Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 17:43
Static task
static1
Behavioral task
behavioral1
Sample
a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe
Resource
win10v2004-20230703-en
General
-
Target
a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe
-
Size
390KB
-
MD5
6f6b129948a313fa52a5fa29afab8d9a
-
SHA1
e6e75d06359660ed6972eb853ec4f1d9f2494e95
-
SHA256
a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84
-
SHA512
33bd9b65fe1946a99dd84b3532d1c694636b36593863d91127965ed104979dc3a35a4927125f091918c57801abc75de201b9c17a0fa465f6206baf06c6f0e48a
-
SSDEEP
12288:3MrGy904k9KzMkB6suwkohbTcHnl9G9ON:1yRaIMrsdkYAHi9ON
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x0009000000023211-145.dat healer behavioral1/files/0x0009000000023211-146.dat healer behavioral1/memory/3884-147-0x0000000000BA0000-0x0000000000BAA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k9086194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k9086194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k9086194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k9086194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k9086194.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k9086194.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation l3221701.exe Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 8 IoCs
pid Process 4304 y4497750.exe 3884 k9086194.exe 3112 l3221701.exe 4392 danke.exe 2312 n3168008.exe 2484 danke.exe 3984 danke.exe 2020 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 868 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k9086194.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y4497750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y4497750.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4908 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3884 k9086194.exe 3884 k9086194.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3884 k9086194.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3112 l3221701.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 556 wrote to memory of 4304 556 a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe 84 PID 556 wrote to memory of 4304 556 a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe 84 PID 556 wrote to memory of 4304 556 a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe 84 PID 4304 wrote to memory of 3884 4304 y4497750.exe 86 PID 4304 wrote to memory of 3884 4304 y4497750.exe 86 PID 4304 wrote to memory of 3112 4304 y4497750.exe 91 PID 4304 wrote to memory of 3112 4304 y4497750.exe 91 PID 4304 wrote to memory of 3112 4304 y4497750.exe 91 PID 3112 wrote to memory of 4392 3112 l3221701.exe 92 PID 3112 wrote to memory of 4392 3112 l3221701.exe 92 PID 3112 wrote to memory of 4392 3112 l3221701.exe 92 PID 556 wrote to memory of 2312 556 a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe 93 PID 556 wrote to memory of 2312 556 a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe 93 PID 556 wrote to memory of 2312 556 a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe 93 PID 4392 wrote to memory of 4908 4392 danke.exe 94 PID 4392 wrote to memory of 4908 4392 danke.exe 94 PID 4392 wrote to memory of 4908 4392 danke.exe 94 PID 4392 wrote to memory of 3264 4392 danke.exe 96 PID 4392 wrote to memory of 3264 4392 danke.exe 96 PID 4392 wrote to memory of 3264 4392 danke.exe 96 PID 3264 wrote to memory of 3204 3264 cmd.exe 98 PID 3264 wrote to memory of 3204 3264 cmd.exe 98 PID 3264 wrote to memory of 3204 3264 cmd.exe 98 PID 3264 wrote to memory of 1316 3264 cmd.exe 99 PID 3264 wrote to memory of 1316 3264 cmd.exe 99 PID 3264 wrote to memory of 1316 3264 cmd.exe 99 PID 3264 wrote to memory of 4748 3264 cmd.exe 100 PID 3264 wrote to memory of 4748 3264 cmd.exe 100 PID 3264 wrote to memory of 4748 3264 cmd.exe 100 PID 3264 wrote to memory of 2176 3264 cmd.exe 101 PID 3264 wrote to memory of 2176 3264 cmd.exe 101 PID 3264 wrote to memory of 2176 3264 cmd.exe 101 PID 3264 wrote to memory of 3740 3264 cmd.exe 102 PID 3264 wrote to memory of 3740 3264 cmd.exe 102 PID 3264 wrote to memory of 3740 3264 cmd.exe 102 PID 3264 wrote to memory of 1352 3264 cmd.exe 103 PID 3264 wrote to memory of 1352 3264 cmd.exe 103 PID 3264 wrote to memory of 1352 3264 cmd.exe 103 PID 4392 wrote to memory of 868 4392 danke.exe 111 PID 4392 wrote to memory of 868 4392 danke.exe 111 PID 4392 wrote to memory of 868 4392 danke.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe"C:\Users\Admin\AppData\Local\Temp\a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4497750.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4497750.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9086194.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9086194.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3221701.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3221701.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:4908
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3204
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:1316
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:4748
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2176
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:3740
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:1352
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:868
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3168008.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3168008.exe2⤵
- Executes dropped EXE
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:3984
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
173KB
MD5d2c139b9404055c46938b2284a8d055c
SHA197e61929f30d479295f898b31da1d02c2061dbbd
SHA2567c3b9277d763519314b0057e02e9eab74aa8dda72a97d6d85879ec34a71bdefe
SHA51232bc5be53b4b149be240077c80d0386f8d4a2386dc8158717ce43fe0bfb30bff1ee2299d705f39337f8e3ec52d514153c961e610b9ddc5e329748c43e28df642
-
Filesize
173KB
MD5d2c139b9404055c46938b2284a8d055c
SHA197e61929f30d479295f898b31da1d02c2061dbbd
SHA2567c3b9277d763519314b0057e02e9eab74aa8dda72a97d6d85879ec34a71bdefe
SHA51232bc5be53b4b149be240077c80d0386f8d4a2386dc8158717ce43fe0bfb30bff1ee2299d705f39337f8e3ec52d514153c961e610b9ddc5e329748c43e28df642
-
Filesize
235KB
MD59a022d4014886e1f3340c275f308b337
SHA128c9d5bceb642e7a841659ec9b9f9319596df57b
SHA256cf9d1ac3283355aa6446c0dc6b2dad8a96bc1ca7d14ba92f20965a3e24564976
SHA512000f7ef072b080677ccf78a9f860b8ac81eea05e056b49e8a17bc6b67bfbaf205022d7fb0831e7d5451e63cbc1154809b10e143345cfc62f11dd13fd1a35c484
-
Filesize
235KB
MD59a022d4014886e1f3340c275f308b337
SHA128c9d5bceb642e7a841659ec9b9f9319596df57b
SHA256cf9d1ac3283355aa6446c0dc6b2dad8a96bc1ca7d14ba92f20965a3e24564976
SHA512000f7ef072b080677ccf78a9f860b8ac81eea05e056b49e8a17bc6b67bfbaf205022d7fb0831e7d5451e63cbc1154809b10e143345cfc62f11dd13fd1a35c484
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59