Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
09-08-2023 17:09
Static task
static1
Behavioral task
behavioral1
Sample
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe
-
Size
517KB
-
MD5
7a4c7e87293811a73f42e7f92c0b8316
-
SHA1
a6f9a80112901db5a316a8c5cbda717651b02141
-
SHA256
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdf
-
SHA512
f0080c8654d53068672fedf5dc68b4cca4e19930369de9546bbc242ebb85f4b7fdaadb8bbd25723d2c242eadd0b8f27d4d4ae1884aab8c1be6e8e381547b906d
-
SSDEEP
6144:K9y+bnr+zp0yN90QEhf1lsLhCm6G2QkI/lcqmMitHw6xCnijn0IQVJHZVzI2fzBG:vMrny90b1ikw2QPqwtij0bVJ5Vrr/c
Malware Config
Extracted
amadey
3.86
5.42.92.67/norm/index.php
Extracted
redline
papik
77.91.124.156:19071
-
auth_value
325a615d8be5db8e2f7a4c2448fdac3a
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5981999.exe healer C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5981999.exe healer behavioral2/memory/4268-154-0x0000000000DD0000-0x0000000000DDA000-memory.dmp healer -
Processes:
p5981999.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p5981999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p5981999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p5981999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p5981999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p5981999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p5981999.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
Processes:
z6028950.exez4339574.exep5981999.exer3088141.exelegola.exes7532140.exelegola.exelegola.exepid process 216 z6028950.exe 4408 z4339574.exe 4268 p5981999.exe 1652 r3088141.exe 628 legola.exe 4748 s7532140.exe 5004 legola.exe 1992 legola.exe -
Processes:
p5981999.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p5981999.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exez6028950.exez4339574.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z6028950.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4339574.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
p5981999.exepid process 4268 p5981999.exe 4268 p5981999.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p5981999.exedescription pid process Token: SeDebugPrivilege 4268 p5981999.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
r3088141.exepid process 1652 r3088141.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exez6028950.exez4339574.exer3088141.exelegola.execmd.exedescription pid process target process PID 4480 wrote to memory of 216 4480 a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe z6028950.exe PID 4480 wrote to memory of 216 4480 a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe z6028950.exe PID 4480 wrote to memory of 216 4480 a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe z6028950.exe PID 216 wrote to memory of 4408 216 z6028950.exe z4339574.exe PID 216 wrote to memory of 4408 216 z6028950.exe z4339574.exe PID 216 wrote to memory of 4408 216 z6028950.exe z4339574.exe PID 4408 wrote to memory of 4268 4408 z4339574.exe p5981999.exe PID 4408 wrote to memory of 4268 4408 z4339574.exe p5981999.exe PID 4408 wrote to memory of 1652 4408 z4339574.exe r3088141.exe PID 4408 wrote to memory of 1652 4408 z4339574.exe r3088141.exe PID 4408 wrote to memory of 1652 4408 z4339574.exe r3088141.exe PID 1652 wrote to memory of 628 1652 r3088141.exe legola.exe PID 1652 wrote to memory of 628 1652 r3088141.exe legola.exe PID 1652 wrote to memory of 628 1652 r3088141.exe legola.exe PID 216 wrote to memory of 4748 216 z6028950.exe s7532140.exe PID 216 wrote to memory of 4748 216 z6028950.exe s7532140.exe PID 216 wrote to memory of 4748 216 z6028950.exe s7532140.exe PID 628 wrote to memory of 1884 628 legola.exe schtasks.exe PID 628 wrote to memory of 1884 628 legola.exe schtasks.exe PID 628 wrote to memory of 1884 628 legola.exe schtasks.exe PID 628 wrote to memory of 4856 628 legola.exe cmd.exe PID 628 wrote to memory of 4856 628 legola.exe cmd.exe PID 628 wrote to memory of 4856 628 legola.exe cmd.exe PID 4856 wrote to memory of 4124 4856 cmd.exe cmd.exe PID 4856 wrote to memory of 4124 4856 cmd.exe cmd.exe PID 4856 wrote to memory of 4124 4856 cmd.exe cmd.exe PID 4856 wrote to memory of 2640 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 2640 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 2640 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 1964 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 1964 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 1964 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 744 4856 cmd.exe cmd.exe PID 4856 wrote to memory of 744 4856 cmd.exe cmd.exe PID 4856 wrote to memory of 744 4856 cmd.exe cmd.exe PID 4856 wrote to memory of 4276 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 4276 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 4276 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 4616 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 4616 4856 cmd.exe cacls.exe PID 4856 wrote to memory of 4616 4856 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdfexe_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6028950.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6028950.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4339574.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4339574.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5981999.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5981999.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3088141.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3088141.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7532140.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7532140.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6028950.exeFilesize
390KB
MD58ad09806134cb86889b873b002dd68d9
SHA1b2100f25b8e8c9acd238364310d8db25aed1be4f
SHA25678004e5616e546c3d27d622ac63e060741b0eb5c2cceb2dfbb3f6c7659bde7e8
SHA5120fa3cd5221e930535c212a03c9d28c91262442fd7aa2843174b83d3d47c6db13ed28733a50496702bc4b972b358b98ac300ecf7f5edff8ff956972ddc9762375
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6028950.exeFilesize
390KB
MD58ad09806134cb86889b873b002dd68d9
SHA1b2100f25b8e8c9acd238364310d8db25aed1be4f
SHA25678004e5616e546c3d27d622ac63e060741b0eb5c2cceb2dfbb3f6c7659bde7e8
SHA5120fa3cd5221e930535c212a03c9d28c91262442fd7aa2843174b83d3d47c6db13ed28733a50496702bc4b972b358b98ac300ecf7f5edff8ff956972ddc9762375
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7532140.exeFilesize
173KB
MD5be4f8fa8c73fa3fe6f2b528ab9d34e5c
SHA1e21e11a0132b0075c3c30212149385f077af4074
SHA256b2a29fa42defdce98f38b92e020eab5a1f654410a8e5a763719fc609870fd898
SHA512728d2e7ed1c696e34dcaafb5a88ee40f2c6d1d1cd2b6bc0918f8faf6361feaf34a1b0159d9dbb1ae63b9e8097107b97932b47e63d868ef9778027ac964589117
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7532140.exeFilesize
173KB
MD5be4f8fa8c73fa3fe6f2b528ab9d34e5c
SHA1e21e11a0132b0075c3c30212149385f077af4074
SHA256b2a29fa42defdce98f38b92e020eab5a1f654410a8e5a763719fc609870fd898
SHA512728d2e7ed1c696e34dcaafb5a88ee40f2c6d1d1cd2b6bc0918f8faf6361feaf34a1b0159d9dbb1ae63b9e8097107b97932b47e63d868ef9778027ac964589117
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4339574.exeFilesize
234KB
MD56b1f09627d8cff3329eb06810860343a
SHA1738d5d97c9d7046de4346e449894a26794c3924c
SHA256a7d1b26c4ca45a419e422a0d2412efb5d8e0aba9b940a433a9eb35ceb8542a4a
SHA512c708cdc2aba82f47c18a1240c38e51ed1b5c6c01e56cbb11cb7150e0cbe995b8b8ee4a923c2c54b7a0a399ddd1730defeabd829b9ff5413b27103757725524bb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4339574.exeFilesize
234KB
MD56b1f09627d8cff3329eb06810860343a
SHA1738d5d97c9d7046de4346e449894a26794c3924c
SHA256a7d1b26c4ca45a419e422a0d2412efb5d8e0aba9b940a433a9eb35ceb8542a4a
SHA512c708cdc2aba82f47c18a1240c38e51ed1b5c6c01e56cbb11cb7150e0cbe995b8b8ee4a923c2c54b7a0a399ddd1730defeabd829b9ff5413b27103757725524bb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5981999.exeFilesize
11KB
MD5b56255d57ccfa39a05f39a20ee60cc0a
SHA1af80c1eecfabcdd48fece68cec63d3e15fb20b80
SHA256288ed88964e563607ae87c0e8f825e2cf64f1b3378cf2cba47c2d72d9a484055
SHA512b861b16a21c5abb6d6afd1949a80f0c2179eed779fb768fa3ba6868b0f50da0c4f75c3515662cba0e591c503d5ca2c68ae8c1f40e7570aebe9e280288d88060f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5981999.exeFilesize
11KB
MD5b56255d57ccfa39a05f39a20ee60cc0a
SHA1af80c1eecfabcdd48fece68cec63d3e15fb20b80
SHA256288ed88964e563607ae87c0e8f825e2cf64f1b3378cf2cba47c2d72d9a484055
SHA512b861b16a21c5abb6d6afd1949a80f0c2179eed779fb768fa3ba6868b0f50da0c4f75c3515662cba0e591c503d5ca2c68ae8c1f40e7570aebe9e280288d88060f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3088141.exeFilesize
225KB
MD53559b495d3048f53f57fb9b6e2ab4de7
SHA11ffb5e9f12228d22f1af2cb7fd5329edd60e7648
SHA2560c204a70a12d4aba7392964b0a7f138884396bfbf3ca1c2b6b552e4479975c80
SHA51271c06033d45f059e0cd839a0e3272891aef233415f14a206c2552e20a976b9d3b84f1a2c53c4c66e2a49f29491fc68a6cd865d490da3d0623900f958446106b9
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3088141.exeFilesize
225KB
MD53559b495d3048f53f57fb9b6e2ab4de7
SHA11ffb5e9f12228d22f1af2cb7fd5329edd60e7648
SHA2560c204a70a12d4aba7392964b0a7f138884396bfbf3ca1c2b6b552e4479975c80
SHA51271c06033d45f059e0cd839a0e3272891aef233415f14a206c2552e20a976b9d3b84f1a2c53c4c66e2a49f29491fc68a6cd865d490da3d0623900f958446106b9
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD53559b495d3048f53f57fb9b6e2ab4de7
SHA11ffb5e9f12228d22f1af2cb7fd5329edd60e7648
SHA2560c204a70a12d4aba7392964b0a7f138884396bfbf3ca1c2b6b552e4479975c80
SHA51271c06033d45f059e0cd839a0e3272891aef233415f14a206c2552e20a976b9d3b84f1a2c53c4c66e2a49f29491fc68a6cd865d490da3d0623900f958446106b9
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD53559b495d3048f53f57fb9b6e2ab4de7
SHA11ffb5e9f12228d22f1af2cb7fd5329edd60e7648
SHA2560c204a70a12d4aba7392964b0a7f138884396bfbf3ca1c2b6b552e4479975c80
SHA51271c06033d45f059e0cd839a0e3272891aef233415f14a206c2552e20a976b9d3b84f1a2c53c4c66e2a49f29491fc68a6cd865d490da3d0623900f958446106b9
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD53559b495d3048f53f57fb9b6e2ab4de7
SHA11ffb5e9f12228d22f1af2cb7fd5329edd60e7648
SHA2560c204a70a12d4aba7392964b0a7f138884396bfbf3ca1c2b6b552e4479975c80
SHA51271c06033d45f059e0cd839a0e3272891aef233415f14a206c2552e20a976b9d3b84f1a2c53c4c66e2a49f29491fc68a6cd865d490da3d0623900f958446106b9
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD53559b495d3048f53f57fb9b6e2ab4de7
SHA11ffb5e9f12228d22f1af2cb7fd5329edd60e7648
SHA2560c204a70a12d4aba7392964b0a7f138884396bfbf3ca1c2b6b552e4479975c80
SHA51271c06033d45f059e0cd839a0e3272891aef233415f14a206c2552e20a976b9d3b84f1a2c53c4c66e2a49f29491fc68a6cd865d490da3d0623900f958446106b9
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD53559b495d3048f53f57fb9b6e2ab4de7
SHA11ffb5e9f12228d22f1af2cb7fd5329edd60e7648
SHA2560c204a70a12d4aba7392964b0a7f138884396bfbf3ca1c2b6b552e4479975c80
SHA51271c06033d45f059e0cd839a0e3272891aef233415f14a206c2552e20a976b9d3b84f1a2c53c4c66e2a49f29491fc68a6cd865d490da3d0623900f958446106b9
-
memory/4268-154-0x0000000000DD0000-0x0000000000DDA000-memory.dmpFilesize
40KB
-
memory/4268-157-0x00007FFC2C3B0000-0x00007FFC2CE71000-memory.dmpFilesize
10.8MB
-
memory/4268-155-0x00007FFC2C3B0000-0x00007FFC2CE71000-memory.dmpFilesize
10.8MB
-
memory/4748-174-0x0000000000300000-0x0000000000330000-memory.dmpFilesize
192KB
-
memory/4748-175-0x0000000073CB0000-0x0000000074460000-memory.dmpFilesize
7.7MB
-
memory/4748-176-0x0000000005240000-0x0000000005858000-memory.dmpFilesize
6.1MB
-
memory/4748-177-0x0000000004D50000-0x0000000004E5A000-memory.dmpFilesize
1.0MB
-
memory/4748-179-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/4748-178-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/4748-180-0x0000000004CF0000-0x0000000004D2C000-memory.dmpFilesize
240KB
-
memory/4748-181-0x0000000073CB0000-0x0000000074460000-memory.dmpFilesize
7.7MB
-
memory/4748-182-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB