Malware Analysis Report

2024-10-16 03:49

Sample ID 240509-m49nfseb4s
Target red1.zip
SHA256 82d1eca76037f568efb55ba04db39dbaad07d12a6fe618a601317562ac1dbdfe
Tags
amadey healer redline news dropper evasion infostealer persistence trojan lande nasa smokeloader backdoor lamp roma masha
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82d1eca76037f568efb55ba04db39dbaad07d12a6fe618a601317562ac1dbdfe

Threat Level: Known bad

The file red1.zip was found to be: Known bad.

Malicious Activity Summary

amadey healer redline news dropper evasion infostealer persistence trojan lande nasa smokeloader backdoor lamp roma masha

RedLine payload

RedLine

Healer

SmokeLoader

Amadey

Detects Healer an antivirus disabler dropper

Modifies Windows Defender Real-time Protection settings

Executes dropped EXE

Windows security modification

Checks computer location settings

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 11:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3228 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe
PID 3228 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe
PID 3228 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe
PID 4252 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe
PID 4252 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe
PID 4252 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe
PID 4740 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4740 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4740 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4252 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe
PID 4252 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe
PID 4656 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4656 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4656 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4656 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4656 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4656 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3288 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3288 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3288 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3288 wrote to memory of 4064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 4064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 4064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3288 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3288 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3288 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3288 wrote to memory of 400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3228 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9486302.exe
PID 3228 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9486302.exe
PID 3228 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9486302.exe

Processes

C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe

"C:\Users\Admin\AppData\Local\Temp\55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9486302.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9486302.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BE 2.17.196.65:443 www.bing.com tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 65.196.17.2.in-addr.arpa udp
BE 2.17.196.65:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1950649.exe

MD5 0e1b6f0e90ba0b1edb4fc89f54a3415e
SHA1 1be7b3ba729ae63f43047e3823d4a96612bee213
SHA256 ffff9bfc03141c89bfa03838cda738ce7f4fff5dc01122a959addb2cd3080f76
SHA512 4790774e1defa3c1791befc8b06ef607707a9cd3ecb6160eff9ea1e82d54e4f790aa1c752a559302882a43f46904bf06fc7a41109706101ea24c85a743478b16

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9544814.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6869307.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/752-27-0x0000000000D40000-0x0000000000D4A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9486302.exe

MD5 bfceb63e13df3126107cdbc6ef686e3e
SHA1 0bb8026c9d37249d1b066ce500c98727cfd5f44f
SHA256 762867a742a0d13a358d9cb70ce1d6dddce658f5175803c06f465713f5a3721f
SHA512 d59add02f27e06282b971a367986599a70a28bce69bdd5261e2acd6897a41140d3ee7d817bee69fd6a39786c735184f2c091f8f82f85cbc76467d1c963a9ad3b

memory/2388-32-0x00000000002A0000-0x00000000002D0000-memory.dmp

memory/2388-33-0x0000000004CC0000-0x0000000004CC6000-memory.dmp

memory/2388-34-0x000000000A720000-0x000000000AD38000-memory.dmp

memory/2388-35-0x000000000A250000-0x000000000A35A000-memory.dmp

memory/2388-36-0x000000000A190000-0x000000000A1A2000-memory.dmp

memory/2388-37-0x000000000A1F0000-0x000000000A22C000-memory.dmp

memory/2388-38-0x0000000004660000-0x00000000046AC000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2436 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe
PID 2436 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe
PID 2436 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe
PID 2944 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe
PID 2944 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe
PID 2944 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe
PID 4780 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4780 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4780 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2944 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe
PID 2944 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe
PID 3196 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3196 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3196 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3196 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3196 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 4460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 4460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1456 wrote to memory of 4460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2436 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8993884.exe
PID 2436 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8993884.exe
PID 2436 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8993884.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe

"C:\Users\Admin\AppData\Local\Temp\7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4396,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8993884.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8993884.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1898755.exe

MD5 46fefd94684eae53aa6e5b087a0e904d
SHA1 068dbc979cfba607b4320c3319d2e9c3df1834a5
SHA256 25e906edd0de04a3f742672ce04de45897f2f460a8648c237176a6054fd8f6cf
SHA512 04c4640f23b8e3f511d242b437051b124bf32290e60bb94b9eb2e7b487c1603968f9f83f991e1e981764490497749f56000bab818eb0694371bfd7ea9aebab6c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9766881.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1804739.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4324-27-0x0000000000250000-0x000000000025A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j8993884.exe

MD5 b0ebb7be5b777987cbe9de70fdddb35b
SHA1 af89cd4d09d295b810690dac596048e3e5a817f5
SHA256 f3dca7abf7b27d550fa8a24ca39adfe2a423f79bfb62986031d3eae4ef776c45
SHA512 7aca0b0b561f3d74041503c03a4291799a2e7d45b0281342d7fbb14114fdd0b8e780f44a2fb583e64ebdd27f0cda3fa21c25eb559c584683eceb3c1774073e34

memory/3540-32-0x0000000000130000-0x0000000000160000-memory.dmp

memory/3540-33-0x0000000004A10000-0x0000000004A16000-memory.dmp

memory/3540-34-0x000000000A560000-0x000000000AB78000-memory.dmp

memory/3540-35-0x000000000A0E0000-0x000000000A1EA000-memory.dmp

memory/3540-36-0x000000000A020000-0x000000000A032000-memory.dmp

memory/3540-37-0x000000000A080000-0x000000000A0BC000-memory.dmp

memory/3540-38-0x0000000004550000-0x000000000459C000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4044 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe
PID 4044 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe
PID 4044 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe
PID 2732 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe
PID 2732 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe
PID 2732 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe
PID 2732 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe
PID 2732 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe
PID 4440 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4440 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4440 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4044 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3716331.exe
PID 4044 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3716331.exe
PID 4044 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3716331.exe
PID 4852 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4852 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4852 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4852 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 768 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 768 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 768 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 768 wrote to memory of 3360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 3360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 3360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 3908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 768 wrote to memory of 3908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 768 wrote to memory of 3908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 768 wrote to memory of 3132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 3132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 3132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 768 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe

