Overview
overview
10Static
static
327efa43e16...c1.exe
windows10-2004-x64
102fd7c050fb...83.exe
windows10-2004-x64
1031714e287a...59.exe
windows10-2004-x64
104663b4277c...a5.exe
windows10-2004-x64
104ef1a0149d...77.exe
windows10-2004-x64
1055de348478...bf.exe
windows10-2004-x64
1062e08aa290...71.exe
windows10-2004-x64
107c2b1a4696...86.exe
windows10-2004-x64
109712f3ca55...1a.exe
windows10-2004-x64
10a2578cb8fe...19.exe
windows10-2004-x64
10a2e15ecbc2...3e.exe
windows10-2004-x64
10bc1039ea1a...c2.exe
windows10-2004-x64
10c7a4524e38...ae.exe
windows10-2004-x64
10f47fb04ed8...65.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 11:02
Static task
static1
Behavioral task
behavioral1
Sample
27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
9712f3ca55a69dc82a720b41eeb39aa2d2482719c764715d774a1d1d1d11ea1a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe
Resource
win10v2004-20240426-en
General
-
Target
c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe
-
Size
390KB
-
MD5
86270699bad2681bb3f5f57f44a7094e
-
SHA1
cac5e4b620f438ece23b6e9df463b99d2667a95f
-
SHA256
c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae
-
SHA512
92ed35d0f3a0c22d5be759b2cf71064194e440601cba0b848d6a4440467820273b446a38069794da757c2d1c8ae760792a5156e69e4cf5aeaeb003f8ee740443
-
SSDEEP
12288:sMrYy90slB8Ldj5DBLjkSaHAcHnl9kkN6Kw:MyJ8D1lO/Hc
Malware Config
Extracted
amadey
3.85
http://77.91.68.3
-
install_dir
3ec1f323b5
-
install_file
danke.exe
-
strings_key
827021be90f1e85ab27949ea7e9347e8
-
url_paths
/home/love/index.php
Extracted
redline
roma
77.91.68.56:19071
-
auth_value
f099c2cf92834dbc554a94e1456cf576
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral13/files/0x0008000000023456-12.dat healer behavioral13/memory/3328-14-0x0000000000CA0000-0x0000000000CAA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k2141323.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k2141323.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k2141323.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k2141323.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k2141323.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k2141323.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral13/files/0x0007000000023454-31.dat family_redline behavioral13/memory/2860-33-0x0000000000B20000-0x0000000000B50000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation l9614701.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 8 IoCs
pid Process 2376 y6493242.exe 3328 k2141323.exe 1092 l9614701.exe 3984 danke.exe 2860 n4054738.exe 4912 danke.exe 4552 danke.exe 1568 danke.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k2141323.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y6493242.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3328 k2141323.exe 3328 k2141323.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3328 k2141323.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 396 wrote to memory of 2376 396 c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe 86 PID 396 wrote to memory of 2376 396 c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe 86 PID 396 wrote to memory of 2376 396 c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe 86 PID 2376 wrote to memory of 3328 2376 y6493242.exe 87 PID 2376 wrote to memory of 3328 2376 y6493242.exe 87 PID 2376 wrote to memory of 1092 2376 y6493242.exe 95 PID 2376 wrote to memory of 1092 2376 y6493242.exe 95 PID 2376 wrote to memory of 1092 2376 y6493242.exe 95 PID 1092 wrote to memory of 3984 1092 l9614701.exe 96 PID 1092 wrote to memory of 3984 1092 l9614701.exe 96 PID 1092 wrote to memory of 3984 1092 l9614701.exe 96 PID 396 wrote to memory of 2860 396 c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe 97 PID 396 wrote to memory of 2860 396 c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe 97 PID 396 wrote to memory of 2860 396 c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe 97 PID 3984 wrote to memory of 3736 3984 danke.exe 98 PID 3984 wrote to memory of 3736 3984 danke.exe 98 PID 3984 wrote to memory of 3736 3984 danke.exe 98 PID 3984 wrote to memory of 2560 3984 danke.exe 100 PID 3984 wrote to memory of 2560 3984 danke.exe 100 PID 3984 wrote to memory of 2560 3984 danke.exe 100 PID 2560 wrote to memory of 588 2560 cmd.exe 102 PID 2560 wrote to memory of 588 2560 cmd.exe 102 PID 2560 wrote to memory of 588 2560 cmd.exe 102 PID 2560 wrote to memory of 3732 2560 cmd.exe 103 PID 2560 wrote to memory of 3732 2560 cmd.exe 103 PID 2560 wrote to memory of 3732 2560 cmd.exe 103 PID 2560 wrote to memory of 4392 2560 cmd.exe 104 PID 2560 wrote to memory of 4392 2560 cmd.exe 104 PID 2560 wrote to memory of 4392 2560 cmd.exe 104 PID 2560 wrote to memory of 944 2560 cmd.exe 105 PID 2560 wrote to memory of 944 2560 cmd.exe 105 PID 2560 wrote to memory of 944 2560 cmd.exe 105 PID 2560 wrote to memory of 4316 2560 cmd.exe 106 PID 2560 wrote to memory of 4316 2560 cmd.exe 106 PID 2560 wrote to memory of 4316 2560 cmd.exe 106 PID 2560 wrote to memory of 3724 2560 cmd.exe 107 PID 2560 wrote to memory of 3724 2560 cmd.exe 107 PID 2560 wrote to memory of 3724 2560 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe"C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3328
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:3736
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:588
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:3732
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:4392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:944
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:4316
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:3724
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4054738.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4054738.exe2⤵
- Executes dropped EXE
PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4912
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4552
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:1568
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173KB
MD54f75b7e9d5236297dc3822bf100d5b95
SHA1e71c7797b0464cf04c495296c554ead9e6d414a6
SHA256f8a69c86a94d2aaf1610240e695f890a7040942cadcab6edfc5e403c6fa6e2a5
SHA512e51b76f89975da45d90f9e7555695892cdb8c25b4459e2457c98a9e5358af25b004cb060015153f5c86a916f4fd1e82ae90d556b703ec65b2d4359b8520e477b
-
Filesize
235KB
MD5eeb0f57daaedc904d7b3997623d00981
SHA13088f6ad9497933729120fa8a9fc57288cf8cd14
SHA2565fc9c2ac6b5221c712815672a4446a1c2f7d8d31595ff7167ae1c70024cfd899
SHA5129b331474333bf841e7603bdc4dcfea03526a3a092e03b68b72d3ff44076d464369111ca39cf184860ea2145375b717c245e97d9157a04eb2cda7188843c30da2
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce