Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2023 14:05
Static task
static1
Behavioral task
behavioral1
Sample
74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exe
-
Size
517KB
-
MD5
1cd832065cfeaeb7de5bf0b2a13844fa
-
SHA1
99cf055f93648ceb8dbacc4fdba133310e6ea7f1
-
SHA256
74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5
-
SHA512
801a323fff16ad09deda7ea08f127df6a4632b2b4a48957bdd50c48b5d50f37785c510ac86f87b068cfba0e189115098c7a3d4ab1168f9d1b13564e9a075bb0e
-
SSDEEP
12288:lMrry906OL/FjIVQXRUZ0iuRT7pgO+9/We8jLgw:yyc/GVQBUZ0iuVve+Lb
Malware Config
Extracted
amadey
3.86
5.42.92.67/norm/index.php
Extracted
redline
papik
77.91.124.156:19071
-
auth_value
325a615d8be5db8e2f7a4c2448fdac3a
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7686481.exe healer C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7686481.exe healer behavioral2/memory/2436-155-0x0000000000A10000-0x0000000000A1A000-memory.dmp healer -
Processes:
p7686481.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p7686481.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p7686481.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p7686481.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p7686481.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p7686481.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p7686481.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
Processes:
z9434579.exez1180793.exep7686481.exer9931654.exelegola.exes1324436.exelegola.exelegola.exepid process 4816 z9434579.exe 3116 z1180793.exe 2436 p7686481.exe 5088 r9931654.exe 3748 legola.exe 2460 s1324436.exe 2116 legola.exe 664 legola.exe -
Processes:
p7686481.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p7686481.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
z9434579.exez1180793.exe74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9434579.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z1180793.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
p7686481.exepid process 2436 p7686481.exe 2436 p7686481.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p7686481.exedescription pid process Token: SeDebugPrivilege 2436 p7686481.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
r9931654.exepid process 5088 r9931654.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exez9434579.exez1180793.exer9931654.exelegola.execmd.exedescription pid process target process PID 3732 wrote to memory of 4816 3732 74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exe z9434579.exe PID 3732 wrote to memory of 4816 3732 74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exe z9434579.exe PID 3732 wrote to memory of 4816 3732 74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exe z9434579.exe PID 4816 wrote to memory of 3116 4816 z9434579.exe z1180793.exe PID 4816 wrote to memory of 3116 4816 z9434579.exe z1180793.exe PID 4816 wrote to memory of 3116 4816 z9434579.exe z1180793.exe PID 3116 wrote to memory of 2436 3116 z1180793.exe p7686481.exe PID 3116 wrote to memory of 2436 3116 z1180793.exe p7686481.exe PID 3116 wrote to memory of 5088 3116 z1180793.exe r9931654.exe PID 3116 wrote to memory of 5088 3116 z1180793.exe r9931654.exe PID 3116 wrote to memory of 5088 3116 z1180793.exe r9931654.exe PID 5088 wrote to memory of 3748 5088 r9931654.exe legola.exe PID 5088 wrote to memory of 3748 5088 r9931654.exe legola.exe PID 5088 wrote to memory of 3748 5088 r9931654.exe legola.exe PID 4816 wrote to memory of 2460 4816 z9434579.exe s1324436.exe PID 4816 wrote to memory of 2460 4816 z9434579.exe s1324436.exe PID 4816 wrote to memory of 2460 4816 z9434579.exe s1324436.exe PID 3748 wrote to memory of 4388 3748 legola.exe schtasks.exe PID 3748 wrote to memory of 4388 3748 legola.exe schtasks.exe PID 3748 wrote to memory of 4388 3748 legola.exe schtasks.exe PID 3748 wrote to memory of 1580 3748 legola.exe cmd.exe PID 3748 wrote to memory of 1580 3748 legola.exe cmd.exe PID 3748 wrote to memory of 1580 3748 legola.exe cmd.exe PID 1580 wrote to memory of 4704 1580 cmd.exe cmd.exe PID 1580 wrote to memory of 4704 1580 cmd.exe cmd.exe PID 1580 wrote to memory of 4704 1580 cmd.exe cmd.exe PID 1580 wrote to memory of 4532 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 4532 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 4532 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 3912 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 3912 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 3912 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 4752 1580 cmd.exe cmd.exe PID 1580 wrote to memory of 4752 1580 cmd.exe cmd.exe PID 1580 wrote to memory of 4752 1580 cmd.exe cmd.exe PID 1580 wrote to memory of 3860 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 3860 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 3860 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 1424 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 1424 1580 cmd.exe cacls.exe PID 1580 wrote to memory of 1424 1580 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5exe_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9434579.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9434579.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1180793.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1180793.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7686481.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7686481.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r9931654.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r9931654.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1324436.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1324436.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9434579.exeFilesize
390KB
MD56e599a7737b9ff7950b0ec79f9f6788f
SHA11ed2accf0a2cc606abac44d2e111dea54d825e39
SHA2569fee10d09e3c3de1620c976c5301dbef3c155f8771b7a90a0271e2d35478486a
SHA5127fdea815741d6b26178524372d45a05d10cdac552fb99d7ffa4781508dc78aceed5c3718b74e32b10e936b3f75f6acf313d8882f7674ed2d0244b2e400c261d6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9434579.exeFilesize
390KB
MD56e599a7737b9ff7950b0ec79f9f6788f
SHA11ed2accf0a2cc606abac44d2e111dea54d825e39
SHA2569fee10d09e3c3de1620c976c5301dbef3c155f8771b7a90a0271e2d35478486a
SHA5127fdea815741d6b26178524372d45a05d10cdac552fb99d7ffa4781508dc78aceed5c3718b74e32b10e936b3f75f6acf313d8882f7674ed2d0244b2e400c261d6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1324436.exeFilesize
173KB
MD581a1c51be1a0846a29d7fb03a43e78db
SHA175d4a3e1a1f77463186dd296fac687d3b902659b
SHA25685b26f0de31a09514b2d4854f2108a8966d66e7795765a265628ea32cc33a59c
SHA5121330995fe8e16f16f91e83ba2a3a10a5978aa108768a4daa86b2474dd2e2626e384b1a0f27f07cf1ad2bfc2d748a8c29943ea7000bd3c9c2cb9c660c381e8a7f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1324436.exeFilesize
173KB
MD581a1c51be1a0846a29d7fb03a43e78db
SHA175d4a3e1a1f77463186dd296fac687d3b902659b
SHA25685b26f0de31a09514b2d4854f2108a8966d66e7795765a265628ea32cc33a59c
SHA5121330995fe8e16f16f91e83ba2a3a10a5978aa108768a4daa86b2474dd2e2626e384b1a0f27f07cf1ad2bfc2d748a8c29943ea7000bd3c9c2cb9c660c381e8a7f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1180793.exeFilesize
234KB
MD5940ef33fafaa1e070bb8b3b9ac3c4efb
SHA1242bfae7b05f2fdb7983507cd21e3b3ecd7307b6
SHA2561a0fefeb1f2d1cf324352b131fd092b1eac01a1b0241631a6a906f579420f203
SHA5127e83d880ce4ab99afe684c5466ed911b75ee43cc8424acbde276288f85585b475c687d8de3c1497403fc49707bbebe410025302227f99624067067db2ed99f72
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1180793.exeFilesize
234KB
MD5940ef33fafaa1e070bb8b3b9ac3c4efb
SHA1242bfae7b05f2fdb7983507cd21e3b3ecd7307b6
SHA2561a0fefeb1f2d1cf324352b131fd092b1eac01a1b0241631a6a906f579420f203
SHA5127e83d880ce4ab99afe684c5466ed911b75ee43cc8424acbde276288f85585b475c687d8de3c1497403fc49707bbebe410025302227f99624067067db2ed99f72
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7686481.exeFilesize
11KB
MD59a90898584d800c90a89055cf0356713
SHA148c8fddec278b3236ad69e5314feff0bb10bb4f9
SHA256762239ee0d844f3140b924bc8955316186b69f3173f5d7f617db235f56e0e19e
SHA5120584167000436a17658519b7841744bcca0ad34ad1569b0c44e165b5351fc5fb9303e72a0d896ba2d969e2e961d9feaa9e3670f829cf70eaba52f5f1ba35a689
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7686481.exeFilesize
11KB
MD59a90898584d800c90a89055cf0356713
SHA148c8fddec278b3236ad69e5314feff0bb10bb4f9
SHA256762239ee0d844f3140b924bc8955316186b69f3173f5d7f617db235f56e0e19e
SHA5120584167000436a17658519b7841744bcca0ad34ad1569b0c44e165b5351fc5fb9303e72a0d896ba2d969e2e961d9feaa9e3670f829cf70eaba52f5f1ba35a689
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r9931654.exeFilesize
225KB
MD5cd2c3ef895a16e716f68e54156092d2d
SHA179d8960b9d7cbcf7beabc13804f84718fd378319
SHA2562da9f0ddcfdf1f51839a35271e9929bd648be1ce82bf3c291106832f78316652
SHA512a80649049fdf46beff6ce9f7599b3c69258b9c9f4600cc069f0092d48abeda48dbc46fa850253267afd78b47428abf34ab73ab7c9e003e1ea39a5be859c5972b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r9931654.exeFilesize
225KB
MD5cd2c3ef895a16e716f68e54156092d2d
SHA179d8960b9d7cbcf7beabc13804f84718fd378319
SHA2562da9f0ddcfdf1f51839a35271e9929bd648be1ce82bf3c291106832f78316652
SHA512a80649049fdf46beff6ce9f7599b3c69258b9c9f4600cc069f0092d48abeda48dbc46fa850253267afd78b47428abf34ab73ab7c9e003e1ea39a5be859c5972b
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5cd2c3ef895a16e716f68e54156092d2d
SHA179d8960b9d7cbcf7beabc13804f84718fd378319
SHA2562da9f0ddcfdf1f51839a35271e9929bd648be1ce82bf3c291106832f78316652
SHA512a80649049fdf46beff6ce9f7599b3c69258b9c9f4600cc069f0092d48abeda48dbc46fa850253267afd78b47428abf34ab73ab7c9e003e1ea39a5be859c5972b
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5cd2c3ef895a16e716f68e54156092d2d
SHA179d8960b9d7cbcf7beabc13804f84718fd378319
SHA2562da9f0ddcfdf1f51839a35271e9929bd648be1ce82bf3c291106832f78316652
SHA512a80649049fdf46beff6ce9f7599b3c69258b9c9f4600cc069f0092d48abeda48dbc46fa850253267afd78b47428abf34ab73ab7c9e003e1ea39a5be859c5972b
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5cd2c3ef895a16e716f68e54156092d2d
SHA179d8960b9d7cbcf7beabc13804f84718fd378319
SHA2562da9f0ddcfdf1f51839a35271e9929bd648be1ce82bf3c291106832f78316652
SHA512a80649049fdf46beff6ce9f7599b3c69258b9c9f4600cc069f0092d48abeda48dbc46fa850253267afd78b47428abf34ab73ab7c9e003e1ea39a5be859c5972b
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5cd2c3ef895a16e716f68e54156092d2d
SHA179d8960b9d7cbcf7beabc13804f84718fd378319
SHA2562da9f0ddcfdf1f51839a35271e9929bd648be1ce82bf3c291106832f78316652
SHA512a80649049fdf46beff6ce9f7599b3c69258b9c9f4600cc069f0092d48abeda48dbc46fa850253267afd78b47428abf34ab73ab7c9e003e1ea39a5be859c5972b
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5cd2c3ef895a16e716f68e54156092d2d
SHA179d8960b9d7cbcf7beabc13804f84718fd378319
SHA2562da9f0ddcfdf1f51839a35271e9929bd648be1ce82bf3c291106832f78316652
SHA512a80649049fdf46beff6ce9f7599b3c69258b9c9f4600cc069f0092d48abeda48dbc46fa850253267afd78b47428abf34ab73ab7c9e003e1ea39a5be859c5972b
-
memory/2436-155-0x0000000000A10000-0x0000000000A1A000-memory.dmpFilesize
40KB
-
memory/2436-158-0x00007FFCC6A40000-0x00007FFCC7501000-memory.dmpFilesize
10.8MB
-
memory/2436-156-0x00007FFCC6A40000-0x00007FFCC7501000-memory.dmpFilesize
10.8MB
-
memory/2436-154-0x00007FFCC6A40000-0x00007FFCC7501000-memory.dmpFilesize
10.8MB
-
memory/2460-175-0x00000000731E0000-0x0000000073990000-memory.dmpFilesize
7.7MB
-
memory/2460-176-0x0000000000770000-0x00000000007A0000-memory.dmpFilesize
192KB
-
memory/2460-177-0x00000000058B0000-0x0000000005EC8000-memory.dmpFilesize
6.1MB
-
memory/2460-178-0x00000000053A0000-0x00000000054AA000-memory.dmpFilesize
1.0MB
-
memory/2460-179-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/2460-180-0x0000000005030000-0x0000000005042000-memory.dmpFilesize
72KB
-
memory/2460-181-0x00000000052D0000-0x000000000530C000-memory.dmpFilesize
240KB
-
memory/2460-182-0x00000000731E0000-0x0000000073990000-memory.dmpFilesize
7.7MB
-
memory/2460-183-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB