Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2023, 20:02
Static task
static1
Behavioral task
behavioral1
Sample
0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe
Resource
win10v2004-20230703-en
General
-
Target
0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe
-
Size
390KB
-
MD5
a58eecf981d228b1ac1c4bca4f1dab6c
-
SHA1
5a8085b67ed207c635523d9e95cbb2d49fda81dc
-
SHA256
0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb
-
SHA512
be90f27f24ba44c6dcd4ff2b355b139491c4175c1bcecce5b1c146df0e3d91019f915868e0b919bf333ad52c8d86ace407012997cbcf9faf2797fb15741cf42d
-
SSDEEP
6144:KPy+bnr+op0yN90QEej1iCVPThXnkzMilvmBHT+5Yd7Z9dtWAu/fv0:NMrMy90AjIwPtXn7+vmBFX9dk3fv0
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x0006000000023229-158.dat healer behavioral1/files/0x0006000000023229-159.dat healer behavioral1/memory/1620-160-0x0000000000350000-0x000000000035A000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h8766648.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h8766648.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h8766648.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h8766648.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h8766648.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h8766648.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation g8630973.exe Key value queried \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 7 IoCs
pid Process 864 x5086023.exe 4868 g8630973.exe 4468 danke.exe 1620 h8766648.exe 3724 j0070136.exe 5116 danke.exe 3804 danke.exe -
Loads dropped DLL 1 IoCs
pid Process 3576 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h8766648.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x5086023.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x5086023.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3968 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1620 h8766648.exe 1620 h8766648.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1620 h8766648.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4868 g8630973.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 724 wrote to memory of 864 724 0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe 86 PID 724 wrote to memory of 864 724 0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe 86 PID 724 wrote to memory of 864 724 0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe 86 PID 864 wrote to memory of 4868 864 x5086023.exe 87 PID 864 wrote to memory of 4868 864 x5086023.exe 87 PID 864 wrote to memory of 4868 864 x5086023.exe 87 PID 4868 wrote to memory of 4468 4868 g8630973.exe 88 PID 4868 wrote to memory of 4468 4868 g8630973.exe 88 PID 4868 wrote to memory of 4468 4868 g8630973.exe 88 PID 864 wrote to memory of 1620 864 x5086023.exe 89 PID 864 wrote to memory of 1620 864 x5086023.exe 89 PID 4468 wrote to memory of 3968 4468 danke.exe 90 PID 4468 wrote to memory of 3968 4468 danke.exe 90 PID 4468 wrote to memory of 3968 4468 danke.exe 90 PID 4468 wrote to memory of 1280 4468 danke.exe 92 PID 4468 wrote to memory of 1280 4468 danke.exe 92 PID 4468 wrote to memory of 1280 4468 danke.exe 92 PID 1280 wrote to memory of 2168 1280 cmd.exe 94 PID 1280 wrote to memory of 2168 1280 cmd.exe 94 PID 1280 wrote to memory of 2168 1280 cmd.exe 94 PID 1280 wrote to memory of 4464 1280 cmd.exe 95 PID 1280 wrote to memory of 4464 1280 cmd.exe 95 PID 1280 wrote to memory of 4464 1280 cmd.exe 95 PID 1280 wrote to memory of 1204 1280 cmd.exe 96 PID 1280 wrote to memory of 1204 1280 cmd.exe 96 PID 1280 wrote to memory of 1204 1280 cmd.exe 96 PID 1280 wrote to memory of 732 1280 cmd.exe 97 PID 1280 wrote to memory of 732 1280 cmd.exe 97 PID 1280 wrote to memory of 732 1280 cmd.exe 97 PID 1280 wrote to memory of 4416 1280 cmd.exe 98 PID 1280 wrote to memory of 4416 1280 cmd.exe 98 PID 1280 wrote to memory of 4416 1280 cmd.exe 98 PID 1280 wrote to memory of 2600 1280 cmd.exe 99 PID 1280 wrote to memory of 2600 1280 cmd.exe 99 PID 1280 wrote to memory of 2600 1280 cmd.exe 99 PID 724 wrote to memory of 3724 724 0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe 104 PID 724 wrote to memory of 3724 724 0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe 104 PID 724 wrote to memory of 3724 724 0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe 104 PID 4468 wrote to memory of 3576 4468 danke.exe 119 PID 4468 wrote to memory of 3576 4468 danke.exe 119 PID 4468 wrote to memory of 3576 4468 danke.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe"C:\Users\Admin\AppData\Local\Temp\0f8922cf78c7910a56bf32b91e4142f9f033364edb64fb5c07b63e3ee6aaadcb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5086023.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5086023.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g8630973.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g8630973.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:3968
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2168
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:4464
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:1204
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:732
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:4416
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:2600
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3576
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8766648.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8766648.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0070136.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0070136.exe2⤵
- Executes dropped EXE
PID:3724
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:5116
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:3804
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
174KB
MD566221ff109493684bfe08e18e0d8d304
SHA15bbbb288806d4075946f6b1dc42bc70fae7a0893
SHA2566aa3f610a89b30ec9bb39a3deb2c7d728e42407fc604394c738c13d7223951a3
SHA512e64d3612aa5a8d29e451a5d2c42949c2d14d9128e25cbe48ce4c890b5279c0892ab46985af4987e6f95cb28d5502ae3a1b3d60e79a4aa05c00659a352e203c69
-
Filesize
174KB
MD566221ff109493684bfe08e18e0d8d304
SHA15bbbb288806d4075946f6b1dc42bc70fae7a0893
SHA2566aa3f610a89b30ec9bb39a3deb2c7d728e42407fc604394c738c13d7223951a3
SHA512e64d3612aa5a8d29e451a5d2c42949c2d14d9128e25cbe48ce4c890b5279c0892ab46985af4987e6f95cb28d5502ae3a1b3d60e79a4aa05c00659a352e203c69
-
Filesize
234KB
MD5b2cab6f4dbfed2a485205a0f15862382
SHA13514c11ca00e5368d4017674c523a55d16f0b966
SHA25608c3cdd08a1f1e797af7121db5572599f2c4c8ca623900b01c4b8928ee6eb2c5
SHA512d375f215c3aa7e10976293a3d2de827269827fba5d437c07f9bcf7d3ed70615262e9d1a839929fd1f2cdae27cecce62b94088d1007cdd964cfea7bc8337513dd
-
Filesize
234KB
MD5b2cab6f4dbfed2a485205a0f15862382
SHA13514c11ca00e5368d4017674c523a55d16f0b966
SHA25608c3cdd08a1f1e797af7121db5572599f2c4c8ca623900b01c4b8928ee6eb2c5
SHA512d375f215c3aa7e10976293a3d2de827269827fba5d437c07f9bcf7d3ed70615262e9d1a839929fd1f2cdae27cecce62b94088d1007cdd964cfea7bc8337513dd
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
89KB
MD5dc587d08b8ca3cd62e5dc057d41a966b
SHA10ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA2567d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
SHA5127300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9
-
Filesize
272B
MD5d867eabb1be5b45bc77bb06814e23640
SHA13139a51ce7e8462c31070363b9532c13cc52c82d
SHA25638c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
SHA512afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59