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3360071.exeFilesize
355KB
MD5b88a16a8766a6ac8138f8c29105cfe9b
SHA13630c6cf85141d381f30caf2a260ce9e113f3d13
SHA2563a29536d49026258549f55a56ee6c23b4bae7d730ac62ab89f0dbb8fc70cbe74
SHA512a19f3bbd58b71f281ea1dac827de8b100d9155b83f8e123cc4147937b4a4be26e0543426a5d1db64404390afcb0190b9af4725c69ee8137feed8124b86ca16b7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3360071.exeFilesize
355KB
MD5b88a16a8766a6ac8138f8c29105cfe9b
SHA13630c6cf85141d381f30caf2a260ce9e113f3d13
SHA2563a29536d49026258549f55a56ee6c23b4bae7d730ac62ab89f0dbb8fc70cbe74
SHA512a19f3bbd58b71f281ea1dac827de8b100d9155b83f8e123cc4147937b4a4be26e0543426a5d1db64404390afcb0190b9af4725c69ee8137feed8124b86ca16b7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1320179.exeFilesize
250KB
MD5d1ec5b837caec5705085cea2a286b821
SHA19d2fbd7cddd9c5b3d8f906ce38f6d9bd437546ad
SHA2568637ec1a7f2ba19dded1e3dae131bcece84912004302fe4105b9913520f4f1af
SHA512b77b6359d06adf2206c8e464cdd532eea240bd9f0fd3cf19861ede12b6e700f1807eebbc6c79235d4bec7db1e05519d4d3a8575c70644d6851bcc27ff2c9eec0
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1320179.exeFilesize
250KB
MD5d1ec5b837caec5705085cea2a286b821
SHA19d2fbd7cddd9c5b3d8f906ce38f6d9bd437546ad
SHA2568637ec1a7f2ba19dded1e3dae131bcece84912004302fe4105b9913520f4f1af
SHA512b77b6359d06adf2206c8e464cdd532eea240bd9f0fd3cf19861ede12b6e700f1807eebbc6c79235d4bec7db1e05519d4d3a8575c70644d6851bcc27ff2c9eec0
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9375435.exeFilesize
379KB
MD5a950b9e6558f64d354d712b8cf0b6f5b
SHA10a1307a6af2583ff08a6d6c02947dc4688066b56
SHA25624476bbe32368ae48269bb98e01723affc3c9aa79cace04eb249afc819b80d6c
SHA512e56c5a8261aeeb02be00a25a5820093cf9c63f2c512357ddb757092f97ed7435333eb7b3e9385295b01d54a6cdbb157abae556919fec2c8f76cd63e4f19d4e43
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9375435.exeFilesize
379KB
MD5a950b9e6558f64d354d712b8cf0b6f5b
SHA10a1307a6af2583ff08a6d6c02947dc4688066b56
SHA25624476bbe32368ae48269bb98e01723affc3c9aa79cace04eb249afc819b80d6c
SHA512e56c5a8261aeeb02be00a25a5820093cf9c63f2c512357ddb757092f97ed7435333eb7b3e9385295b01d54a6cdbb157abae556919fec2c8f76cd63e4f19d4e43
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/560-86-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/560-36-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/560-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/560-84-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/3312-68-0x0000000005B40000-0x0000000006158000-memory.dmpFilesize
6.1MB
-
memory/3312-49-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/3312-88-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/3312-74-0x0000000005520000-0x0000000005532000-memory.dmpFilesize
72KB
-
memory/3312-69-0x0000000005630000-0x000000000573A000-memory.dmpFilesize
1.0MB
-
memory/3312-81-0x0000000005580000-0x00000000055BC000-memory.dmpFilesize
240KB
-
memory/3312-50-0x00000000054C0000-0x00000000054C6000-memory.dmpFilesize
24KB
-
memory/3312-87-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/3312-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3312-83-0x00000000055D0000-0x000000000561C000-memory.dmpFilesize
304KB
-
memory/3312-75-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/4152-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4152-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4152-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4152-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB