healer | 7d60632999cb7a025661ce9308e40c8cf9d5acdb17a2faacdf1cd2c51c0c4043

Analysis

max time kernel
234s
max time network
260s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 14:11 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d60632999cb7a025661ce9308e40c8cf9d5acdb17a2faacdf1cd2c51c0c4043.exe
Size

1.1MB
MD5

54f152f5296eec04ed5cfe40627d606d
SHA1

9c9f45ae31f4136dddaa3886afcf61faf7bb1e91
SHA256

7d60632999cb7a025661ce9308e40c8cf9d5acdb17a2faacdf1cd2c51c0c4043
SHA512

48a9e96238b6b0507fa79b315b3817e571dcfe2e97654b8944af552392324e238528da0c8de0bde2121deea248d1c3e9215a725e2a7cea4516f3d520e73224e9
SSDEEP

24576:Gy5DWX7JB6LVnOw5BToTLUGyHlNqXLenS4BV3yht2UMlDIsqAAsoa4G:V5DWX7JB6ROw5R8IGyFSnWV31LlDKI4

Score

10^/10

healer mystic redline darts dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

darts

77.91.124.82:19071

Attributes

auth_value
3c8818da7045365845f15ec0946ebf11

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/3752-40-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3752-41-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3752-42-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3752-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/1140-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 7 IoCs

pid	Process
3948	z6486854.exe
1144	z2938382.exe
3804	z6949175.exe
5036	z6957121.exe
1868	q3290162.exe
2404	r3369821.exe
4872	s6718841.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7d60632999cb7a025661ce9308e40c8cf9d5acdb17a2faacdf1cd2c51c0c4043.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6486854.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2938382.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6949175.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z6957121.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 1140	1868	q3290162.exe	92
PID 2404 set thread context of 3752	2404	r3369821.exe	95
PID 4872 set thread context of 4412	4872	s6718841.exe	104

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5084	2404	WerFault.exe	94
2396	3752	WerFault.exe	95
3824	4872	WerFault.exe	102

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1140	AppLaunch.exe
1140	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	AppLaunch.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3948	4908	7d60632999cb7a025661ce9308e40c8cf9d5acdb17a2faacdf1cd2c51c0c4043.exe	79
PID 4908 wrote to memory of 3948	4908	7d60632999cb7a025661ce9308e40c8cf9d5acdb17a2faacdf1cd2c51c0c4043.exe	79
PID 4908 wrote to memory of 3948	4908	7d60632999cb7a025661ce9308e40c8cf9d5acdb17a2faacdf1cd2c51c0c4043.exe	79
PID 3948 wrote to memory of 1144	3948	z6486854.exe	83
PID 3948 wrote to memory of 1144	3948	z6486854.exe	83
PID 3948 wrote to memory of 1144	3948	z6486854.exe	83
PID 1144 wrote to memory of 3804	1144	z2938382.exe	86
PID 1144 wrote to memory of 3804	1144	z2938382.exe	86
PID 1144 wrote to memory of 3804	1144	z2938382.exe	86
PID 3804 wrote to memory of 5036	3804	z6949175.exe	88
PID 3804 wrote to memory of 5036	3804	z6949175.exe	88
PID 3804 wrote to memory of 5036	3804	z6949175.exe	88
PID 5036 wrote to memory of 1868	5036	z6957121.exe	89
PID 5036 wrote to memory of 1868	5036	z6957121.exe	89
PID 5036 wrote to memory of 1868	5036	z6957121.exe	89
PID 1868 wrote to memory of 1140	1868	q3290162.exe	92
PID 1868 wrote to memory of 1140	1868	q3290162.exe	92
PID 1868 wrote to memory of 1140	1868	q3290162.exe	92
PID 1868 wrote to memory of 1140	1868	q3290162.exe	92
PID 1868 wrote to memory of 1140	1868	q3290162.exe	92
PID 1868 wrote to memory of 1140	1868	q3290162.exe	92
PID 1868 wrote to memory of 1140	1868	q3290162.exe	92
PID 1868 wrote to memory of 1140	1868	q3290162.exe	92
PID 5036 wrote to memory of 2404	5036	z6957121.exe	94
PID 5036 wrote to memory of 2404	5036	z6957121.exe	94
PID 5036 wrote to memory of 2404	5036	z6957121.exe	94
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 2404 wrote to memory of 3752	2404	r3369821.exe	95
PID 3804 wrote to memory of 4872	3804	z6949175.exe	102
PID 3804 wrote to memory of 4872	3804	z6949175.exe	102
PID 3804 wrote to memory of 4872	3804	z6949175.exe	102
PID 4872 wrote to memory of 4608	4872	s6718841.exe	103
PID 4872 wrote to memory of 4608	4872	s6718841.exe	103
PID 4872 wrote to memory of 4608	4872	s6718841.exe	103
PID 4872 wrote to memory of 4412	4872	s6718841.exe	104
PID 4872 wrote to memory of 4412	4872	s6718841.exe	104
PID 4872 wrote to memory of 4412	4872	s6718841.exe	104
PID 4872 wrote to memory of 4412	4872	s6718841.exe	104
PID 4872 wrote to memory of 4412	4872	s6718841.exe	104
PID 4872 wrote to memory of 4412	4872	s6718841.exe	104
PID 4872 wrote to memory of 4412	4872	s6718841.exe	104
PID 4872 wrote to memory of 4412	4872	s6718841.exe	104

C:\Users\Admin\AppData\Local\Temp\7d60632999cb7a025661ce9308e40c8cf9d5acdb17a2faacdf1cd2c51c0c4043.exe
"C:\Users\Admin\AppData\Local\Temp\7d60632999cb7a025661ce9308e40c8cf9d5acdb17a2faacdf1cd2c51c0c4043.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6486854.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6486854.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2938382.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2938382.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6949175.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6949175.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6957121.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6957121.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3290162.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3290162.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3369821.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3369821.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 540
        8⤵
        Program crash
        
        PID:2396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 564
        7⤵
        Program crash
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6718841.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6718841.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4872
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4608
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 584
        6⤵
        Program crash
        
        PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2404 -ip 2404
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3752 -ip 3752
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4872 -ip 4872
1⤵
PID:1848

Network

DNS

2.136.104.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.136.104.51.in-addr.arpa

IN PTR

Response
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

254.7.248.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

254.7.248.8.in-addr.arpa

IN PTR

Response
DNS

13.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.173.189.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

133.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.32.126.40.in-addr.arpa

IN PTR

Response
DNS

26.35.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.35.223.20.in-addr.arpa

IN PTR

Response
DNS

9.228.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.228.82.20.in-addr.arpa

IN PTR

Response
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

240.81.21.72.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.81.21.72.in-addr.arpa

IN PTR

Response
DNS

126.177.238.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

126.177.238.8.in-addr.arpa

IN PTR

Response
DNS

126.177.238.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

126.177.238.8.in-addr.arpa

IN PTR
DNS

126.177.238.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

126.177.238.8.in-addr.arpa

IN PTR
DNS

126.177.238.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

126.177.238.8.in-addr.arpa

IN PTR
DNS

29.81.57.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

29.81.57.23.in-addr.arpa

IN PTR

Response

29.81.57.23.in-addr.arpa

IN PTR

a23-57-81-29deploystaticakamaitechnologiescom

No results found

8.8.8.8:53

2.136.104.51.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

2.136.104.51.in-addr.arpa
8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

254.7.248.8.in-addr.arpa

dns

70 B
124 B
1
1

DNS Request

254.7.248.8.in-addr.arpa
8.8.8.8:53

13.173.189.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.173.189.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

133.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

133.32.126.40.in-addr.arpa
8.8.8.8:53

26.35.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

26.35.223.20.in-addr.arpa
8.8.8.8:53

9.228.82.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

9.228.82.20.in-addr.arpa
8.8.8.8:53

26.165.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

26.165.165.52.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

240.81.21.72.in-addr.arpa

dns

71 B
142 B
1
1

DNS Request

240.81.21.72.in-addr.arpa
8.8.8.8:53

126.177.238.8.in-addr.arpa

dns

288 B
126 B
4
1

DNS Request

126.177.238.8.in-addr.arpa

DNS Request

126.177.238.8.in-addr.arpa

DNS Request

126.177.238.8.in-addr.arpa

DNS Request

126.177.238.8.in-addr.arpa
8.8.8.8:53

29.81.57.23.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

29.81.57.23.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6486854.exe

Filesize
997KB

MD5
6700977bfca99753c0271817944aa239

SHA1
0de68561874c6c8c423e7daffdb3a4b5cef5cca5

SHA256
c9ace4fd8457303ad9bcb4dcfca4e59aca88b1a1df8add7e6a0a35101899bf90

SHA512
00a25527ed46e6eae680f806ee3813dd9c7ebb0d66794bedef1afe0249f10eaf35262be4bececa559eec385820f6490a4fc14ed69c55d58e35fc327d92bc05ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6486854.exe

Filesize
997KB

MD5
6700977bfca99753c0271817944aa239

SHA1
0de68561874c6c8c423e7daffdb3a4b5cef5cca5

SHA256
c9ace4fd8457303ad9bcb4dcfca4e59aca88b1a1df8add7e6a0a35101899bf90

SHA512
00a25527ed46e6eae680f806ee3813dd9c7ebb0d66794bedef1afe0249f10eaf35262be4bececa559eec385820f6490a4fc14ed69c55d58e35fc327d92bc05ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2938382.exe

Filesize
814KB

MD5
7fba175670ba0f22703a1ba15da39a8c

SHA1
466b4403289132f28ffe4df84f2bc29d4710e815

SHA256
7bc37a3e0fcef8c16a69d57b83a84de405d68f25365de5f6dc20e79e22390f6b

SHA512
fa00418d3da06f0a5a7f18ee619fa5ba2014f12a834aa489f20313d064eb275525b8479a9697776963ae83f78549d59cd3d33251a0bf21daa118a6be28f08b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2938382.exe

Filesize
814KB

MD5
7fba175670ba0f22703a1ba15da39a8c

SHA1
466b4403289132f28ffe4df84f2bc29d4710e815

SHA256
7bc37a3e0fcef8c16a69d57b83a84de405d68f25365de5f6dc20e79e22390f6b

SHA512
fa00418d3da06f0a5a7f18ee619fa5ba2014f12a834aa489f20313d064eb275525b8479a9697776963ae83f78549d59cd3d33251a0bf21daa118a6be28f08b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6949175.exe

Filesize
631KB

MD5
e618bae2e4681fd09971ce9f44fb89d7

SHA1
07a46f2f27cb8c2c3c772fd4005e8221ab3cda82

SHA256
1f5f90eb1f49ceba726fb280a149cddb5ad4f25fc9ea0a43c7246d42ce261e9c

SHA512
514ee5473c227f1b0df91cc51b8f68bca1250df6d3913e40577f0c0ee01aaa2056a13bf54fa7fb016215b893bc8f3eba2e3732239730ba53c7a7158537536d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6949175.exe

Filesize
631KB

MD5
e618bae2e4681fd09971ce9f44fb89d7

SHA1
07a46f2f27cb8c2c3c772fd4005e8221ab3cda82

SHA256
1f5f90eb1f49ceba726fb280a149cddb5ad4f25fc9ea0a43c7246d42ce261e9c

SHA512
514ee5473c227f1b0df91cc51b8f68bca1250df6d3913e40577f0c0ee01aaa2056a13bf54fa7fb016215b893bc8f3eba2e3732239730ba53c7a7158537536d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6718841.exe

Filesize
413KB

MD5
b14f3d77c5dd8fcff03e09c2e662ae51

SHA1
fe31048e96ed21eb2e4819532956354b77397c80

SHA256
07c100b5173c0820cd6522671f56c74e1dd124b35c4574dc5c0e9abec6c6ff3d

SHA512
6dc692340677c6e67004cf9ebd29cb280eca9b86eae362b7d7bc254a77a646b0daa80863f21976fc3c93d8ab1b723467ddd5c127e2f016ddd24d4fa9eba64ba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6718841.exe