"C:\Users\Admin\AppData\Local\Temp\31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3716331.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3716331.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.115:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 2.17.196.115:443 www.bing.com tcp
US 8.8.8.8:53 115.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4862534.exe

MD5 996af6822b2ac7bf15bb8bcb917f7b96
SHA1 a9f4a3313bea5092bfd6e32b02a0d3a2e7746cda
SHA256 fbff6d654e32271874de41598bed0431628bc51b1ea447e77045f6fd8d6aaa52
SHA512 26ed9745803ddcab8d9ed01e8968668ed401be1f46a8c5061f5a72887ad96483376bbd83e596296e8f7bc889f27d4246ddd4cef6adefb70ee977e02a513545af

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0530051.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3092-15-0x00007FF82E543000-0x00007FF82E545000-memory.dmp

memory/3092-14-0x0000000000570000-0x000000000057A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3198279.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3716331.exe

MD5 fc7575d9cc38d254cd64e4b9893773ec
SHA1 5379222770e783bbd9da64e64c8030b7090f9b69
SHA256 416a2e8145f73c951c0249168391a9a20abbda8f3180d9aa4ea7011e3e7f223f
SHA512 d001c7bde5686b5f8f67d6f844b23a2ade25eeb5f6412143daa83f48ff14326aaccdbbb8ed458a27f0293be0e1c50e4fe1c06a42fbcb92831ca4caa0fcecf331

memory/3844-33-0x0000000000090000-0x00000000000C0000-memory.dmp

memory/3844-34-0x0000000002480000-0x0000000002486000-memory.dmp

memory/3844-35-0x0000000005120000-0x0000000005738000-memory.dmp

memory/3844-36-0x0000000004C20000-0x0000000004D2A000-memory.dmp

memory/3844-37-0x0000000004B60000-0x0000000004B72000-memory.dmp

memory/3844-38-0x0000000004BC0000-0x0000000004BFC000-memory.dmp

memory/3844-39-0x0000000004D30000-0x0000000004D7C000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4524 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe
PID 4524 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe
PID 4524 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe
PID 1520 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe
PID 1520 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe
PID 1520 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe
PID 3348 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe
PID 3348 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe
PID 3348 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe
PID 3348 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe
PID 3348 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe
PID 3592 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3592 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3592 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1520 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe
PID 1520 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe
PID 1520 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe
PID 3212 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3212 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3212 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3212 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3212 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3212 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 4272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 4272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 4272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4580 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4524 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5591518.exe
PID 4524 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5591518.exe
PID 4524 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5591518.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe

"C:\Users\Admin\AppData\Local\Temp\4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5591518.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5591518.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.97:443 www.bing.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.196.17.2.in-addr.arpa udp
BE 2.17.196.97:443 www.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2938738.exe

MD5 a6cf36ef0cb936be2e48b770ffaa692a
SHA1 c852ab2016c488531c2360ccb45100d41d27087a
SHA256 350b02638361c39cdfc97bdcd6aa8da65ada1391d622ccbf771876cb1907071c
SHA512 58786472efff11a8883ca0567a43075d8ebe7d639fd13d6d131b5b10fbb5dcceaa6ae2907d8baadadf71dd72df233f9e09434c812b45000e7e8699a4e08717bc

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4832294.exe

MD5 c8b837d87424640f379241af42394991
SHA1 8be0131290c7a0ff0492eb154662a2ab0eead141
SHA256 361030ee64076cbd0a45dfd2b842caa68e89a2ed513db0c428148672e0aa4161
SHA512 2d420050100972abd2a39802b9a60fef7854fac1a55667cee6d335db50501e058f0c9fb6940b0a088961e286940ebcf061976b13ed7b6bb943c822090a6693b8

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3588610.exe

MD5 f42c5e225d737b9c3fee86c53fcde9e1
SHA1 194f0b1858498d790ffc30a750e689f8677a76e2
SHA256 d3362dd3c549e8bf353de30125a3730b33efac4e127bd0eb24eb66a197ec09e0
SHA512 6b0560f2b4e11bf154311db52d8cb4e04b8d2ee21fd26d1cefece829d13541fa0c3194115175a8d65c1c3f9fe86eb68b5eb74ec6bf374ca3aa5b87b4b8c90a92

memory/1176-22-0x00007FF98D293000-0x00007FF98D295000-memory.dmp

memory/1176-21-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6542666.exe

MD5 89d742e7e14729b64f3789a49431df00
SHA1 a62b8f96272e8762500c43a76fb2d39bf6b0ad28
SHA256 e2cd2b696d33cfc0738eded231b9f1d67a0cc77bcaea5fb5c88998eadc737829
SHA512 b8375f5c0648b5606d89e894485312cdb39becbf433a6983e8868effe660d856907a1d1379af985f5f8769b8c695461519c34f47d2ca620a50d17ee77193992e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1964322.exe

