Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
12344043ebb001d2322505c7347c38a2d6df3b5cb7262d3423e7002265ee4485.exe
Resource
win10v2004-20230703-en
General
-
Target
12344043ebb001d2322505c7347c38a2d6df3b5cb7262d3423e7002265ee4485.exe
-
Size
517KB
-
MD5
130fb448c02b27c068a801d188f51783
-
SHA1
16f9cea2790fd6a6d5603c42612e529bb2bf00af
-
SHA256
12344043ebb001d2322505c7347c38a2d6df3b5cb7262d3423e7002265ee4485
-
SHA512
d81ee5cbbd836f48910155f568fb2096a652ff2abae91ec351b9ff3c675a6fd9cdeee7880b0973a89ce0cf015ab02f7550821b050c27567cf434ea66d5019eff
-
SSDEEP
12288:EMr3y90/jvjOjSbb9flf+Sby2v8T09si35J:rymbisnZhkT09si5J
Malware Config
Extracted
amadey
3.86
77.91.68.61/rock/index.php
Extracted
redline
maxik
77.91.124.156:19071
-
auth_value
a7714e1bc167c67e3fc8f9e368352269
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00070000000230ba-152.dat healer behavioral1/files/0x00070000000230ba-153.dat healer behavioral1/memory/4440-154-0x0000000000710000-0x000000000071A000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k2790507.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k2790507.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k2790507.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k2790507.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k2790507.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k2790507.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 2008 y9164885.exe 3148 y5269350.exe 4440 k2790507.exe 4684 l9843771.exe 428 pdates.exe 1980 m9559045.exe 4848 pdates.exe 180 pdates.exe -
Loads dropped DLL 1 IoCs
pid Process 2864 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k2790507.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 12344043ebb001d2322505c7347c38a2d6df3b5cb7262d3423e7002265ee4485.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y9164885.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y5269350.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4484 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4440 k2790507.exe 4440 k2790507.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4440 k2790507.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4684 l9843771.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 488 wrote to memory of 2008 488 12344043ebb001d2322505c7347c38a2d6df3b5cb7262d3423e7002265ee4485.exe 86 PID 488 wrote to memory of 2008 488 12344043ebb001d2322505c7347c38a2d6df3b5cb7262d3423e7002265ee4485.exe 86 PID 488 wrote to memory of 2008 488 12344043ebb001d2322505c7347c38a2d6df3b5cb7262d3423e7002265ee4485.exe 86 PID 2008 wrote to memory of 3148 2008 y9164885.exe 87 PID 2008 wrote to memory of 3148 2008 y9164885.exe 87 PID 2008 wrote to memory of 3148 2008 y9164885.exe 87 PID 3148 wrote to memory of 4440 3148 y5269350.exe 88 PID 3148 wrote to memory of 4440 3148 y5269350.exe 88 PID 3148 wrote to memory of 4684 3148 y5269350.exe 96 PID 3148 wrote to memory of 4684 3148 y5269350.exe 96 PID 3148 wrote to memory of 4684 3148 y5269350.exe 96 PID 4684 wrote to memory of 428 4684 l9843771.exe 98 PID 4684 wrote to memory of 428 4684 l9843771.exe 98 PID 4684 wrote to memory of 428 4684 l9843771.exe 98 PID 2008 wrote to memory of 1980 2008 y9164885.exe 99 PID 2008 wrote to memory of 1980 2008 y9164885.exe 99 PID 2008 wrote to memory of 1980 2008 y9164885.exe 99 PID 428 wrote to memory of 4484 428 pdates.exe 100 PID 428 wrote to memory of 4484 428 pdates.exe 100 PID 428 wrote to memory of 4484 428 pdates.exe 100 PID 428 wrote to memory of 4552 428 pdates.exe 102 PID 428 wrote to memory of 4552 428 pdates.exe 102 PID 428 wrote to memory of 4552 428 pdates.exe 102 PID 4552 wrote to memory of 4736 4552 cmd.exe 104 PID 4552 wrote to memory of 4736 4552 cmd.exe 104 PID 4552 wrote to memory of 4736 4552 cmd.exe 104 PID 4552 wrote to memory of 384 4552 cmd.exe 105 PID 4552 wrote to memory of 384 4552 cmd.exe 105 PID 4552 wrote to memory of 384 4552 cmd.exe 105 PID 4552 wrote to memory of 3220 4552 cmd.exe 106 PID 4552 wrote to memory of 3220 4552 cmd.exe 106 PID 4552 wrote to memory of 3220 4552 cmd.exe 106 PID 4552 wrote to memory of 4300 4552 cmd.exe 107 PID 4552 wrote to memory of 4300 4552 cmd.exe 107 PID 4552 wrote to memory of 4300 4552 cmd.exe 107 PID 4552 wrote to memory of 1164 4552 cmd.exe 108 PID 4552 wrote to memory of 1164 4552 cmd.exe 108 PID 4552 wrote to memory of 1164 4552 cmd.exe 108 PID 4552 wrote to memory of 4964 4552 cmd.exe 109 PID 4552 wrote to memory of 4964 4552 cmd.exe 109 PID 4552 wrote to memory of 4964 4552 cmd.exe 109 PID 428 wrote to memory of 2864 428 pdates.exe 114 PID 428 wrote to memory of 2864 428 pdates.exe 114 PID 428 wrote to memory of 2864 428 pdates.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\12344043ebb001d2322505c7347c38a2d6df3b5cb7262d3423e7002265ee4485.exe"C:\Users\Admin\AppData\Local\Temp\12344043ebb001d2322505c7347c38a2d6df3b5cb7262d3423e7002265ee4485.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9164885.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9164885.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5269350.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5269350.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2790507.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k2790507.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9843771.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9843771.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F6⤵
- Creates scheduled task(s)
PID:4484
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4736
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"7⤵PID:384
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E7⤵PID:3220
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4300
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"7⤵PID:1164
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E7⤵PID:4964
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2864
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m9559045.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m9559045.exe3⤵
- Executes dropped EXE
PID:1980
-
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:4848
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:180
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
390KB
MD5f4692ba87899c2f41b3f0a5bc23dd4f0
SHA12efc71cf83f5592488923115e3cc66095d164b8a
SHA25698ef71b641ffa0563d9c361e2a9776d16cdc770c12ad038672c61d5413c91efa
SHA51248403338b621c9b45ad46cbc0ac24a8a74a047ba86e7b424183204ad1abc6fc32ced7ac09a03231344c02288b87659b6367964c86787624835754965243962f1
-
Filesize
390KB
MD5f4692ba87899c2f41b3f0a5bc23dd4f0
SHA12efc71cf83f5592488923115e3cc66095d164b8a
SHA25698ef71b641ffa0563d9c361e2a9776d16cdc770c12ad038672c61d5413c91efa
SHA51248403338b621c9b45ad46cbc0ac24a8a74a047ba86e7b424183204ad1abc6fc32ced7ac09a03231344c02288b87659b6367964c86787624835754965243962f1
-
Filesize
173KB
MD5e91915ceba724e2f04eb5ad6f42a73aa
SHA1fcfd1ccc5f4520b611c6a2417ce1d60cb72d56ab
SHA256db5fadcfae6d44905a9f4b5bb9b2b98839f3dcfd0099800a88c5c86d7f19fbc8
SHA512036fdf149ea26af3ddb388e85b2a941ebf8b005b0b567436259c81d0250eccd98dac7662c37fddd5810841a3d49ddc0645562585a80feb5d5a6595f12dd6cbaa
-
Filesize
173KB
MD5e91915ceba724e2f04eb5ad6f42a73aa
SHA1fcfd1ccc5f4520b611c6a2417ce1d60cb72d56ab
SHA256db5fadcfae6d44905a9f4b5bb9b2b98839f3dcfd0099800a88c5c86d7f19fbc8
SHA512036fdf149ea26af3ddb388e85b2a941ebf8b005b0b567436259c81d0250eccd98dac7662c37fddd5810841a3d49ddc0645562585a80feb5d5a6595f12dd6cbaa
-
Filesize
234KB
MD543a85e6bca099f29e59db13ff7a498a6
SHA13df3c6ee3b7b186d26c62b2d734d5da19d0149d2
SHA256c76fc119c40944804d3eede35664867a19749d53de3e1c4caa46636fd0135226
SHA51265f0a34c678c211273089df8bfed78fcc928369b0a6e643523d98eb3244c8912b269b8ae6e176e71a09cd6da44ea094e36584b9501cb3d918285bb7c17415d7d
-
Filesize
234KB
MD543a85e6bca099f29e59db13ff7a498a6
SHA13df3c6ee3b7b186d26c62b2d734d5da19d0149d2
SHA256c76fc119c40944804d3eede35664867a19749d53de3e1c4caa46636fd0135226
SHA51265f0a34c678c211273089df8bfed78fcc928369b0a6e643523d98eb3244c8912b269b8ae6e176e71a09cd6da44ea094e36584b9501cb3d918285bb7c17415d7d
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
89KB
MD52392b231cf4a80739b5cb09bf808127d
SHA141b5cf81c50884954911d96444fe83cfd0da465b
SHA2562244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f
SHA51219ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34
-
Filesize
273B
MD59851b884bf4aadfade57d911a3f03332
SHA1aaadd1c1856c22844bb9fbb030cf4f586ed8866a
SHA25603afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f
SHA512a7de560f51bacd381d3e741f887c3c40ece88521ee93a22a4f7448297e8bda2131be866d9ae6438c528d9f40a277c18bae517deec16b6b723f67d4c308031327