Analysis
-
max time kernel
183s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 08:35
Static task
static1
Behavioral task
behavioral1
Sample
42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe
Resource
win7-20230831-en
General
-
Target
42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe
-
Size
1.1MB
-
MD5
5df6eb8e766dbe7db9b4bc5c7e574262
-
SHA1
ce67fdb6541205ade7d4228faab79c6cee3e0e18
-
SHA256
42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554
-
SHA512
091efe39a57228e2f794b929fcb2f4fde8f4627b712ded7363177f673043593bec0cd0832979ac27ebaf5c9f00d78653b36c25a25eec2acc71be0679935815f7
-
SSDEEP
24576:wyvmX/9S/UXdNmBMmSfozdsBlLIZ/HQVuScFSRO87B480yxlKK:34IGdNmBMRwqB8/wQdOm8Xx
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1544-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1544-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1544-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1544-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3224-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
u5357221.exeexplonde.exelegota.exet9836849.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation u5357221.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation t9836849.exe -
Executes dropped EXE 14 IoCs
Processes:
z2603028.exez4765722.exez8957211.exez4221137.exeq0203422.exer8527534.exes8002835.exet9836849.exeexplonde.exeu5357221.exelegota.exew0511289.exeexplonde.exelegota.exepid process 3820 z2603028.exe 1604 z4765722.exe 1556 z8957211.exe 4164 z4221137.exe 2584 q0203422.exe 3728 r8527534.exe 1812 s8002835.exe 660 t9836849.exe 1484 explonde.exe 4452 u5357221.exe 4072 legota.exe 5068 w0511289.exe 992 explonde.exe 5020 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1624 rundll32.exe 1660 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exez2603028.exez4765722.exez8957211.exez4221137.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z2603028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4765722.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z8957211.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z4221137.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q0203422.exer8527534.exes8002835.exedescription pid process target process PID 2584 set thread context of 3224 2584 q0203422.exe AppLaunch.exe PID 3728 set thread context of 1544 3728 r8527534.exe AppLaunch.exe PID 1812 set thread context of 4196 1812 s8002835.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3248 2584 WerFault.exe q0203422.exe 1928 3728 WerFault.exe r8527534.exe 4220 1544 WerFault.exe AppLaunch.exe 1340 1812 WerFault.exe s8002835.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 228 schtasks.exe 2924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3224 AppLaunch.exe 3224 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3224 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exez2603028.exez4765722.exez8957211.exez4221137.exeq0203422.exer8527534.exes8002835.exet9836849.exeu5357221.exeexplonde.exedescription pid process target process PID 4004 wrote to memory of 3820 4004 42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe z2603028.exe PID 4004 wrote to memory of 3820 4004 42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe z2603028.exe PID 4004 wrote to memory of 3820 4004 42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe z2603028.exe PID 3820 wrote to memory of 1604 3820 z2603028.exe z4765722.exe PID 3820 wrote to memory of 1604 3820 z2603028.exe z4765722.exe PID 3820 wrote to memory of 1604 3820 z2603028.exe z4765722.exe PID 1604 wrote to memory of 1556 1604 z4765722.exe z8957211.exe PID 1604 wrote to memory of 1556 1604 z4765722.exe z8957211.exe PID 1604 wrote to memory of 1556 1604 z4765722.exe z8957211.exe PID 1556 wrote to memory of 4164 1556 z8957211.exe z4221137.exe PID 1556 wrote to memory of 4164 1556 z8957211.exe z4221137.exe PID 1556 wrote to memory of 4164 1556 z8957211.exe z4221137.exe PID 4164 wrote to memory of 2584 4164 z4221137.exe q0203422.exe PID 4164 wrote to memory of 2584 4164 z4221137.exe q0203422.exe PID 4164 wrote to memory of 2584 4164 z4221137.exe q0203422.exe PID 2584 wrote to memory of 3224 2584 q0203422.exe AppLaunch.exe PID 2584 wrote to memory of 3224 2584 q0203422.exe AppLaunch.exe PID 2584 wrote to memory of 3224 2584 q0203422.exe AppLaunch.exe PID 2584 wrote to memory of 3224 2584 q0203422.exe AppLaunch.exe PID 2584 wrote to memory of 3224 2584 q0203422.exe AppLaunch.exe PID 2584 wrote to memory of 3224 2584 q0203422.exe AppLaunch.exe PID 2584 wrote to memory of 3224 2584 q0203422.exe AppLaunch.exe PID 2584 wrote to memory of 3224 2584 q0203422.exe AppLaunch.exe PID 4164 wrote to memory of 3728 4164 z4221137.exe r8527534.exe PID 4164 wrote to memory of 3728 4164 z4221137.exe r8527534.exe PID 4164 wrote to memory of 3728 4164 z4221137.exe r8527534.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 3728 wrote to memory of 1544 3728 r8527534.exe AppLaunch.exe PID 1556 wrote to memory of 1812 1556 z8957211.exe s8002835.exe PID 1556 wrote to memory of 1812 1556 z8957211.exe s8002835.exe PID 1556 wrote to memory of 1812 1556 z8957211.exe s8002835.exe PID 1812 wrote to memory of 4196 1812 s8002835.exe AppLaunch.exe PID 1812 wrote to memory of 4196 1812 s8002835.exe AppLaunch.exe PID 1812 wrote to memory of 4196 1812 s8002835.exe AppLaunch.exe PID 1812 wrote to memory of 4196 1812 s8002835.exe AppLaunch.exe PID 1812 wrote to memory of 4196 1812 s8002835.exe AppLaunch.exe PID 1812 wrote to memory of 4196 1812 s8002835.exe AppLaunch.exe PID 1812 wrote to memory of 4196 1812 s8002835.exe AppLaunch.exe PID 1812 wrote to memory of 4196 1812 s8002835.exe AppLaunch.exe PID 1604 wrote to memory of 660 1604 z4765722.exe t9836849.exe PID 1604 wrote to memory of 660 1604 z4765722.exe t9836849.exe PID 1604 wrote to memory of 660 1604 z4765722.exe t9836849.exe PID 660 wrote to memory of 1484 660 t9836849.exe explonde.exe PID 660 wrote to memory of 1484 660 t9836849.exe explonde.exe PID 660 wrote to memory of 1484 660 t9836849.exe explonde.exe PID 3820 wrote to memory of 4452 3820 z2603028.exe u5357221.exe PID 3820 wrote to memory of 4452 3820 z2603028.exe u5357221.exe PID 3820 wrote to memory of 4452 3820 z2603028.exe u5357221.exe PID 4452 wrote to memory of 4072 4452 u5357221.exe legota.exe PID 4452 wrote to memory of 4072 4452 u5357221.exe legota.exe PID 4452 wrote to memory of 4072 4452 u5357221.exe legota.exe PID 1484 wrote to memory of 228 1484 explonde.exe schtasks.exe PID 1484 wrote to memory of 228 1484 explonde.exe schtasks.exe PID 1484 wrote to memory of 228 1484 explonde.exe schtasks.exe PID 4004 wrote to memory of 5068 4004 42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe w0511289.exe PID 4004 wrote to memory of 5068 4004 42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe w0511289.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe"C:\Users\Admin\AppData\Local\Temp\42ed23c246987d8571ae0107d50cbf02e5b11e28d29691799c8f45043606b554_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2603028.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2603028.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4765722.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4765722.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8957211.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8957211.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4221137.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4221137.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0203422.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0203422.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 5927⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8527534.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8527534.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 5647⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8002835.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8002835.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 5646⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9836849.