MD5 3802989e409dbf4ae29081fe55df7e25
SHA1 2335b8445d874ef1471ab98c51f8a5e327c47bcc
SHA256 ef9af28db9eb7e1030ebfd255f0294c5515d3af2432b4374346e2f839de26b90
SHA512 4afabcbe96c7edb6b850685aa4a9d295900df9b986622d482106c2e297c11a8d87bcd4b778f7173570a2021263b4cf59c2790268c36600a97150b4167dab257d

memory/1724-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5591518.exe

MD5 31df0894347caaaef259e2e74c3273ca
SHA1 61b731be9911b72c2e25367e276409efa7729911
SHA256 bd52ad8d28113281760dad60a2dc8a80c4dbd355b5fc99fd6683da38458e2562
SHA512 31d78f923d89b65363679c8693707f41fea3a58a5f87fc87d01829c9202825d6c41eb9278d01a4ae64989cdd7cac708f64dffdf3e25a3a1a679f53286c271a6e

memory/388-45-0x0000000000050000-0x0000000000080000-memory.dmp

memory/388-46-0x0000000004970000-0x0000000004976000-memory.dmp

memory/388-47-0x000000000A480000-0x000000000AA98000-memory.dmp

memory/388-48-0x000000000A000000-0x000000000A10A000-memory.dmp

memory/388-49-0x0000000009F40000-0x0000000009F52000-memory.dmp

memory/388-50-0x0000000009FA0000-0x0000000009FDC000-memory.dmp

memory/388-51-0x0000000004470000-0x00000000044BC000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3916 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe
PID 3916 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe
PID 3916 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe
PID 2176 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe
PID 2176 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe
PID 2176 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe
PID 2176 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe
PID 2176 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe
PID 1896 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1896 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1896 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3916 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6152555.exe
PID 3916 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6152555.exe
PID 3916 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6152555.exe
PID 2308 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2308 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2308 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2308 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 1836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 1836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 1836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 4600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 4600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2840 wrote to memory of 4600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe

"C:\Users\Admin\AppData\Local\Temp\62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6152555.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6152555.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0762839.exe

MD5 9b05545da44ea75e8e8406b990a5b83b
SHA1 91b526547ae1cecef5bb72b4df121ab9bb04f827
SHA256 80578906947084bdf4995b58459ba0f8894c86dcdd13c8dd1ef57fa614ccb644
SHA512 5ce2f64618677b55d2e39ada55eb5cccba31fcc258823357cbb21528683338eb518abe988a643c2084cb4af281f80ebce0c4d639f83bebe87ae66f6bc8882965

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233844.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2584-14-0x00007FFA1B650000-0x00007FFA1B672000-memory.dmp

memory/2584-15-0x0000000000700000-0x000000000070A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1596110.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6152555.exe

MD5 4dbbdddb201a99a455dea7806e63a0cb
SHA1 1d83fc65a0157e821dbc21abde2153b041bb65ee
SHA256 5f82d5bc4d3a8711a57d5aeca1218838e3c008f019b03a649368793b2b2c2de8
SHA512 688dfea3659bf6af4fd909481c3f7cc0535ef4bd0c0fb84c06d8f277855bf777dcf78bc9e4f3e1b5412ce5eb4d1d97f8d441c9387b41cdcaa0c9dfa800f39e3c

memory/4488-33-0x00000000005F0000-0x0000000000620000-memory.dmp

memory/4488-34-0x00000000027A0000-0x00000000027A6000-memory.dmp

memory/4488-35-0x0000000005590000-0x0000000005BA8000-memory.dmp

memory/4488-36-0x0000000005080000-0x000000000518A000-memory.dmp

memory/4488-37-0x0000000004F90000-0x0000000004FA2000-memory.dmp

memory/4488-38-0x0000000004FF0000-0x000000000502C000-memory.dmp

memory/4488-39-0x0000000005030000-0x000000000507C000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9712f3ca55a69dc82a720b41eeb39aa2d2482719c764715d774a1d1d1d11ea1a.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7654585.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\9712f3ca55a69dc82a720b41eeb39aa2d2482719c764715d774a1d1d1d11ea1a.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9712f3ca55a69dc82a720b41eeb39aa2d2482719c764715d774a1d1d1d11ea1a.exe

"C:\Users\Admin\AppData\Local\Temp\9712f3ca55a69dc82a720b41eeb39aa2d2482719c764715d774a1d1d1d11ea1a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7654585.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7654585.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8354031.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8354031.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.113:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 113.196.17.2.in-addr.arpa udp
BE 2.17.196.113:443 www.bing.com tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 52.111.227.11:443 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7654585.exe

MD5 a27cd89a9b3edaa1a4f0e7f11451238e
SHA1 be203c693c3ab8b3e9c28ab33eb541e35c9eacbf
SHA256 b7fdb34a5765c492b175737d1d88e9ab2911f9fe7b13a93a3ea4cbe0efd6babf
SHA512 98b4bbcf7889f32a4110140e3ad8baf96c4451b3bdf8baa2fad7510d58ece5ac58e7058a8f33e754e9cc7200b041f9c423b6dd91d8bbf27cab0bc5c46e66f44a

