Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2023, 19:11
Static task
static1
Behavioral task
behavioral1
Sample
c38d8323e87fb8002f74a01c5a21bbbd0e7673c18d990e69d2f32b3c7ed20041.exe
Resource
win10v2004-20230703-en
General
-
Target
c38d8323e87fb8002f74a01c5a21bbbd0e7673c18d990e69d2f32b3c7ed20041.exe
-
Size
560KB
-
MD5
bb22f32da0e1e9508f256a6f17e120d6
-
SHA1
4937bb143ed49bce22956a2913435f2b89fb2e26
-
SHA256
c38d8323e87fb8002f74a01c5a21bbbd0e7673c18d990e69d2f32b3c7ed20041
-
SHA512
4dd2ade575d04e12b48e9fa4e67c9b46aab9b4fd3bf25d5bf6f5c1b2eaff46c108dc9081bc82ea01b97f433b24f487853d2e0ca1416dd4138272447b302db5eb
-
SSDEEP
12288:qMruy90k4nYC7uud3hEPpRS+mEMnAym0Cin1M3qW6st1:Yy5UYSIDmLAyPCuGZpt1
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
maxik
77.91.124.156:19071
-
auth_value
a7714e1bc167c67e3fc8f9e368352269
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000002325f-152.dat healer behavioral1/files/0x000700000002325f-153.dat healer behavioral1/memory/960-154-0x0000000000DE0000-0x0000000000DEA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p2191992.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p2191992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p2191992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p2191992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p2191992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p2191992.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 2456 z0664308.exe 940 z0118453.exe 960 p2191992.exe 4452 r2939431.exe 3236 legosa.exe 2876 s2115696.exe 4952 legosa.exe 3268 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 444 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p2191992.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z0664308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z0118453.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c38d8323e87fb8002f74a01c5a21bbbd0e7673c18d990e69d2f32b3c7ed20041.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3244 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5012 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 960 p2191992.exe 960 p2191992.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 960 p2191992.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1480 wrote to memory of 2456 1480 c38d8323e87fb8002f74a01c5a21bbbd0e7673c18d990e69d2f32b3c7ed20041.exe 81 PID 1480 wrote to memory of 2456 1480 c38d8323e87fb8002f74a01c5a21bbbd0e7673c18d990e69d2f32b3c7ed20041.exe 81 PID 1480 wrote to memory of 2456 1480 c38d8323e87fb8002f74a01c5a21bbbd0e7673c18d990e69d2f32b3c7ed20041.exe 81 PID 2456 wrote to memory of 940 2456 z0664308.exe 82 PID 2456 wrote to memory of 940 2456 z0664308.exe 82 PID 2456 wrote to memory of 940 2456 z0664308.exe 82 PID 940 wrote to memory of 960 940 z0118453.exe 83 PID 940 wrote to memory of 960 940 z0118453.exe 83 PID 940 wrote to memory of 4452 940 z0118453.exe 89 PID 940 wrote to memory of 4452 940 z0118453.exe 89 PID 940 wrote to memory of 4452 940 z0118453.exe 89 PID 4452 wrote to memory of 3236 4452 r2939431.exe 90 PID 4452 wrote to memory of 3236 4452 r2939431.exe 90 PID 4452 wrote to memory of 3236 4452 r2939431.exe 90 PID 2456 wrote to memory of 2876 2456 z0664308.exe 91 PID 2456 wrote to memory of 2876 2456 z0664308.exe 91 PID 2456 wrote to memory of 2876 2456 z0664308.exe 91 PID 3236 wrote to memory of 5012 3236 legosa.exe 92 PID 3236 wrote to memory of 5012 3236 legosa.exe 92 PID 3236 wrote to memory of 5012 3236 legosa.exe 92 PID 3236 wrote to memory of 4760 3236 legosa.exe 94 PID 3236 wrote to memory of 4760 3236 legosa.exe 94 PID 3236 wrote to memory of 4760 3236 legosa.exe 94 PID 4760 wrote to memory of 876 4760 cmd.exe 96 PID 4760 wrote to memory of 876 4760 cmd.exe 96 PID 4760 wrote to memory of 876 4760 cmd.exe 96 PID 4760 wrote to memory of 4264 4760 cmd.exe 97 PID 4760 wrote to memory of 4264 4760 cmd.exe 97 PID 4760 wrote to memory of 4264 4760 cmd.exe 97 PID 4760 wrote to memory of 2752 4760 cmd.exe 98 PID 4760 wrote to memory of 2752 4760 cmd.exe 98 PID 4760 wrote to memory of 2752 