Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 08:31
Static task
static1
Behavioral task
behavioral1
Sample
4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exe
Resource
win7-20230831-en
General
-
Target
4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exe
-
Size
1.0MB
-
MD5
13ba10f061607f32bd7ae594e7c9af9b
-
SHA1
9600712f23d225e1b485811ba5f6d3d810b3bbeb
-
SHA256
4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb
-
SHA512
be0c4d257dc08dd99b7ddeea8ab5506cc95be5435f801838a261692932d0350331fdf65754b821c004c0bef3e4c7181c319e08bc7afa7ea18a0abf1d34d9d5ae
-
SSDEEP
24576:IyVyeCE+zjUAOh4x8MaH1AyQrfOor8IL/IMhtE:PwehwUAsC8MaHqFzOoIMgM
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2796-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2796-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2796-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2796-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2124-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet2114645.exeexplonde.exeu2193574.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation t2114645.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation u2193574.exe -
Executes dropped EXE 16 IoCs
Processes:
z4068302.exez7510120.exez1593709.exez4216976.exeq2875768.exer2690415.exes8864844.exet2114645.exeexplonde.exeu2193574.exelegota.exew6463858.exelegota.exeexplonde.exelegota.exeexplonde.exepid process 3988 z4068302.exe 4104 z7510120.exe 1876 z1593709.exe 4768 z4216976.exe 4284 q2875768.exe 3880 r2690415.exe 2400 s8864844.exe 2360 t2114645.exe 4368 explonde.exe 4756 u2193574.exe 1200 legota.exe 4672 w6463858.exe 2200 legota.exe 3344 explonde.exe 3920 legota.exe 4392 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4168 rundll32.exe 1196 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z1593709.exez4216976.exe4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exez4068302.exez7510120.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z1593709.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z4216976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4068302.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7510120.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q2875768.exer2690415.exes8864844.exedescription pid process target process PID 4284 set thread context of 2124 4284 q2875768.exe AppLaunch.exe PID 3880 set thread context of 2796 3880 r2690415.exe AppLaunch.exe PID 2400 set thread context of 2000 2400 s8864844.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3808 4284 WerFault.exe q2875768.exe 5044 3880 WerFault.exe r2690415.exe 3912 2796 WerFault.exe AppLaunch.exe 1376 2400 WerFault.exe s8864844.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3420 schtasks.exe 2836 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2124 AppLaunch.exe 2124 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2124 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exez4068302.exez7510120.exez1593709.exez4216976.exeq2875768.exer2690415.exes8864844.exet2114645.exeexplonde.exedescription pid process target process PID 2144 wrote to memory of 3988 2144 4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exe z4068302.exe PID 2144 wrote to memory of 3988 2144 4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exe z4068302.exe PID 2144 wrote to memory of 3988 2144 4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exe z4068302.exe PID 3988 wrote to memory of 4104 3988 z4068302.exe z7510120.exe PID 3988 wrote to memory of 4104 3988 z4068302.exe z7510120.exe PID 3988 wrote to memory of 4104 3988 z4068302.exe z7510120.exe PID 4104 wrote to memory of 1876 4104 z7510120.exe z1593709.exe PID 4104 wrote to memory of 1876 4104 z7510120.exe z1593709.exe PID 4104 wrote to memory of 1876 4104 z7510120.exe z1593709.exe PID 1876 wrote to memory of 4768 1876 z1593709.exe z4216976.exe PID 1876 wrote to memory of 4768 1876 z1593709.exe z4216976.exe PID 1876 wrote to memory of 4768 1876 z1593709.exe z4216976.exe PID 4768 wrote