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9256657.exe

MD5 8a11616e213bdee093a33b9f90b961cd
SHA1 2789b9f6b990f2ee80ccb6d955fdfaf23bbc42e2
SHA256 bbf171f9906b63b6fe5f6c4efd4bcb47878c93817276ca9abbf719630eb0b85a
SHA512 f47e87696740203efaeb912631b9481059a0e3dff4263605788dc4204a50f15b0d9f46f7fb34438b2e53fcd57fe024bc3dd7634f2a09f6f805448ab6e72668d4

memory/3612-15-0x0000000000EE0000-0x0000000000EEA000-memory.dmp

memory/3612-14-0x00007FFAEE1F3000-0x00007FFAEE1F5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8354031.exe

MD5 7db17099ccd4e1be9690412eaacf9a3f
SHA1 a9d22067db19d0f7e4bff66597778ff43aa12833
SHA256 dd8192ebd57226ded99ea00e4bddda2803fc08cdbfa59245e1c97a1f30bb13c3
SHA512 c3b4f0d5a18c0c546d267753687082ff3f5b8da1899549b2948096078e136b36368073fbf796c27f13930c7053f6abf69808024185c5068d9cf3ff4b2ee736a0

memory/3276-20-0x0000000000F20000-0x0000000000F50000-memory.dmp

memory/3276-21-0x0000000003080000-0x0000000003086000-memory.dmp

memory/3276-22-0x000000000B260000-0x000000000B878000-memory.dmp

memory/3276-23-0x000000000AD90000-0x000000000AE9A000-memory.dmp

memory/3276-24-0x000000000ACD0000-0x000000000ACE2000-memory.dmp

memory/3276-25-0x000000000AD30000-0x000000000AD6C000-memory.dmp

memory/3276-26-0x0000000005260000-0x00000000052AC000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4464 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe
PID 4464 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe
PID 4464 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe
PID 4808 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe
PID 4808 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe
PID 4808 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe
PID 4808 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe
PID 4808 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe
PID 4476 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4476 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4476 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4464 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t7163927.exe
PID 4464 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t7163927.exe
PID 4464 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t7163927.exe
PID 5016 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 5016 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 5016 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 5016 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 4324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 4324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 4324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 3504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 3504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 3504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 4996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 4996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 4996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1424 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe

"C:\Users\Admin\AppData\Local\Temp\a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t7163927.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t7163927.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
BE 2.17.196.113:443 www.bing.com tcp
US 8.8.8.8:53 113.196.17.2.in-addr.arpa udp
BE 2.17.196.113:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7809867.exe

MD5 549ddaea9fb608c75086246a1291329a
SHA1 0f14d04a45f4fcae2dd0432d2ca6203fc0772be8
SHA256 7bf1fc553fdd3806ff65cf9a091d8c46550f317415bab510f5d85c76d74381c4
SHA512 2283def7f96e5b9a820d1f9ef47a6c46560d034fb5b6f327bcb709cb0703820807193b4a46e94b3a6c0b54172c4a0f3f4354b2d1e87cd43b8470b4b3131fffe3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p2409854.exe

MD5 ef17b7ccd5021fdd1e4edee1c521dfb4
SHA1 1c1d14da4590252e3c278afb9661192d3624f061
SHA256 64136b8ce42867a690b47acc478e75a9ebe52c6efd6281b5a771079f74ae8d26
SHA512 6c42aae122cf3f2e7beb19281a8f97f21829059f0f0d802b227d4c0a44a8b2ceee553219d02be86adf71c0d2149afa7d16338a56a67ae99b087d93789761a42b

memory/1580-14-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

memory/1580-15-0x00007FF8CB9B3000-0x00007FF8CB9B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1598820.exe

MD5 3b0cd323f293edda582f6ce4ebaed0c5
SHA1 15cb067ca5e5066c356a266200a021dac7674444
SHA256 aa5c1279d6d0a88f406a451e90ed875a6d3a2dc3b85ec7709278c92507857947
SHA512 9f4926c66b01df45fd5e9d8435732b7dcb8d309149e4bdda9cf45939237551b89fae8c76460c39268f7b44c8cdb31abe5c4d4b0614a605e010140de19f87cec1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t7163927.exe

MD5 693bcaa61ddc61595ae3626e19bdc9b9
SHA1 20fe9e616ac7bf6608a59a00557864a2c6a7ca1e
SHA256 3e4d1db13a4303fd7541043786d9788e5b2423dba3baa4caf1244af8751429fa
SHA512 51d1799d2c32ff130b59f75fe79ef345a35fb641b2c710cf7690802fb6cc4a4646be1658f38b7bfdd50d0ddf011e22161b0900c098e729daedcc037dc31b49c0

memory/4792-33-0x00000000001F0000-0x0000000000220000-memory.dmp

memory/4792-34-0x0000000004A10000-0x0000000004A16000-memory.dmp

memory/4792-35-0x00000000051C0000-0x00000000057D8000-memory.dmp

memory/4792-36-0x0000000004CB0000-0x0000000004DBA000-memory.dmp

memory/4792-37-0x0000000004A70000-0x0000000004A82000-memory.dmp

memory/4792-38-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

memory/4792-39-0x0000000004C20000-0x0000000004C6C000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe

"C:\Users\Admin\AppData\Local\Temp\bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 13.107.253.64:443 tcp
GB 172.217.169.74:443 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe

MD5 e6b4ba6f5d76a4719f406cd3aca3b9a7
SHA1 77a6d0a2e77a71534c848a111573f6af326ce5dc
SHA256 96356b86475b7fbf7dce2734b64e0ed95cba6b5a7be0efcb71bf469965457adb
SHA512 ae8b1d3801243dc81ad6288cc449d90ced08d8a34039a8fd07b09557a6fd52213cb08b334f63e1dcdd0110de12dfc7d9ff24e2886bec6175927a385baf1d0486

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe

MD5 84983a334ac089ec14cf05f1c0605bef
SHA1 6836067a70683845a7e773d1f28f1cb9e4138d15
SHA256 e4c23c0d96badfd1ea7612225bd61898a296a585b69230989ee61ecd87fcc57b
SHA512 0ea33bab35c21d5612219337945079d3cac74552c776e379bdbeac809538f600b5a2eb17a6877f7fd1956fad3cdea651fd0b9abde76c5be8a2c1fbc686225080

memory/2484-14-0x00007FFC3D7F3000-0x00007FFC3D7F5000-memory.dmp

memory/2484-15-0x00000000008F0000-0x00000000008FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe

MD5 36fe0ab069c8ee215f9b18e10bb5a184
SHA1 42a3650d4fbda059640555bce0be87544556870d
SHA256 f492ece3bdadd718f42d07315e318b307757c406025d07bfaf56e619232eb9de
SHA512 a201e8d2a5fdd44f2aea01b9ba1ea51ae6c75c40979a912212bea270b223d2f686b271879a5cca2cab01fb3bdbc01d5719bdf4fe7691c878fc3dbd05b79ab06e

memory/1296-20-0x0000000000310000-0x0000000000340000-memory.dmp

memory/1296-21-0x0000000004B30000-0x0000000004B36000-memory.dmp

memory/1296-22-0x000000000A740000-0x000000000AD58000-memory.dmp

memory/1296-23-0x000000000A2C0000-0x000000000A3CA000-memory.dmp

memory/1296-24-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/1296-25-0x0000000004B70000-0x0000000004BAC000-memory.dmp

memory/1296-26-0x000000000A1E0000-0x000000000A22C000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4136 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe
PID 4136 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe
PID 4136 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe
PID 1220 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe
PID 1220 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe
PID 1220 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe
PID 1220 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe
PID 1220 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe
PID 2520 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2520 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2520 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4136 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9925328.exe
PID 4136 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9925328.exe
PID 4136 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9925328.exe
PID 3500 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3500 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3500 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3500 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3256 wrote to memory of 4428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3256 wrote to memory of 4428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3256 wrote to memory of 4428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3256 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3256 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3256 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3256 wrote to memory of 556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3256 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe

"C:\Users\Admin\AppData\Local\Temp\4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9925328.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9925328.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.75:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.75:443 www.bing.com tcp
US 8.8.8.8:53 75.196.17.2.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5561416.exe

MD5 06eb179deca33c91e7d24ead602161c8
SHA1 4d1820ad56b4d9786f089dc6e1548efe3b5fc37a
SHA256 86db0959564d815df771fb195d70a271421ce57da65bc2985b655f9f9a1ff886
SHA512 989e0fa36525813dfc281ff7416d906d18e50b2d36461eb91ceb42ed8a035791f0d2171d55915528cc8df6cf59cba371d5741762d241099ff4623ff9cfea6d3b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0060239.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1988-14-0x0000000000500000-0x000000000050A000-memory.dmp

memory/1988-15-0x00007FFCF97E3000-0x00007FFCF97E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3817400.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9925328.exe

MD5 d7cda797b9c584fcf98555ef3bc3adaf
SHA1 d3352ccb80d85a1005246541d8137a8274e19b00
SHA256 f96f415c79ab66c72bb7f20fd2108e7978b411ba8dcc0b4732995de62ce589f5
SHA512 7c09f54e3887d2b39a068dd173a28a429f5f14c852fa9365ebdb9f6b5acfae9400adc8820558377f7bcd0cd16de0a7abfb56fcb90eac69bb0635e96f668a36c3

memory/4176-33-0x0000000000B00000-0x0000000000B30000-memory.dmp

memory/4176-34-0x0000000001430000-0x0000000001436000-memory.dmp

memory/4176-35-0x0000000005BC0000-0x00000000061D8000-memory.dmp

memory/4176-36-0x00000000056B0000-0x00000000057BA000-memory.dmp

memory/4176-37-0x00000000055D0000-0x00000000055E2000-memory.dmp

memory/4176-38-0x0000000005630000-0x000000000566C000-memory.dmp

memory/4176-39-0x00000000057C0000-0x000000000580C000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1800 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe
PID 1800 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe
PID 1800 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe
PID 3416 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe
PID 3416 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe
PID 3416 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe
PID 3516 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe
PID 3516 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe
PID 3516 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe
PID 3516 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8809867.exe
PID 3516 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8809867.exe
PID 3516 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8809867.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe

"C:\Users\Admin\AppData\Local\Temp\a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8809867.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8809867.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.75:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 75.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.75:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe

MD5 e5497322f71d635495045cbd61c55b63
SHA1 b1b81f4f470bf4511ac047a3a7fd1029e11775e2
SHA256 d818e38a5f67f74b3830741e825c99bc5af0417574efa86effe15e1a52a5b83a
SHA512 43a4b3f02b6aa72b8c6a3ecb7d831cf321384513573532ce36ecb79acb96b5644019969f823c924daf23f5a9bf6a0b942c6aebeaa529897e0752f3f85f85bb27