4760 cmd.exe 98 PID 4760 wrote to memory of 1648 4760 cmd.exe 99 PID 4760 wrote to memory of 1648 4760 cmd.exe 99 PID 4760 wrote to memory of 1648 4760 cmd.exe 99 PID 4760 wrote to memory of 4836 4760 cmd.exe 100 PID 4760 wrote to memory of 4836 4760 cmd.exe 100 PID 4760 wrote to memory of 4836 4760 cmd.exe 100 PID 4760 wrote to memory of 4860 4760 cmd.exe 101 PID 4760 wrote to memory of 4860 4760 cmd.exe 101 PID 4760 wrote to memory of 4860 4760 cmd.exe 101 PID 3236 wrote to memory of 444 3236 legosa.exe 108 PID 3236 wrote to memory of 444 3236 legosa.exe 108 PID 3236 wrote to memory of 444 3236 legosa.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\c38d8323e87fb8002f74a01c5a21bbbd0e7673c18d990e69d2f32b3c7ed20041.exe"C:\Users\Admin\AppData\Local\Temp\c38d8323e87fb8002f74a01c5a21bbbd0e7673c18d990e69d2f32b3c7ed20041.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0664308.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0664308.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0118453.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0118453.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p2191992.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p2191992.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2939431.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2939431.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:5012
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:876
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:4264
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:2752
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1648
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:4836
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:4860
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:444
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s2115696.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s2115696.exe3⤵
- Executes dropped EXE
PID:2876
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:4952
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:3268
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3244
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD5abc1238ee767de2e47ab386e86ac8272
SHA1cfab42dd995dde43ef175b0fcb11179253979bec
SHA25634bdb13d4ed5459b3547fd4a824a22366564305eaa9db6484e2e18c313046949
SHA5123c18cafa9bc4cad0cb4cad41c5a3160ae32359ee420b490ded0317ef24a6bac214f1cf9b443570d9910d0f7cea86befc6af5151c27d439758c2c8bbb1693cf43
-
Filesize
432KB
MD5abc1238ee767de2e47ab386e86ac8272
SHA1cfab42dd995dde43ef175b0fcb11179253979bec
SHA25634bdb13d4ed5459b3547fd4a824a22366564305eaa9db6484e2e18c313046949
SHA5123c18cafa9bc4cad0cb4cad41c5a3160ae32359ee420b490ded0317ef24a6bac214f1cf9b443570d9910d0f7cea86befc6af5151c27d439758c2c8bbb1693cf43
-
Filesize
176KB
MD5de0e478c24bd2636525f5631b71b852e
SHA12eb1a4ac96523ab34245efda58de69ba693140cf
SHA256fc1e692d88e69a2eb228c3e5d3c0251778724ecddeb6c20b11f44fa5b2c85946
SHA51286c5817491393b18c5b7b13d3f14e3aaae13d0d3499e733bfe918b07c5c4c7f3903fad8e0b0790d3c0d9f0a2c6235b79542caad6d24a7279b4d79591c0e48c5d
-
Filesize
176KB
MD5de0e478c24bd2636525f5631b71b852e
SHA12eb1a4ac96523ab34245efda58de69ba693140cf
SHA256fc1e692d88e69a2eb228c3e5d3c0251778724ecddeb6c20b11f44fa5b2c85946
SHA51286c5817491393b18c5b7b13d3f14e3aaae13d0d3499e733bfe918b07c5c4c7f3903fad8e0b0790d3c0d9f0a2c6235b79542caad6d24a7279b4d79591c0e48c5d
-
Filesize
277KB
MD5210058aaf34980fc7387d6280ceea82f
SHA10eedf16658090d75763581f994a2b478da017a34
SHA256cd302a36952ca36e84bc02c8ddfc01426101f7d3860fc02d6da1fe3356dfd4a6
SHA5124684b33d60eada55f6ab725aec0868a0e53583a79fbe9142366b912263cccb2c358e32276f814f3a416a1e93cc0078e8935585e1300f6a818a8759014c8e5292
-
Filesize
277KB
MD5210058aaf34980fc7387d6280ceea82f
SHA10eedf16658090d75763581f994a2b478da017a34
SHA256cd302a36952ca36e84bc02c8ddfc01426101f7d3860fc02d6da1fe3356dfd4a6
SHA5124684b33d60eada55f6ab725aec0868a0e53583a79fbe9142366b912263cccb2c358e32276f814f3a416a1e93cc0078e8935585e1300f6a818a8759014c8e5292
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5