Filesize
413KB

MD5
b14f3d77c5dd8fcff03e09c2e662ae51

SHA1
fe31048e96ed21eb2e4819532956354b77397c80

SHA256
07c100b5173c0820cd6522671f56c74e1dd124b35c4574dc5c0e9abec6c6ff3d

SHA512
6dc692340677c6e67004cf9ebd29cb280eca9b86eae362b7d7bc254a77a646b0daa80863f21976fc3c93d8ab1b723467ddd5c127e2f016ddd24d4fa9eba64ba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6957121.exe

Filesize
354KB

MD5
0aed5ae6b1e723b671360b276039d8ac

SHA1
120f8db08f195e6e28bf41f93428bb5047aafab9

SHA256
a9d0066c5bf5f05248d8666ebce33a7549379f3234d9b5ddcf78e2f9fab1658f

SHA512
affbd6a3cff8108abf7a83d3391de988a012e6e7da3344c4fd89c72a9ea877449a89b135cb302cf0e87156fc240695e8b5c1753ac0860c6686f4751561dc2a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6957121.exe

Filesize
354KB

MD5
0aed5ae6b1e723b671360b276039d8ac

SHA1
120f8db08f195e6e28bf41f93428bb5047aafab9

SHA256
a9d0066c5bf5f05248d8666ebce33a7549379f3234d9b5ddcf78e2f9fab1658f

SHA512
affbd6a3cff8108abf7a83d3391de988a012e6e7da3344c4fd89c72a9ea877449a89b135cb302cf0e87156fc240695e8b5c1753ac0860c6686f4751561dc2a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3290162.exe

Filesize
250KB

MD5
6e7d82b81b53bf617ca01f9ea909e5ba

SHA1
86280d7943ca3fbcc0e2e5ce535aa632e8534eef

SHA256
bdc3ea8b3747acd33405f0d9a8889372251af746132dd13d3f7fc3ae93e8c05c

SHA512
816b6f42333642412ab1e9ca04b6712ebf037ac69440410d32a8d53033d1694ebf9e026184005c75da5ed5cd7d2295a3b5121248eba154e8662646c88b16ef2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3290162.exe

Filesize
250KB

MD5
6e7d82b81b53bf617ca01f9ea909e5ba

SHA1
86280d7943ca3fbcc0e2e5ce535aa632e8534eef

SHA256
bdc3ea8b3747acd33405f0d9a8889372251af746132dd13d3f7fc3ae93e8c05c

SHA512
816b6f42333642412ab1e9ca04b6712ebf037ac69440410d32a8d53033d1694ebf9e026184005c75da5ed5cd7d2295a3b5121248eba154e8662646c88b16ef2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3369821.exe

Filesize
379KB

MD5
8e363a1912d25cef180c54846648abd5

SHA1
c9a238ea6ca27085aabd381595aff534fa93758a

SHA256
9e00622d8ed5819bb618d170eee6590b82cea38b3f1cde0bc405298349029682

SHA512
ba3d0c89b2575a7293e7b75e0d47959e0bda0b3beed1131fd426606057e398125e8b390ca013a7530ff133970a684b7b4d5d62a94737b19e06b1edc4efa4cedf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3369821.exe

Filesize
379KB

MD5
8e363a1912d25cef180c54846648abd5

SHA1
c9a238ea6ca27085aabd381595aff534fa93758a

SHA256
9e00622d8ed5819bb618d170eee6590b82cea38b3f1cde0bc405298349029682

SHA512
ba3d0c89b2575a7293e7b75e0d47959e0bda0b3beed1131fd426606057e398125e8b390ca013a7530ff133970a684b7b4d5d62a94737b19e06b1edc4efa4cedf

Download Submit
memory/1140-45-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1140-47-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1140-39-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1140-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3752-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3752-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3752-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3752-40-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4412-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4412-53-0x0000000074150000-0x0000000074900000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.