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9836849.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5357221.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5357221.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0511289.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0511289.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2584 -ip 25841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3728 -ip 37281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1544 -ip 15441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1812 -ip 18121⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0511289.exeFilesize
22KB
MD5538d45fa52914b33038ccb73f429a9ca
SHA13597c988f96ed5bc25e2b2f59103911f34a97796
SHA2567525ca548836c564a281fe2d1b7d4cdb856a8041530c279cfc04e1bb569f8166
SHA51234f74f889606402c6b287ca8510d93f66dc654cb9da91119ddd9c6302d7bb5f8896113051dc42a15110fbcd6476338d893950e329c7786291dc28db17c6ad473
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0511289.exeFilesize
22KB
MD5538d45fa52914b33038ccb73f429a9ca
SHA13597c988f96ed5bc25e2b2f59103911f34a97796
SHA2567525ca548836c564a281fe2d1b7d4cdb856a8041530c279cfc04e1bb569f8166
SHA51234f74f889606402c6b287ca8510d93f66dc654cb9da91119ddd9c6302d7bb5f8896113051dc42a15110fbcd6476338d893950e329c7786291dc28db17c6ad473
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2603028.exeFilesize
997KB
MD5047ba7c72e751b6e35bc1f541f0fdf81
SHA1112e5051f38f0049cd596e659237109d328a3be4
SHA256d29c661dbb475eefa8cf14881bdf248f4936a9bedb7e0f0c480e2c85abeec002
SHA5129cc38f983e9cb21d73110bda7c3ea4a8f7a244eb8378acf0d8d3e472d1c4bbdf77f396f5193ff3806bbdf4bdc3bedee4924dc69c4315799606ad036bd28660eb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2603028.exeFilesize
997KB
MD5047ba7c72e751b6e35bc1f541f0fdf81
SHA1112e5051f38f0049cd596e659237109d328a3be4
SHA256d29c661dbb475eefa8cf14881bdf248f4936a9bedb7e0f0c480e2c85abeec002
SHA5129cc38f983e9cb21d73110bda7c3ea4a8f7a244eb8378acf0d8d3e472d1c4bbdf77f396f5193ff3806bbdf4bdc3bedee4924dc69c4315799606ad036bd28660eb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5357221.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5357221.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4765722.exeFilesize
814KB
MD5ee679302dfe69020a013884f1581c6c7
SHA1ce29a5e0f791da5d85b240ecbf21e055b41c7cf2
SHA256fe5f949231aa369b5d604e04b9774596ef277a89e225fcb7362c8253935cbbec
SHA512c134e3d6276296226fece1ffe3de588d1237b32cd9a6926ccc6b6c866596b2864cdc2da8f01f9f2ba153dc6d5e670da0e5e120d08c9a178f6761f0b0ee57994c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4765722.exeFilesize
814KB
MD5ee679302dfe69020a013884f1581c6c7
SHA1ce29a5e0f791da5d85b240ecbf21e055b41c7cf2
SHA256fe5f949231aa369b5d604e04b9774596ef277a89e225fcb7362c8253935cbbec
SHA512c134e3d6276296226fece1ffe3de588d1237b32cd9a6926ccc6b6c866596b2864cdc2da8f01f9f2ba153dc6d5e670da0e5e120d08c9a178f6761f0b0ee57994c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9836849.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9836849.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8957211.exeFilesize
631KB
MD5801da039d7ba3e622adcb985b7e7d47e
SHA1ec1817d11150d4b0f4426947838b45e0a31d5fb0
SHA2569a7c23adc837c4539e0e0c0cd13eccd1efd3feb44c8c446fcb67dc55a1af9e4e
SHA512fc55bc0ce63e01d1c83dafdedc3944e855c6a02308651fb0f0c0b5ca9d96bf857fd666b23755c5671c20f8f1396ae3d7433f84aa425d45116262cb4bf70a9870
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8957211.exeFilesize
631KB
MD5801da039d7ba3e622adcb985b7e7d47e
SHA1ec1817d11150d4b0f4426947838b45e0a31d5fb0
SHA2569a7c23adc837c4539e0e0c0cd13eccd1efd3feb44c8c446fcb67dc55a1af9e4e
SHA512fc55bc0ce63e01d1c83dafdedc3944e855c6a02308651fb0f0c0b5ca9d96bf857fd666b23755c5671c20f8f1396ae3d7433f84aa425d45116262cb4bf70a9870
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8002835.exeFilesize
413KB
MD58b25924ee68e449bdd1632c14e7f85e8
SHA1600c8ce6d05c7ec79fe533f4a445d2a565417831
SHA256fb22ba5cdbbc0807efac8521f5509398eb067319e2355657d0357c95f3bb531c
SHA51265059cd7f7a863f8543dd115c22fd60948e5a6dccadbd1dcf0ce7a8925c844e9c8ce64e8e3f104f3c37f4c4b73b6d9aca9a9cb170d92fcfdf42b5d8fe4c85b21