to memory of 4284 4768 z4216976.exe q2875768.exe PID 4768 wrote to memory of 4284 4768 z4216976.exe q2875768.exe PID 4768 wrote to memory of 4284 4768 z4216976.exe q2875768.exe PID 4284 wrote to memory of 2124 4284 q2875768.exe AppLaunch.exe PID 4284 wrote to memory of 2124 4284 q2875768.exe AppLaunch.exe PID 4284 wrote to memory of 2124 4284 q2875768.exe AppLaunch.exe PID 4284 wrote to memory of 2124 4284 q2875768.exe AppLaunch.exe PID 4284 wrote to memory of 2124 4284 q2875768.exe AppLaunch.exe PID 4284 wrote to memory of 2124 4284 q2875768.exe AppLaunch.exe PID 4284 wrote to memory of 2124 4284 q2875768.exe AppLaunch.exe PID 4284 wrote to memory of 2124 4284 q2875768.exe AppLaunch.exe PID 4768 wrote to memory of 3880 4768 z4216976.exe r2690415.exe PID 4768 wrote to memory of 3880 4768 z4216976.exe r2690415.exe PID 4768 wrote to memory of 3880 4768 z4216976.exe r2690415.exe PID 3880 wrote to memory of 4340 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 4340 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 4340 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 3880 wrote to memory of 2796 3880 r2690415.exe AppLaunch.exe PID 1876 wrote to memory of 2400 1876 z1593709.exe s8864844.exe PID 1876 wrote to memory of 2400 1876 z1593709.exe s8864844.exe PID 1876 wrote to memory of 2400 1876 z1593709.exe s8864844.exe PID 2400 wrote to memory of 2000 2400 s8864844.exe AppLaunch.exe PID 2400 wrote to memory of 2000 2400 s8864844.exe AppLaunch.exe PID 2400 wrote to memory of 2000 2400 s8864844.exe AppLaunch.exe PID 2400 wrote to memory of 2000 2400 s8864844.exe AppLaunch.exe PID 2400 wrote to memory of 2000 2400 s8864844.exe AppLaunch.exe PID 2400 wrote to memory of 2000 2400 s8864844.exe AppLaunch.exe PID 2400 wrote to memory of 2000 2400 s8864844.exe AppLaunch.exe PID 2400 wrote to memory of 2000 2400 s8864844.exe AppLaunch.exe PID 4104 wrote to memory of 2360 4104 z7510120.exe t2114645.exe PID 4104 wrote to memory of 2360 4104 z7510120.exe t2114645.exe PID 4104 wrote to memory of 2360 4104 z7510120.exe t2114645.exe PID 2360 wrote to memory of 4368 2360 t2114645.exe explonde.exe PID 2360 wrote to memory of 4368 2360 t2114645.exe explonde.exe PID 2360 wrote to memory of 4368 2360 t2114645.exe explonde.exe PID 3988 wrote to memory of 4756 3988 z4068302.exe u2193574.exe PID 3988 wrote to memory of 4756 3988 z4068302.exe u2193574.exe PID 3988 wrote to memory of 4756 3988 z4068302.exe u2193574.exe PID 4368 wrote to memory of 3420 4368 explonde.exe schtasks.exe PID 4368 wrote to memory of 3420 4368 explonde.exe schtasks.exe PID 4368 wrote to memory of 3420 4368 explonde.exe schtasks.exe PID 4368 wrote to memory of 1532 4368 explonde.exe cmd.exe PID 4368 wrote to memory of 1532 4368 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exe"C:\Users\Admin\AppData\Local\Temp\4d87a72c325e9fc9820cfed3a46c67d4299ff8a54af16a107f28cedf621d01cb_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4068302.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4068302.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7510120.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7510120.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1593709.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1593709.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4216976.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4216976.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2875768.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2875768.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 1487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2690415.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2690415.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 5448⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 6087⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8864844.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8864844.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2114645.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2114645.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2193574.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2193574.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6463858.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6463858.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4284 -ip 42841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3880 -ip 38801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2796 -ip 27961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2400 -ip 24001⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6463858.exeFilesize
22KB
MD55f6570af3962553a6661f9364cf7ecc2
SHA153f3c6d0511c653f1e7b9316174511afa68b47f2
SHA256177d4e13cab429a9dc4184bd661a4cde63cc993002f48b9bf9f6778283e8f403
SHA512563ae5b17fc1122ebfda855a6fe4bdd6e47110ae4db5ce5188b5fb0b01e42835745cae94acc3e02cbaf5f500b743e039f9b9f5fb830ae5f21188de85bb542051
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6463858.exeFilesize
22KB
MD55f6570af3962553a6661f9364cf7ecc2
SHA153f3c6d0511c653f1e7b9316174511afa68b47f2
SHA256177d4e13cab429a9dc4184bd661a4cde63cc993002f48b9bf9f6778283e8f403
SHA512563ae5b17fc1122ebfda855a6fe4bdd6e47110ae4db5ce5188b5fb0b01e42835745cae94acc3e02cbaf5f500b743e039f9b9f5fb830ae5f21188de85bb542051
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4068302.exeFilesize
966KB
MD582299f3e1b9b70627488b9b13ec64735
SHA1349777847ed85d16ba08a4881f81e65633cbdd56
SHA2564ee26c353878cf9bd18d724f32cea5a76d349359a2dede411520a1d7da94b702
SHA512955242519a4d5793c8808ad2575a81a6566f802e2e07abb033be1147326353da5cd83a9e8fd949ab5f655b26417c2d04723d52284c35d0aa5cf1069c0517ae0b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4068302.exeFilesize
966KB
MD582299f3e1b9b70627488b9b13ec64735
SHA1349777847ed85d16ba08a4881f81e65633cbdd56
SHA2564ee26c353878cf9bd18d724f32cea5a76d349359a2dede411520a1d7da94b702
SHA512955242519a4d5793c8808ad2575a81a6566f802e2e07abb033be1147326353da5cd83a9e8fd949ab5f655b26417c2d04723d52284c35d0aa5cf1069c0517ae0b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2193574.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2193574.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7510120.exeFilesize
782KB
MD597b866f2c22a901fb393371152d5483d
SHA15e25367bcb2c1badbf7c26962b6113d146abdb65
SHA256098c6f17bfea38604d4b84b3c68cbca1f539311100ec1d5e1000c3fc523b2703
SHA51207fb4604d4b97739945a2efc912dbf22c546c0c067eec7a48de9d314a7cee64007cc2cd77059161d722f0b3e4e257b426609625fa3463ed6b84981348390d1b2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7510120.exeFilesize
782KB
MD597b866f2c22a901fb393371152d5483d
SHA15e25367bcb2c1badbf7c26962b6113d146abdb65
SHA256098c6f17bfea38604d4b84b3c68cbca1f539311100ec1d5e1000c3fc523b2703
SHA51207fb4604d4b97739945a2efc912dbf22c546c0c067eec7a48de9d314a7cee64007cc2cd77059161d722f0b3e4e257b426609625fa3463ed6b84981348390d1b2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2114645.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2114645.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1593709.exeFilesize
600KB
MD5d266293acbfec560c5ba10b3cafea388
SHA18a776a3afe60de93ec5f316c4753a6c2f3e65436
SHA2562b008ec5fcce976d629e0df973a6cd9f1a5c53f044f03f99a1f8fd2f14f5ec93
SHA512d5313f5d004ad0bc510f6e475791eda05020f90cc9ef1e2290dcff618d217da3ca1da1780ab4de987ff0eaac4b6922b71461d20cfee143209dcdcda4a1182d8f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1593709.exeFilesize
600KB
MD5d266293acbfec560c5ba10b3cafea388
SHA18a776a3afe60de93ec5f316c4753a6c2f3e65436
SHA2562b008ec5fcce976d629e0df973a6cd9f1a5c53f044f03f99a1f8fd2f14f5ec93
SHA512d5313f5d004ad0bc510f6e475791eda05020f90cc9ef1e2290dcff618d217da3ca1da1780ab4de987ff0eaac4b6922b71461d20cfee143209dcdcda4a1182d8f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8864844.exeFilesize
380KB
MD5bc49e23d884502ea7669c0dab6936f97
SHA1e9c2a599ad15f643958e350d8622a393986a13cc
SHA2565cfaf6ab47adcba11b059c884f8d8039d83802d5dacac3f7d47326cf205f896b