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe

MD5 e3aeed7464a15a54b799c7f7cd1351ad
SHA1 e29bf1925284d025253a83ebcf3f43c8eebaef4c
SHA256 77fd1e8025ac167ebffd85262eea82987650aaf13577cc00c1277fa7a52bd865
SHA512 d65d02e128aa275a01df2a33558b92eb3a9b27a7a2a34b19595f77b62c121d31db0277352d4eea410ef23c49cf837e974d947cece22b73055c67f31bb38459a1

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe

MD5 b233dad928a40509fbd052dc86b3f1d3
SHA1 f33b9970e592903e573c0e8c6c9cf716b197aa11
SHA256 96f5b677852225d7a74cc500300101087cf7ce143bc7eab75952142ecb52f2ad
SHA512 ec01e18789a2aee6fa2ad98fc8567ac27af69e2db8706ec8780793460363a1e1d76ce0351aa90a586c9e9b10146bca7281959b05154abf72f02bf9ad9f59244e

memory/1292-22-0x0000000000740000-0x000000000077E000-memory.dmp

memory/1292-27-0x0000000000401000-0x0000000000404000-memory.dmp

memory/1292-28-0x0000000000740000-0x000000000077E000-memory.dmp

memory/1292-29-0x0000000004460000-0x0000000004461000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8809867.exe

MD5 e52911bc1933eb3cac93d97fd9cd9634
SHA1 ddd957a746281b351e4b4172762730ada4b3e5d2
SHA256 eec7e6ff5212af652abd5afd062000557f211d334bd7f184617dd65cab4982ac
SHA512 f643fdf1d5b60ddd79b948d25639966a7b5c3e97779021f7979db10628f2935bcdfadcbe6b5927a13552ca4ac49ff6c710c6785bbad65c3672b5e7df162e8187

memory/3528-35-0x0000000001FE0000-0x000000000206C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/3528-42-0x0000000001FE0000-0x000000000206C000-memory.dmp

memory/3528-44-0x00000000023C0000-0x00000000023C6000-memory.dmp

memory/3528-45-0x000000000A500000-0x000000000AB18000-memory.dmp

memory/3528-46-0x0000000009EE0000-0x0000000009FEA000-memory.dmp

memory/3528-47-0x0000000006A70000-0x0000000006A82000-memory.dmp

memory/3528-48-0x0000000006A90000-0x0000000006ACC000-memory.dmp

memory/3528-49-0x0000000009FF0000-0x000000000A03C000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 396 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe
PID 396 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe
PID 396 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe
PID 2376 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe
PID 2376 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe
PID 2376 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe
PID 2376 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe
PID 2376 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe
PID 1092 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1092 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1092 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 396 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4054738.exe
PID 396 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4054738.exe
PID 396 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4054738.exe
PID 3984 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3984 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3984 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 3732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 3732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 3732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 4392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 4392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 4392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2560 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe

"C:\Users\Admin\AppData\Local\Temp\c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4054738.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4054738.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.56:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.120:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
BE 2.17.196.120:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 120.196.17.2.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6493242.exe

MD5 eeb0f57daaedc904d7b3997623d00981
SHA1 3088f6ad9497933729120fa8a9fc57288cf8cd14
SHA256 5fc9c2ac6b5221c712815672a4446a1c2f7d8d31595ff7167ae1c70024cfd899
SHA512 9b331474333bf841e7603bdc4dcfea03526a3a092e03b68b72d3ff44076d464369111ca39cf184860ea2145375b717c245e97d9157a04eb2cda7188843c30da2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2141323.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3328-14-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

memory/3328-15-0x00007FFB21DA3000-0x00007FFB21DA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9614701.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4054738.exe

MD5 4f75b7e9d5236297dc3822bf100d5b95
SHA1 e71c7797b0464cf04c495296c554ead9e6d414a6
SHA256 f8a69c86a94d2aaf1610240e695f890a7040942cadcab6edfc5e403c6fa6e2a5
SHA512 e51b76f89975da45d90f9e7555695892cdb8c25b4459e2457c98a9e5358af25b004cb060015153f5c86a916f4fd1e82ae90d556b703ec65b2d4359b8520e477b

memory/2860-33-0x0000000000B20000-0x0000000000B50000-memory.dmp

memory/2860-34-0x0000000002E00000-0x0000000002E06000-memory.dmp

memory/2860-35-0x0000000005CC0000-0x00000000062D8000-memory.dmp

memory/2860-36-0x00000000057B0000-0x00000000058BA000-memory.dmp

memory/2860-37-0x00000000055E0000-0x00000000055F2000-memory.dmp

memory/2860-38-0x0000000005640000-0x000000000567C000-memory.dmp

memory/2860-39-0x00000000056A0000-0x00000000056EC000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240426-en

Max time kernel

141s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1428 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe
PID 1428 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe
PID 1428 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe
PID 1532 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe
PID 1532 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe
PID 1532 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe
PID 3560 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe
PID 3560 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe
PID 3560 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe
PID 344 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe
PID 344 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe
PID 344 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe
PID 344 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe
PID 344 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe
PID 3560 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8157648.exe
PID 3560 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8157648.exe
PID 3560 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8157648.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe

"C:\Users\Admin\AppData\Local\Temp\f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8157648.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8157648.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 2.17.196.106:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 106.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
BE 2.17.196.106:443 www.bing.com tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe

MD5 5975b6e2c53907e72a35e89a69829c36
SHA1 bdeaf1c68fe28de49e2c923868060d4bb7d4dfd0
SHA256 bd3cb6e81880ffa0c32fb408d60ef9974e2b6ff06b13a928e9f69b459517457d
SHA512 6ddef808b8eb0a2db8a1b4db953fe6b92d653e2208660a27e0bf2be312da11f0261f3a5a7bc9364274b1c25c8b42544c5413b0fd0bd94ec27d7a7ee8f0fbb4fb

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe

MD5 b3b5e12b2eb24482da326a731dc7d362
SHA1 e3d53b6262147ccb92342c2aab19286267c95e0d
SHA256 147a26be6100b3209d27a17a0c9915c9e88285e81a21f4a71ef39a44166b5570
SHA512 bee0b1e67b76719522a982e0a3c8a1e64240deb1586f94b6cf93ecc80573e3a9fddf4ab98e698545eddc74099ec9f074ead9991ca2dd7ac3a0a55e2ef55acd76

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe

MD5 36868cf42a0fa5357de5d91a49b02ec2
SHA1 826cfb70a23f86f8fa5887c346db91ddc5a81c05
SHA256 041152e94915786645759f52877ae1c2c8657d5e6576cd62de073bca45655978
SHA512 e5361aa1c45edb2400984a78577c1c7b0833ef110254d6e5748d92c6e2c64326c9c10a40912a95c271df1d65108712e24b74851c725849c77217fd95ce518583

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe

MD5 f6f6c1d86e71979c2881590fd84e006f
SHA1 9fa7bb5ae2f4df1cc75792a9c88a4cc2a21d435a
SHA256 fac89f40c173b98d2c6b0955c4d8385b8aa3bb3e1b0e9c30238e71e05529a6f5
SHA512 22b6376d651d6ee4a36374931288e86cd986a3d10fb0800bdfbd421e88889ed664d295dd37d35647eb1c67349050147ef7c94bb18f921385e3e9c942b107473c

memory/4428-28-0x0000000000540000-0x000000000054A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/404-37-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8157648.exe

MD5 04620d9fe2a5325defb2976d91136961
SHA1 2d6093b077dc8c25a645040b4d293b81fcfd0515
SHA256 4428e22ca4b63c5c6ff73cbe6feb7516c02768a3ffa990398ca70ab87fad7fc9
SHA512 1f72eafbfffce0a1222ddb201b63f0d1dfd991f847d57d8847b2221cfe01e49307179533202ad6937f1685eae6170a3d6a1d0b91ac8853614ff3127a62905ac3

memory/3124-42-0x0000000001F30000-0x0000000001F60000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/3124-47-0x00000000022F0000-0x00000000022F6000-memory.dmp

memory/3124-48-0x0000000005200000-0x0000000005818000-memory.dmp

memory/3124-49-0x0000000004C00000-0x0000000004D0A000-memory.dmp

memory/3124-50-0x0000000004D40000-0x0000000004D52000-memory.dmp

memory/3124-51-0x0000000004D60000-0x0000000004D9C000-memory.dmp

memory/3124-52-0x0000000004E00000-0x0000000004E4C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240426-en

Max time kernel

140s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2424 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe
PID 2424 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe
PID 2424 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe
PID 3344 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe
PID 3344 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe
PID 3344 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe
PID 4808 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe
PID 4808 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe
PID 4808 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe
PID 2180 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe
PID 2180 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe
PID 2180 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe
PID 3216 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe
PID 3216 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe
PID 3216 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe
PID 3216 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe
PID 3216 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe
PID 2180 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2955605.exe
PID 2180 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2955605.exe
PID 2180 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2955605.exe

Processes

C:\Users\Admin\AppData\Local\Temp\27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1.exe

"C:\Users\Admin\AppData\Local\Temp\27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2955605.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2955605.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
BE 2.17.196.113:443 www.bing.com tcp
BE 2.17.196.113:443 www.bing.com tcp
US 8.8.8.8:53 113.196.17.2.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4706679.exe

MD5 d99c9e8014fd98a5853bb0080066e936
SHA1 e237506f5dafe36d584654d17a9d89789e49abbc
SHA256 7eef2bc77210dfb371441f3047d2846eab00efa17776e8dd2174dc6cfcc22651
SHA512 f0d38b9baae2e87de9c0d0445c7aca43721cd1ff8a37ca8b56a7641cf09e9b1d08a15f83d2750f7c56c6b6e85f44d491d559cf91004102b66910561ba0e02f76

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4373698.exe

MD5 f6d64813192fad614a257adbf420648b
SHA1 71fbc5cf4b03d9835ccf416f6ac9e3c87d023021
SHA256 c9efc07dc3d1de7d09ef98482efbab50d57d8536b9e046b68e6390bfa840f5bb
SHA512 73c5accc42fc873a26095b0468918d98cf8d5761229903fc08c02008d836bbf84ca89f0c7f3a494138c33e2fd173a57e0437be4f9a5d548071fec946f35afd6f

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5824928.exe

MD5 b961bbd078d1fe381fcbc28cf386e581
SHA1 cb07ff1e265bf9b3981407b19a3a3b5b6d6f4118
SHA256 934e3940690b574644d70bfc00cc2145298402b2db4c227d4ce50a3b4e38b33b
SHA512 054e1a710393e2d8943969768b0e0d740eccfa67f011aa70a45b94df493c51693f20f5fff89d985f105ae154a8fc0d0a530d2ef997d514169ebc3bcf1243b4da