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8002835.exeFilesize
413KB
MD58b25924ee68e449bdd1632c14e7f85e8
SHA1600c8ce6d05c7ec79fe533f4a445d2a565417831
SHA256fb22ba5cdbbc0807efac8521f5509398eb067319e2355657d0357c95f3bb531c
SHA51265059cd7f7a863f8543dd115c22fd60948e5a6dccadbd1dcf0ce7a8925c844e9c8ce64e8e3f104f3c37f4c4b73b6d9aca9a9cb170d92fcfdf42b5d8fe4c85b21
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4221137.exeFilesize
354KB
MD5831148e5ce0f2c6021268115a0bbdd7a
SHA1aeafa7d3e2bc3f0496c3819cbd008eba79fc9408
SHA2560ac695b178d7772924f826945b25f0dd2fb9efbef86eb11df953dd36f236fdaf
SHA51266812b95e986c5539958709c7bd4e05c63d8820b45f492acd13961fb650863775fc23ed25a0fa6ff96df0333f081373ea1f749b54bde16dc4a1dac61a6b1ec3a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4221137.exeFilesize
354KB
MD5831148e5ce0f2c6021268115a0bbdd7a
SHA1aeafa7d3e2bc3f0496c3819cbd008eba79fc9408
SHA2560ac695b178d7772924f826945b25f0dd2fb9efbef86eb11df953dd36f236fdaf
SHA51266812b95e986c5539958709c7bd4e05c63d8820b45f492acd13961fb650863775fc23ed25a0fa6ff96df0333f081373ea1f749b54bde16dc4a1dac61a6b1ec3a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0203422.exeFilesize
250KB
MD5a6787ad0e90d4214aaa1a1a9a79d37e0
SHA1dce1b8200e7d259a67a09f68a86b8fbde73c72e7
SHA2563e1e5e8b608da841b8acf25ccdb48b652ee10bedffd301a11aa7a485f4c684f9
SHA51203a30c9795b9bdc12ad6d720c8e7e5cb3e16c2940e9cbe61f95246832112e9c63fbd09df305af332a50f409d391fa95283201dbd7702ca6784707c532e729a3e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0203422.exeFilesize
250KB
MD5a6787ad0e90d4214aaa1a1a9a79d37e0
SHA1dce1b8200e7d259a67a09f68a86b8fbde73c72e7
SHA2563e1e5e8b608da841b8acf25ccdb48b652ee10bedffd301a11aa7a485f4c684f9
SHA51203a30c9795b9bdc12ad6d720c8e7e5cb3e16c2940e9cbe61f95246832112e9c63fbd09df305af332a50f409d391fa95283201dbd7702ca6784707c532e729a3e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8527534.exeFilesize
379KB
MD506a4f8ea35a8a9658a0a5a2e5dcd03f7
SHA1d8b6a1d006b52fe905cb4811a4e4858df300d5d6
SHA256c8ad6246704cf5a68fae6f95b64608fca0f4cf100a1b2b614731aa80ee77a3ae
SHA5129926e361387b5775e7176e31a96d59b5406713e33de9851b38cf5ee9acd8b55c654555a2ea7d0d177ca4560bf44ba1243d55c20926f093aa0de050596f97c64f
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8527534.exeFilesize
379KB
MD506a4f8ea35a8a9658a0a5a2e5dcd03f7
SHA1d8b6a1d006b52fe905cb4811a4e4858df300d5d6
SHA256c8ad6246704cf5a68fae6f95b64608fca0f4cf100a1b2b614731aa80ee77a3ae
SHA5129926e361387b5775e7176e31a96d59b5406713e33de9851b38cf5ee9acd8b55c654555a2ea7d0d177ca4560bf44ba1243d55c20926f093aa0de050596f97c64f
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1544-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1544-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1544-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1544-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3224-45-0x00000000741F0000-0x00000000749A0000-memory.dmpFilesize
7.7MB
-
memory/3224-36-0x00000000741F0000-0x00000000749A0000-memory.dmpFilesize
7.7MB
-
memory/3224-47-0x00000000741F0000-0x00000000749A0000-memory.dmpFilesize
7.7MB
-
memory/3224-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4196-64-0x00000000051E0000-0x00000000051F2000-memory.dmpFilesize
72KB
-
memory/4196-53-0x0000000073D60000-0x0000000074510000-memory.dmpFilesize
7.7MB
-
memory/4196-69-0x00000000057F0000-0x000000000582C000-memory.dmpFilesize
240KB
-
memory/4196-89-0x0000000005240000-0x0000000005250000-memory.dmpFilesize
64KB
-
memory/4196-63-0x0000000005240000-0x0000000005250000-memory.dmpFilesize
64KB
-
memory/4196-62-0x0000000005560000-0x000000000566A000-memory.dmpFilesize
1.0MB
-
memory/4196-61-0x0000000005A70000-0x0000000006088000-memory.dmpFilesize
6.1MB
-
memory/4196-87-0x0000000005830000-0x000000000587C000-memory.dmpFilesize
304KB
-
memory/4196-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4196-55-0x0000000000FB0000-0x0000000000FB6000-memory.dmpFilesize
24KB
-
memory/4196-54-0x0000000073D60000-0x0000000074510000-memory.dmpFilesize
7.7MB