SHA512b5dcf48981674bd957f45ffaf68e95b09745e1f4f868d016e5cf746c54b52bc3f638b40540435661c9f132e3f4603d255b3ad47a31390bbff53c79923a2e607f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8864844.exeFilesize
380KB
MD5bc49e23d884502ea7669c0dab6936f97
SHA1e9c2a599ad15f643958e350d8622a393986a13cc
SHA2565cfaf6ab47adcba11b059c884f8d8039d83802d5dacac3f7d47326cf205f896b
SHA512b5dcf48981674bd957f45ffaf68e95b09745e1f4f868d016e5cf746c54b52bc3f638b40540435661c9f132e3f4603d255b3ad47a31390bbff53c79923a2e607f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4216976.exeFilesize
338KB
MD53e7b91174d58d15a9d05feffa4ac8f39
SHA167bde90d879986efb9df6ca3de828bf6c478eee9
SHA256b1a7206014ecff21479666e6ad6093931b94ae3fc34007ba0384755f89a384e9
SHA5128b5098afbdb296d513b543483ccfc772c897aa0d1697ec3ccdecf2acc9e6f2c413f8332818b9e07624a1a90b357e778d2a0d1287baf4f57f5af3238e85597c57
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4216976.exeFilesize
338KB
MD53e7b91174d58d15a9d05feffa4ac8f39
SHA167bde90d879986efb9df6ca3de828bf6c478eee9
SHA256b1a7206014ecff21479666e6ad6093931b94ae3fc34007ba0384755f89a384e9
SHA5128b5098afbdb296d513b543483ccfc772c897aa0d1697ec3ccdecf2acc9e6f2c413f8332818b9e07624a1a90b357e778d2a0d1287baf4f57f5af3238e85597c57
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2875768.exeFilesize
217KB
MD59c88d494b1647d002d80322c58376262
SHA15fc2d852a71ac6b1132a09b07609316618d7f3e5
SHA25683e0afbee48dd91eda9fc69d45b95245e7b1df860b9ca1228f920d6c15ceeb56
SHA512bd45c464c807f9ef0694e876448f27f0540716bd7d6e344dc8faaa85965a7f1812f5b1321dbc33a90666028c98eab677668427835a24d3fa167bfc6efcc0b39b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2875768.exeFilesize
217KB
MD59c88d494b1647d002d80322c58376262
SHA15fc2d852a71ac6b1132a09b07609316618d7f3e5
SHA25683e0afbee48dd91eda9fc69d45b95245e7b1df860b9ca1228f920d6c15ceeb56
SHA512bd45c464c807f9ef0694e876448f27f0540716bd7d6e344dc8faaa85965a7f1812f5b1321dbc33a90666028c98eab677668427835a24d3fa167bfc6efcc0b39b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2690415.exeFilesize
346KB
MD5694f1dd1d79f1e2943d96b0679ab18b0
SHA1eae850a136a69f993c3328575102a147119457a4
SHA256b378bae2165f96332678646c8b619fbbab9a2c762f7cda59c07b3edb81e4bef4
SHA5120ef79e917b9949f094657d503d2d9f8a355ec2f6affe929fcb2be9cc0b89132c8c5051df2ab055f08eaff4e6ee97101355d4f9682520c8d1695f05c5e11bb9eb
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2690415.exeFilesize
346KB
MD5694f1dd1d79f1e2943d96b0679ab18b0
SHA1eae850a136a69f993c3328575102a147119457a4
SHA256b378bae2165f96332678646c8b619fbbab9a2c762f7cda59c07b3edb81e4bef4
SHA5120ef79e917b9949f094657d503d2d9f8a355ec2f6affe929fcb2be9cc0b89132c8c5051df2ab055f08eaff4e6ee97101355d4f9682520c8d1695f05c5e11bb9eb
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2000-87-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/2000-56-0x00000000058F0000-0x0000000005F08000-memory.dmpFilesize
6.1MB
-
memory/2000-62-0x0000000005310000-0x000000000534C000-memory.dmpFilesize
240KB
-
memory/2000-58-0x0000000005290000-0x00000000052A2000-memory.dmpFilesize
72KB
-
memory/2000-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2000-60-0x00000000052C0000-0x00000000052D0000-memory.dmpFilesize
64KB
-
memory/2000-88-0x00000000052C0000-0x00000000052D0000-memory.dmpFilesize
64KB
-
memory/2000-50-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/2000-57-0x00000000053E0000-0x00000000054EA000-memory.dmpFilesize
1.0MB
-
memory/2000-69-0x0000000005350000-0x000000000539C000-memory.dmpFilesize
304KB
-
memory/2000-49-0x0000000001260000-0x0000000001266000-memory.dmpFilesize
24KB
-
memory/2124-59-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/2124-86-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/2124-36-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/2124-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2796-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2796-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2796-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2796-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB