resource	yara_rule
behavioral1/files/0x0006000000019326-44.dat	healer
behavioral1/memory/2724-48-0x0000000000110000-0x000000000011A000-memory.dmp	healer

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7341166.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7341166.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7341166.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7341166.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7341166.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7341166.exe

resource	yara_rule
behavioral1/files/0x0006000000018bdb-57.dat	family_redline
behavioral1/memory/2436-63-0x0000000000EB0000-0x0000000000EE0000-memory.dmp	family_redline

pid	Process
2932	v1174701.exe
2472	v6302603.exe
2588	v5756523.exe
2568	v5896929.exe
2724	a7341166.exe
2360	b7297316.exe
2436	c3956936.exe

pid	Process
1504	8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b_JC.exe
2932	v1174701.exe
2932	v1174701.exe
2472	v6302603.exe
2472	v6302603.exe
2588	v5756523.exe
2588	v5756523.exe
2568	v5896929.exe
2568	v5896929.exe
2568	v5896929.exe
2360	b7297316.exe
2588	v5756523.exe
2436	c3956936.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	a7341166.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7341166.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v5896929.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1174701.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6302603.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v5756523.exe

description	pid	Process	procid_target
PID 1504 wrote to memory of 2932	1504	8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b_JC.exe	28
PID 1504 wrote to memory of 2932	1504	8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b_JC.exe	28
PID 1504 wrote to memory of 2932	1504	8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b_JC.exe	28
PID 1504 wrote to memory of 2932	1504	8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b_JC.exe	28
PID 1504 wrote to memory of 2932	1504	8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b_JC.exe	28
PID 1504 wrote to memory of 2932	1504	8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b_JC.exe	28
PID 1504 wrote to memory of 2932	1504	8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b_JC.exe	28
PID 2932 wrote to memory of 2472	2932	v1174701.exe	29
PID 2932 wrote to memory of 2472	2932	v1174701.exe	29
PID 2932 wrote to memory of 2472	2932	v1174701.exe	29
PID 2932 wrote to memory of 2472	2932	v1174701.exe	29
PID 2932 wrote to memory of 2472	2932	v1174701.exe	29
PID 2932 wrote to memory of 2472	2932	v1174701.exe	29
PID 2932 wrote to memory of 2472	2932	v1174701.exe	29
PID 2472 wrote to memory of 2588	2472	v6302603.exe	30
PID 2472 wrote to memory of 2588	2472	v6302603.exe	30
PID 2472 wrote to memory of 2588	2472	v6302603.exe	30
PID 2472 wrote to memory of 2588	2472	v6302603.exe	30
PID 2472 wrote to memory of 2588	2472	v6302603.exe	30
PID 2472 wrote to memory of 2588	2472	v6302603.exe	30
PID 2472 wrote to memory of 2588	2472	v6302603.exe	30
PID 2588 wrote to memory of 2568	2588	v5756523.exe	31
PID 2588 wrote to memory of 2568	2588	v5756523.exe	31
PID 2588 wrote to memory of 2568	2588	v5756523.exe	31
PID 2588 wrote to memory of 2568	2588	v5756523.exe	31
PID 2588 wrote to memory of 2568	2588	v5756523.exe	31
PID 2588 wrote to memory of 2568	2588	v5756523.exe	31
PID 2588 wrote to memory of 2568	2588	v5756523.exe	31
PID 2568 wrote to memory of 2724	2568	v5896929.exe	32
PID 2568 wrote to memory of 2724	2568	v5896929.exe	32
PID 2568 wrote to memory of 2724	2568	v5896929.exe	32
PID 2568 wrote to memory of 2724	2568	v5896929.exe	32
PID 2568 wrote to memory of 2724	2568	v5896929.exe	32
PID 2568 wrote to memory of 2724	2568	v5896929.exe	32
PID 2568 wrote to memory of 2724	2568	v5896929.exe	32
PID 2568 wrote to memory of 2360	2568	v5896929.exe	33
PID 2568 wrote to memory of 2360	2568	v5896929.exe	33
PID 2568 wrote to memory of 2360	2568	v5896929.exe	33
PID 2568 wrote to memory of 2360	2568	v5896929.exe	33
PID 2568 wrote to memory of 2360	2568	v5896929.exe	33
PID 2568 wrote to memory of 2360	2568	v5896929.exe	33
PID 2568 wrote to memory of 2360	2568	v5896929.exe	33
PID 2588 wrote to memory of 2436	2588	v5756523.exe	34
PID 2588 wrote to memory of 2436	2588	v5756523.exe	34
PID 2588 wrote to memory of 2436	2588	v5756523.exe	34
PID 2588 wrote to memory of 2436	2588	v5756523.exe	34
PID 2588 wrote to memory of 2436	2588	v5756523.exe	34
PID 2588 wrote to memory of 2436	2588	v5756523.exe	34
PID 2588 wrote to memory of 2436	2588	v5756523.exe	34

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads