Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2023 03:45
Static task
static1
Behavioral task
behavioral1
Sample
ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe
Resource
win10v2004-20230703-en
General
-
Target
ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe
-
Size
389KB
-
MD5
0eedb36299b566813249c3236d616b15
-
SHA1
8ec8fb8b5b6593d7456942fd4ae846f8c0f54033
-
SHA256
ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d
-
SHA512
d4213fad54c7dde356419c719040c1d85fcf8b270d3bae0564fee2c79184488177f2543b500448aa94d40896eecc27b044fe8d140cda21c869b388fdd45db546
-
SSDEEP
6144:Kry+bnr+Hp0yN90QE7eigl9HUP4+jww3xgejXOzCrW7Eb8kjk8U4Xk+JVI:1MrXy90deiFJVmejX7RYX8Uo1I
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
zahar
77.91.68.56:19071
-
auth_value
94c55a31fcf1761f07eeb4a0c6fb74fa
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00060000000231fc-158.dat healer behavioral1/files/0x00060000000231fc-159.dat healer behavioral1/memory/1924-160-0x0000000000EE0000-0x0000000000EEA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h8454195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h8454195.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h8454195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h8454195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h8454195.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h8454195.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation danke.exe Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation g7981981.exe -
Executes dropped EXE 8 IoCs
pid Process 3896 x4860188.exe 1060 g7981981.exe 956 danke.exe 1924 h8454195.exe 3932 j2576106.exe 4800 danke.exe 3204 danke.exe 1336 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 1668 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h8454195.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x4860188.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x4860188.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2356 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1924 h8454195.exe 1924 h8454195.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1924 h8454195.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1060 g7981981.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 3812 wrote to memory of 3896 3812 ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe 85 PID 3812 wrote to memory of 3896 3812 ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe 85 PID 3812 wrote to memory of 3896 3812 ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe 85 PID 3896 wrote to memory of 1060 3896 x4860188.exe 86 PID 3896 wrote to memory of 1060 3896 x4860188.exe 86 PID 3896 wrote to memory of 1060 3896 x4860188.exe 86 PID 1060 wrote to memory of 956 1060 g7981981.exe 87 PID 1060 wrote to memory of 956 1060 g7981981.exe 87 PID 1060 wrote to memory of 956 1060 g7981981.exe 87 PID 3896 wrote to memory of 1924 3896 x4860188.exe 88 PID 3896 wrote to memory of 1924 3896 x4860188.exe 88 PID 956 wrote to memory of 2356 956 danke.exe 89 PID 956 wrote to memory of 2356 956 danke.exe 89 PID 956 wrote to memory of 2356 956 danke.exe 89 PID 956 wrote to memory of 640 956 danke.exe 91 PID 956 wrote to memory of 640 956 danke.exe 91 PID 956 wrote to memory of 640 956 danke.exe 91 PID 640 wrote to memory of 436 640 cmd.exe 93 PID 640 wrote to memory of 436 640 cmd.exe 93 PID 640 wrote to memory of 436 640 cmd.exe 93 PID 640 wrote to memory of 5076 640 cmd.exe 94 PID 640 wrote to memory of 5076 640 cmd.exe 94 PID 640 wrote to memory of 5076 640 cmd.exe 94 PID 640 wrote to memory of 3964 640 cmd.exe 95 PID 640 wrote to memory of 3964 640 cmd.exe 95 PID 640 wrote to memory of 3964 640 cmd.exe 95 PID 640 wrote to memory of 1108 640 cmd.exe 96 PID 640 wrote to memory of 1108 640 cmd.exe 96 PID 640 wrote to memory of 1108 640 cmd.exe 96 PID 640 wrote to memory of 2632 640 cmd.exe 97 PID 640 wrote to memory of 2632 640 cmd.exe 97 PID 640 wrote to memory of 2632 640 cmd.exe 97 PID 640 wrote to memory of 4516 640 cmd.exe 98 PID 640 wrote to memory of 4516 640 cmd.exe 98 PID 640 wrote to memory of 4516 640 cmd.exe 98 PID 3812 wrote to memory of 3932 3812 ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe 103 PID 3812 wrote to memory of 3932 3812 ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe 103 PID 3812 wrote to memory of 3932 3812 ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe 103 PID 956 wrote to memory of 1668 956 danke.exe 109 PID 956 wrote to memory of 1668 956 danke.exe 109 PID 956 wrote to memory of 1668 956 danke.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe"C:\Users\Admin\AppData\Local\Temp\ac5a626a46354c382955a77b42b04f87c7b21dc1ae80c439c0d361ba4619a33d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4860188.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4860188.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7981981.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7981981.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:2356
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:436
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:5076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:3964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1108
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:2632
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:4516
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1668
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8454195.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8454195.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2576106.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2576106.exe2⤵
- Executes dropped EXE
PID:3932
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4800
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:3204
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:1336
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
174KB
MD56b9209a74fe707b8458e59c2a357a9f2
SHA18556d2b178e801fbde0399899d9bec6568718baf
SHA25687ebf848cc07a1914fa6767f51ec6a5017b28622dc400c89d2bb1b6ec7ddb32f
SHA5127ae44edad8765cce3579a6c1b0f3a7c870fbb7f4dacbf55fec0f83392a683e5da678a038da847c92249ffea7754667b170279c966d1b8c38531ddbf71b86c2aa
-
Filesize
174KB
MD56b9209a74fe707b8458e59c2a357a9f2
SHA18556d2b178e801fbde0399899d9bec6568718baf
SHA25687ebf848cc07a1914fa6767f51ec6a5017b28622dc400c89d2bb1b6ec7ddb32f
SHA5127ae44edad8765cce3579a6c1b0f3a7c870fbb7f4dacbf55fec0f83392a683e5da678a038da847c92249ffea7754667b170279c966d1b8c38531ddbf71b86c2aa
-
Filesize
234KB
MD5189473d6d648c76097359d03b68f2724
SHA189ed0a12b376bb7d80eb1ac841a3f9e1b2786b8a
SHA2568e3aa645311e63757fc95245d474434c70861c440db5d173d6db9693f033399d
SHA512c5980fa4c461088e88fa772db6b066cc4812e12f4fb9837deed5b71e2d12e60c72fb0abe9b1ff9906399402a43634acecf67ea43c2b86c782babd9935b0d137e
-
Filesize
234KB
MD5189473d6d648c76097359d03b68f2724
SHA189ed0a12b376bb7d80eb1ac841a3f9e1b2786b8a
SHA2568e3aa645311e63757fc95245d474434c70861c440db5d173d6db9693f033399d
SHA512c5980fa4c461088e88fa772db6b066cc4812e12f4fb9837deed5b71e2d12e60c72fb0abe9b1ff9906399402a43634acecf67ea43c2b86c782babd9935b0d137e
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59