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6920833.exe

MD5 7fe7107090dd0b3d88aedc6546e1cc4e
SHA1 47b7e6e0362bcfbeba92920c9d2a97d2d91464e8
SHA256 cd505eae50fdf3b4cdf9ca2e8cd92aa71083e5f5f8a5fabdfdffd29a18688182
SHA512 11e173dfe65c8594f3fe5095eb0f27115c0048bf6341c09a771234ca5e346dee102fada41f4ec80da3460371e121e12fedacb63547ffc46b6a3fd7d0e068a8b8

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5662532.exe

MD5 7b9509824ecbc98098a72bd9f82255ef
SHA1 66b515d756229e615b8c0b3cac95e8189589f4d4
SHA256 937c45336dcd8317bbc60a49b4664044624e1090feeb6d64bca4a62d29e825ab
SHA512 cec8b69950b259f484f61b63c6300ccfaf2d95daf8a791613514b90dc80a766bf6aae4662555382a0892534b1f0774d0e5794aadb13d78e83f4b049d590287dc

memory/3700-35-0x0000000000490000-0x00000000004CE000-memory.dmp

memory/3700-41-0x0000000000490000-0x00000000004CE000-memory.dmp

memory/3700-42-0x00000000021F0000-0x00000000021F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b9621859.exe

MD5 4bd6694914cb2de0d5e4a1cc0b1c1f74
SHA1 2f5ad161de0a4735376060d4bac8c58fe8b7107d
SHA256 97fe71d12da003907a0b02de0940a32851e8a7052cf5b4070643cc8c136c7408
SHA512 54104ccf23ec91c77552527d5e279d8831c83ec5a829a6af5446c49198cefe8c7edc5ffcc97b7cbdff86e3f5925d94966206d3d1c284766c4ed92ecb4b951043

memory/1420-48-0x0000000000B50000-0x0000000000B5A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2955605.exe

MD5 ac523d21c55d2d2644043c53e75c55f2
SHA1 eef365e4a038081b448ca57c1a62442a91337922
SHA256 568f3c159a41a0e2bc796dae311399b219263b9cf560c8ee35097e5f82c4a9fd
SHA512 0b0f50e108d2a732745b3613fc578d3883747a71b147725db977122e9b9fa52ce56e29ba5b6300da237d7f6e414b4c8b7a4ef296b2539b6e266764a4b1947672

memory/1948-53-0x0000000000950000-0x00000000009DC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/1948-60-0x0000000000950000-0x00000000009DC000-memory.dmp

memory/1948-62-0x00000000023E0000-0x00000000023E6000-memory.dmp

memory/1948-63-0x0000000009FA0000-0x000000000A5B8000-memory.dmp

memory/1948-64-0x000000000A5C0000-0x000000000A6CA000-memory.dmp

memory/1948-65-0x0000000006CF0000-0x0000000006D02000-memory.dmp

memory/1948-66-0x000000000A6D0000-0x000000000A70C000-memory.dmp

memory/1948-67-0x0000000006A00000-0x0000000006A4C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 11:02

Reported

2024-05-09 11:05

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1016 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe
PID 1016 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe
PID 1016 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe
PID 2780 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe
PID 2780 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe
PID 2780 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe
PID 1688 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1688 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1688 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2780 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe
PID 2780 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe
PID 2600 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2600 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2600 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2600 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1092 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2498725.exe
PID 1016 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2498725.exe
PID 1016 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2498725.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe

"C:\Users\Admin\AppData\Local\Temp\2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2498725.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2498725.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.65:443 www.bing.com tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.65:443 www.bing.com tcp
US 8.8.8.8:53 65.196.17.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5924303.exe

MD5 799a816ea4d3026a25c673503b6821ea
SHA1 74fcbc62374af486599c392a94afc6859ede3fad
SHA256 31e450f20ad58e7cc3658ccccd0a02b68dcd50f18461a0f3080264a3aac5bf75
SHA512 97c5bfc0a370d44ab6fbd17a7d2b81e30e7e70c5de8e0b0b77f00a226052af23654014ab0062588b1c557cd3ab3bb2214a50dfe967838c51ae5c0f8248430c5d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4719279.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3322917.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4480-27-0x0000000000140000-0x000000000014A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2498725.exe

MD5 08fd147a1e9edded8d0bd4e2d606b190
SHA1 3751f9a867c5a9754d058ba1dcd475e2d4acf85d
SHA256 af53befab6e920f24d498773a18ceff54ab78c6f9a8f2609d4cd693486db7eb9
SHA512 645f0c318608308e011c563030a25fec36e199fe9c74a6b684a0008a7c75af6771728276414db61495316deb032bd6cb006779fef39abf68afb92ec16c629a2a

memory/1916-32-0x0000000000010000-0x0000000000040000-memory.dmp

memory/1916-33-0x00000000022A0000-0x00000000022A6000-memory.dmp

memory/1916-34-0x000000000A480000-0x000000000AA98000-memory.dmp

memory/1916-35-0x0000000009FC0000-0x000000000A0CA000-memory.dmp

memory/1916-36-0x0000000009F00000-0x0000000009F12000-memory.dmp

memory/1916-37-0x0000000009F60000-0x0000000009F9C000-memory.dmp

memory/1916-38-0x0000000002160000-0x00000000021AC000-memory.dmp