Malware Analysis Report

2024-10-16 03:46

Sample ID 240509-mx45dsgd72
Target red.zip
SHA256 1fdd5f3e8505e6e6d5694fd5bb78388c9f5ca6f38c5a2c066159adca4a10d217
Tags
amadey healer redline papik dropper evasion infostealer persistence trojan masha privateloader risepro loader stealer smokeloader backdoor nasa lande lamp grom
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1fdd5f3e8505e6e6d5694fd5bb78388c9f5ca6f38c5a2c066159adca4a10d217

Threat Level: Known bad

The file red.zip was found to be: Known bad.

Malicious Activity Summary

amadey healer redline papik dropper evasion infostealer persistence trojan masha privateloader risepro loader stealer smokeloader backdoor nasa lande lamp grom

RedLine payload

Detects Healer an antivirus disabler dropper

Healer

SmokeLoader

RisePro

RedLine

Amadey

PrivateLoader

Modifies Windows Defender Real-time Protection settings

Executes dropped EXE

Drops startup file

Windows security modification

Checks computer location settings

Adds Run key to start application

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 10:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\699bfc597d56fb4ed7153a5a4fe2851361b9e27b9b8c3109277f0c5a54afbe1d.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\699bfc597d56fb4ed7153a5a4fe2851361b9e27b9b8c3109277f0c5a54afbe1d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\699bfc597d56fb4ed7153a5a4fe2851361b9e27b9b8c3109277f0c5a54afbe1d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe
PID 2016 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\699bfc597d56fb4ed7153a5a4fe2851361b9e27b9b8c3109277f0c5a54afbe1d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe
PID 2016 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\699bfc597d56fb4ed7153a5a4fe2851361b9e27b9b8c3109277f0c5a54afbe1d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe
PID 4552 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe
PID 4552 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe
PID 4552 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe
PID 1644 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe
PID 1644 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe
PID 1644 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe
PID 1644 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe
PID 1644 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe
PID 1836 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1836 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1836 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4552 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3659694.exe
PID 4552 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3659694.exe
PID 4552 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3659694.exe
PID 1048 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1048 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1048 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1048 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1800 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1800 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1800 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1800 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 3264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 3264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 3264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 3408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1800 wrote to memory of 3408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1800 wrote to memory of 3408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1800 wrote to memory of 924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1800 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\699bfc597d56fb4ed7153a5a4fe2851361b9e27b9b8c3109277f0c5a54afbe1d.exe

"C:\Users\Admin\AppData\Local\Temp\699bfc597d56fb4ed7153a5a4fe2851361b9e27b9b8c3109277f0c5a54afbe1d.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3659694.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3659694.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.156:19071 tcp
FI 77.91.124.156:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.124.156:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.156:19071 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 77.91.124.156:19071 tcp
FI 77.91.124.156:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3729429.exe

MD5 ac7160a3a1348b7da03856747d06cf62
SHA1 1eeb5c204b328ecd5e2f6fec87f0be66f2602ba0
SHA256 45c8c7c27353265cc8a41357f40d155ee0c4ebf38b4722ead8f651e01a5d001a
SHA512 8c462e4223107889a21b3d4902f15dc2ec9ec5d8ab96decac7008494d0716169bcd83ba26c9ab35e5181b9375342944885e6536bec1a433cb27925ffe50ddffd

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0306942.exe

MD5 834db7514f3b88e0224a3fb67eb4a3e5
SHA1 92d34c7475354901c3468dabe5ca242913ef43d6
SHA256 3cdc96c0625f6512cc0c44ab69c68d526f5bcf60a58db6ec7ba7571351e6f209
SHA512 01ec41806b2baac375386b87bfff951c3781a9c3a470881e9b236fbb1ef44034213df9855d3f703d34f4e1cbca811a09970ffc8bcad5535939e0974df15c0c12

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6775914.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1712-22-0x00007FFAE55B3000-0x00007FFAE55B5000-memory.dmp

memory/1712-21-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7449951.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3659694.exe

MD5 fb09612d0dd2b03ce603878fff07c077
SHA1 fb14d2f355ca622380094f177c53a2dbd15a7487
SHA256 6fd99c1761ebdf1efe85564483359243f88ade8bd5d5251f7293adf2544d884f
SHA512 100e6e11fa04487211bb58e174809832a2d98608bf35132c66039f00eb717e3abe5ae892c05ac547b9ed7703f3204a1b6ab9a86b54dcfefbf83389bfd9514a07

memory/5116-40-0x0000000000F60000-0x0000000000F90000-memory.dmp

memory/5116-41-0x0000000003350000-0x0000000003356000-memory.dmp

memory/5116-42-0x0000000006040000-0x0000000006658000-memory.dmp

memory/5116-43-0x0000000005B30000-0x0000000005C3A000-memory.dmp

memory/5116-44-0x0000000005A40000-0x0000000005A52000-memory.dmp

memory/5116-45-0x0000000005AA0000-0x0000000005ADC000-memory.dmp

memory/5116-46-0x0000000005AE0000-0x0000000005B2C000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240426-en

Max time kernel

141s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\844b5b76938e178a82f8c18d5600f389ee4da147c66b379dbc5cb8587d11e5ab.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\844b5b76938e178a82f8c18d5600f389ee4da147c66b379dbc5cb8587d11e5ab.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\844b5b76938e178a82f8c18d5600f389ee4da147c66b379dbc5cb8587d11e5ab.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe
PID 4480 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\844b5b76938e178a82f8c18d5600f389ee4da147c66b379dbc5cb8587d11e5ab.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe
PID 4480 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\844b5b76938e178a82f8c18d5600f389ee4da147c66b379dbc5cb8587d11e5ab.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe
PID 4864 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe
PID 4864 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe
PID 4864 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe
PID 4848 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe
PID 4848 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe
PID 4848 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe
PID 2052 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe
PID 2052 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe
PID 2052 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe
PID 2052 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe
PID 2052 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe
PID 4848 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7155504.exe
PID 4848 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7155504.exe
PID 4848 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7155504.exe

Processes

C:\Users\Admin\AppData\Local\Temp\844b5b76938e178a82f8c18d5600f389ee4da147c66b379dbc5cb8587d11e5ab.exe

"C:\Users\Admin\AppData\Local\Temp\844b5b76938e178a82f8c18d5600f389ee4da147c66b379dbc5cb8587d11e5ab.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7155504.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7155504.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 96.196.17.2.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6205559.exe

MD5 088e87133ee678a8b31b0d7bbb951c02
SHA1 325f430bbc59fd3ff123f2f4d34dd214c1c889ec
SHA256 6d52a07c3772ac6446969c4d8274e818055f73f6bb281ef5a37ad52e0258c575
SHA512 4436b9d28876888b6ecfd0addb5271628b7f203385c11821040c36edb70a73f7c2d41bbc39a680fd1c30f6c83717132c398e94c97d42b886e9bf3c189f99c761

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7919191.exe

MD5 8a33e531826f517c8c47a87bc964ecfa
SHA1 98307298753791fa2db99202295e2b4dcea03ce9
SHA256 7bf34c5225e719b7cd23083c0f928af79494fc3989398529722851ac2b7a9218
SHA512 9630d116fd597f05b91816ef281c190023e1cf90fa4726f75a4cb85011b44d73e2536f8e0e61d22acd3da27f83a27f647c6bc6993126ec6c55285938a3cc4392

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1172693.exe

MD5 244fa5db56a8d8a66dd74760a4f86238
SHA1 3391d935288848c9a3cc345453cf1862cf6a7eca
SHA256 1bee181c1474a31c880e539118c43f9e9d0cba1fff75e94fe79336d02fd65e97
SHA512 227c2de03946d9ff074c2e7c929a68aa2a42382a0def297cffc6ee688c3b218809f9fd91a7207f4886b53c9bd633b6ef8e2819808448ae3d7ca946a3fd8a27db

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8325876.exe

MD5 abeb534b362dfb9b8421850442516a17
SHA1 2b8b0de64fb3ecf726206bb0fc7224788d98f78e
SHA256 1963a5127acbfa67b1133acb3279ac8765ec2b021be43036bfcfe5b6c8dc366d
SHA512 76788eb2296c5e644aaefcb28b83494bdd41c4535be1a49ddf2b1ac52d3b5bd6eb2cc745cb843adf662e59bada6211cff6fdc04f89c31519b2c93f7a910d3e7c

memory/2624-28-0x0000000000420000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2765561.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4824-37-0x0000000000230000-0x000000000023A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7155504.exe

MD5 0e6ae50e619cd27c3be7dd5e0d0470d9
SHA1 966d3d9e8620f8c6ee53bab1a199c417816f31e8
SHA256 98ed2c4dfcadc878a5e304dda49c41d447568987665fc2a8ab6d52e8da7ebc61
SHA512 77b0adc9810df719df683d87a51b38f203b633a1ddf84f236f01a9799ebeb221adc52e2efa349e0cfdb0c404b74b9cce7b29d53f65b8d1dabe65a66cafea6657

memory/1168-43-0x0000000000520000-0x0000000000550000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/1168-47-0x0000000004A60000-0x0000000004A66000-memory.dmp

memory/1168-48-0x0000000009EA0000-0x000000000A4B8000-memory.dmp

memory/1168-49-0x000000000A500000-0x000000000A60A000-memory.dmp

memory/1168-50-0x000000000A640000-0x000000000A652000-memory.dmp

memory/1168-51-0x000000000A660000-0x000000000A69C000-memory.dmp

memory/1168-52-0x00000000042C0000-0x000000000430C000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe"

Signatures

PrivateLoader

loader privateloader

RisePro

stealer risepro

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Qe51ov4.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Qe51ov4.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Qe51ov4.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe

"C:\Users\Admin\AppData\Local\Temp\86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Qe51ov4.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Qe51ov4.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
NL 194.49.94.152:50500 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 2.17.196.129:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.129:443 www.bing.com tcp
US 8.8.8.8:53 129.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
NL 194.49.94.152:50500 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 17.14.97.104.in-addr.arpa udp
NL 194.49.94.152:50500 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
NL 194.49.94.152:50500 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 194.49.94.152:50500 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
NL 194.49.94.152:50500 tcp
NL 194.49.94.152:50500 tcp
NL 194.49.94.152:50500 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Qe51ov4.exe

MD5 2554335d1d5d65d601b4d45a6e8aced2
SHA1 db8d862c2eff246f13eb5a676fa15815f66673dd
SHA256 f94b4a944d16a12fe45ec0e2c779607c1418dd789462e40d83dcf190496d4f80
SHA512 a073dc2387ffd84143466136b0fd5c12ccd6a5d0bd67aa6d648d3f3790ee79028edd5d2ed8897437d794674dd46334d6cade72c91a0103d617285f5018c22fcb

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9cf3d2bf3c4df3cc22948e45de303aec0f5ffce78a74c453774be0f6f060f6cb.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\9cf3d2bf3c4df3cc22948e45de303aec0f5ffce78a74c453774be0f6f060f6cb.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3100732.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3100732.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3100732.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3560 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\9cf3d2bf3c4df3cc22948e45de303aec0f5ffce78a74c453774be0f6f060f6cb.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe
PID 3560 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\9cf3d2bf3c4df3cc22948e45de303aec0f5ffce78a74c453774be0f6f060f6cb.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe
PID 3560 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\9cf3d2bf3c4df3cc22948e45de303aec0f5ffce78a74c453774be0f6f060f6cb.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe
PID 4324 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe
PID 4324 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe
PID 4324 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe
PID 2064 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe
PID 2064 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe
PID 2064 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe
PID 3988 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe
PID 3988 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe
PID 3988 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe
PID 3988 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe
PID 3988 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe
PID 864 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 864 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 864 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2064 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3100732.exe
PID 2064 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3100732.exe
PID 2064 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3100732.exe
PID 4324 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3112438.exe
PID 4324 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3112438.exe
PID 4324 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3112438.exe
PID 1556 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1556 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1556 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1556 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 5092 wrote to memory of 3552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5092 wrote to memory of 3552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5092 wrote to memory of 3552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5092 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 3924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 3924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 3924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5092 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5092 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5092 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 4028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 4028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5092 wrote to memory of 4028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9cf3d2bf3c4df3cc22948e45de303aec0f5ffce78a74c453774be0f6f060f6cb.exe

"C:\Users\Admin\AppData\Local\Temp\9cf3d2bf3c4df3cc22948e45de303aec0f5ffce78a74c453774be0f6f060f6cb.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3100732.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3100732.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3112438.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3112438.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.156:19071 tcp
FI 77.91.124.156:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.124.156:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.156:19071 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 77.91.124.156:19071 tcp
FI 77.91.124.156:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4064086.exe

MD5 e8a0840e23b53422f2f299069d7a2dcc
SHA1 2033836e4ab587b555c3fead8a67b506278991ca
SHA256 52bf78ec4fb6c307bb3a1c5676aac3f8d437772e4b8923710505441b039fd541
SHA512 75afb121885c5473ff3cf8a389378ae937199b3e8446ad23caf87922c1586f0507064eded48f3832baeb290932e00d70ea817dcdcc023950bf575cfc74da3268

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1098674.exe

MD5 7394d0f16028296e6d09e4737f3f5696
SHA1 b389b6f9603ddad4a5f87e30f0e0b6ce7df943ba
SHA256 83f297d11ebec0525e2182ec43a1b689be70658f5fd3427307a933f97129ac2d
SHA512 a45aa1c24cb9633ff0fe81186096d40ab612000f0b51880c886ab498ed9fdc985a942fd637d56007e31a84a5f0a079621858a219ad79644280085aa21a3cf441

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8664704.exe

MD5 f0a4a3201a71b8ca51a0704624427a4b
SHA1 489e1d54cfac4be3ee13ed54bba924aeee2e8ce7
SHA256 549b3092cf82e97dc04eec45a99b16a8e281585d50c45917400382be10b5cd24
SHA512 9d5f55bb806949c300d13fa05d9273c57b0235899a3fddf9f6eda9dfa534d524e2192b2e5aa63fa1f2ffbb9c212ab2440edf9c5d58a5161673c7e4b895f2b45d

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0678150.exe

MD5 3d408716834736ed12d9638e2e477df8
SHA1 a6ac21609ad6c20caf50aaadfd6f4f547435e75e
SHA256 6a50eca253cb440b7cabef534a21bae755ac6b7e814c5fabd9309ce30271bb7c
SHA512 a345c14da445dd2bd0ff74180d7a0595d132c05af51f17fb0ce79ae4b74b1da878c5e5553c56ab4fa728fa57d419c14cc50ca14c9591759cd4e52d709f4de7df

memory/3244-28-0x0000000000B40000-0x0000000000B4A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0446818.exe

MD5 a80b2fbe6b38a9a2677a6c60a90e6f49
SHA1 18273d742c05c794af3e68b9f17169efbaabed3d
SHA256 7540c82afa338dfb150532fd58c724af228c4ed971ee16f47e4f3ff94be0a4ae
SHA512 805175133bb08ab2f1774a49fe778731e49e7d24ba111d74acee138612265f51b7f924cb1b9c191c070a1eeb1d39e6d69ee7d7d883eba9458d034499db8c728d

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3100732.exe

MD5 cf18057e74053855d7772119a92817f7
SHA1 d10251d98c1823857f3bdae888fe0455a486b2ce
SHA256 a4511c7c49eaf3b4f70fd15ceffb8a185436572b2047a9083a33f1634d9254cc
SHA512 fe14ad29ce83d4e6c9ae836edbbcd45c0e0a9f54c37f0dbe5745197c31ceb962dab6066cdb92c7fd38b76ba19f1eef871717139f31ae3b15b73ab0cd1c32d8b2

memory/3772-46-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3772-47-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3112438.exe

MD5 19b09057024b41ebce9b043c79b67449
SHA1 e7d51484334c92420e608580c96fd0ea5eb7a345
SHA256 8b6e1d853285303d58d1d7aa345b69315bf6128c47edb38df7dfaf0238e3b670
SHA512 2d764d8fa63fc7ce7c320575d06fba06b82b65aa94533c835326c93df37c60cce0cfaa51ff4e7e8ef2b052286b269afba66b03234a6c4c0dcbae7f54652a26c2

memory/344-51-0x0000000000DE0000-0x0000000000E10000-memory.dmp

memory/344-52-0x0000000003030000-0x0000000003036000-memory.dmp

memory/344-53-0x0000000005DC0000-0x00000000063D8000-memory.dmp

memory/344-54-0x00000000058B0000-0x00000000059BA000-memory.dmp

memory/344-55-0x0000000005660000-0x0000000005672000-memory.dmp

memory/344-56-0x00000000057E0000-0x000000000581C000-memory.dmp

memory/344-57-0x0000000005820000-0x000000000586C000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3800 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe
PID 3800 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe
PID 3800 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe
PID 2900 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe
PID 2900 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe
PID 2900 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe
PID 4532 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4532 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4532 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2900 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe
PID 2900 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe
PID 3016 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3016 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3016 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3016 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 3640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 3640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 3640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 4728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 4728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 4728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 4268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 4268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4500 wrote to memory of 4268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6147775.exe
PID 3800 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6147775.exe
PID 3800 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6147775.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe

"C:\Users\Admin\AppData\Local\Temp\d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6147775.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6147775.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.129:443 www.bing.com tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 129.196.17.2.in-addr.arpa udp
BE 2.17.196.129:443 www.bing.com tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8304226.exe

MD5 87aedfc560c9bd0c8573f0c5459e0c03
SHA1 94ecaa60536bf743c72ad3d463e24414a82b0b07
SHA256 d8a30b3f0111c04c370ebe3791b3edce9716e90df42e4056c327377a4410fb09
SHA512 7a4842a87e18f6589d1052e7435322ec6b31af5f82d97d1ffbf18a440d266d540eec6014634907afd4c455afbdc615e3b0835406681657fe8c0ba81331956d2e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0416455.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4419793.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4312-27-0x0000000000E10000-0x0000000000E1A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6147775.exe

MD5 b7f729379a37c0f7f5dfb7a17f1bcb1c
SHA1 c3df08c950d0d9d8fffa8d2f25216f8b74fc9f36
SHA256 e7fe2de161d98a92f13385743abb9a5a37e7d27ae238adbefa07fc859035b2af
SHA512 753bf2a61bffad0d69999996f08353942b9814abf9a8d676649c925f4a49b2b0bfd71df45098837ed2c19468b7f1b7c142137b9d4887faaca3d913b5d35dc056

memory/396-32-0x0000000000D00000-0x0000000000D30000-memory.dmp

memory/396-33-0x0000000005520000-0x0000000005526000-memory.dmp

memory/396-34-0x000000000B080000-0x000000000B698000-memory.dmp

memory/396-35-0x000000000AB70000-0x000000000AC7A000-memory.dmp

memory/396-36-0x000000000AAB0000-0x000000000AAC2000-memory.dmp

memory/396-37-0x000000000AB10000-0x000000000AB4C000-memory.dmp

memory/396-38-0x0000000005010000-0x000000000505C000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4500 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe
PID 4500 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe
PID 4500 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe
PID 4004 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe
PID 4004 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe
PID 4004 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe
PID 4004 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe
PID 4004 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe
PID 4388 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4388 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4388 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4500 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1762830.exe
PID 4500 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1762830.exe
PID 4500 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1762830.exe
PID 8 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 8 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 8 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 8 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 8 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 8 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4060 wrote to memory of 3608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4060 wrote to memory of 3608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4060 wrote to memory of 3608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4060 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 4344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4060 wrote to memory of 4344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4060 wrote to memory of 4344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4060 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4060 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe

"C:\Users\Admin\AppData\Local\Temp\fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1762830.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1762830.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.115:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 115.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
BE 2.17.196.115:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1535374.exe

MD5 1d3d74bce4cb86fe40dbdc82ec30e7b4
SHA1 2c9a7d4a707653cfb7b9a95bf16b945c6fae5b7e
SHA256 7b36cf0c753c77b6a720fad0d6f89fb4bbef21ac4112d3be789cca1fa7ef90f7
SHA512 13b007ba56e851b3754e8d218c0e13b1d40fa67ebcb40506a2fc7c54e2375f05064a49a68ad0592c3a0c02cafc3c9f9334119e8c323de71979d428540df25288

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8772823.exe

MD5 f05cae077054672e94dd380d619747bc
SHA1 7c7b8e4faff43907150a64b9a95780ba86e7e00a
SHA256 f10f71cb8281e6bfd5bcfb5cf0fc2db40bab75ee542f842fa1934907b1d9c5f5
SHA512 1441725f868c5d41b441854eb768671ac4f3c6acf0c8c77b13c9b69db707bbdd4f6dc45c8f87881029379d0d91ce89bd97261a1a3252ccd546d43566bd3e7256

memory/4984-14-0x0000000000630000-0x000000000063A000-memory.dmp

memory/4984-15-0x00007FFD5D423000-0x00007FFD5D425000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2173793.exe

MD5 f0ea5fc3ee2d81c71088845831d67224
SHA1 d8ebaf6aeb50bbf7c71039fe97e8f2174890a15f
SHA256 32085e88d7f4690ec7e037931fb7edc354a7ae65b13ea4f48fcd5698b4ac98a3
SHA512 80c784633aebc411fc025379b2b15f5af7bad08ce8f6fb0e46879f58da9cea0a7520368fbbfcc227ecf35130a72eb41dba0941a75718c14e2eaf680a255008fd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1762830.exe

MD5 75d519bc71b0df0a05230e5286d83eed
SHA1 aa159aec36da401a6d5642ee0062dc66b589d7c9
SHA256 c807bc1d72e78993834caa44014201fd6a452584796e1f235ddfa06d323f922b
SHA512 40caf2d52f749db43ace3f1096621bc75addb5d72a55d9e7679232a232afe37e10c761784d170e6e5bfa7bc3266ffc467ef73fb9829da3d96a89a14d8b623e10

memory/1736-33-0x0000000000240000-0x0000000000270000-memory.dmp

memory/1736-34-0x0000000004B60000-0x0000000004B66000-memory.dmp

memory/1736-35-0x000000000A550000-0x000000000AB68000-memory.dmp

memory/1736-36-0x000000000A0B0000-0x000000000A1BA000-memory.dmp

memory/1736-37-0x0000000009FF0000-0x000000000A002000-memory.dmp

memory/1736-38-0x000000000A050000-0x000000000A08C000-memory.dmp

memory/1736-39-0x0000000004550000-0x000000000459C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f6b8faa6814b26627c6c8eac0bc9c5237229efaec31a93ac5634db12970f986.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\4f6b8faa6814b26627c6c8eac0bc9c5237229efaec31a93ac5634db12970f986.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\4f6b8faa6814b26627c6c8eac0bc9c5237229efaec31a93ac5634db12970f986.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe
PID 2020 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\4f6b8faa6814b26627c6c8eac0bc9c5237229efaec31a93ac5634db12970f986.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe
PID 2020 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\4f6b8faa6814b26627c6c8eac0bc9c5237229efaec31a93ac5634db12970f986.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe
PID 4844 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe
PID 4844 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe
PID 4844 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe
PID 4204 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe
PID 4204 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe
PID 4204 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe
PID 4204 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4476781.exe
PID 4204 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4476781.exe
PID 4204 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4476781.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4f6b8faa6814b26627c6c8eac0bc9c5237229efaec31a93ac5634db12970f986.exe

"C:\Users\Admin\AppData\Local\Temp\4f6b8faa6814b26627c6c8eac0bc9c5237229efaec31a93ac5634db12970f986.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4476781.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4476781.exe

Network

Country Destination Domain Proto
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3648461.exe

MD5 318a8eb67e8bcaee3b89dc081807d46b
SHA1 f78a8e23612e270f6b6d3307f41bb920a7fc192e
SHA256 ab1b9e632564fb3c2826cd638e3277d9bdf07dddc041266d361a6d4cc95015f6
SHA512 661fea1e8059173d551c6b538f46220e6d8f911f53977df24f55be72d5d25346b360e1acdfeb101f2e861acd4011ecd752e809279c7664fd082198aebb935c97

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8860082.exe

MD5 2677f8194fefee3ab023a4d84fe7f80f
SHA1 40d025e65fbb8f2e14b8e26c961cd8c1fec08105
SHA256 f1cf4820bb2702cf7511d9a2d90c3fe80b263088ac476a3595a7eaa049212f88
SHA512 ad3daa1d49f8378c9ebae85817748f539fd19af5a95baa4033726edf12ec8ea7a103a673c736d68e5ae102143e33dd29d1405fef35a790bed9d95ee9bb07ff92

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0381995.exe

MD5 61311f348b60fae73c1dec88ddb812b8
SHA1 e584bec72429d0f2aac1b5d351a03f6dedf9146d
SHA256 5e01d277979e902ec4bae4561368f84e9d5d1cc3cf340ca5ed832ae63e97052b
SHA512 82464d99004b7f9f8db0cca14c31dd18a40c1db4c2eba889bf9937fe6278f3d7798ec068a2f66b375518dc479edc68201003ea6bc944480b9c1cb85416b73eb0

memory/720-21-0x00000000006D0000-0x000000000070E000-memory.dmp

memory/720-27-0x0000000000401000-0x0000000000404000-memory.dmp

memory/720-29-0x00000000024A0000-0x00000000024A1000-memory.dmp

memory/720-28-0x00000000006D0000-0x000000000070E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4476781.exe

MD5 f958d6d636e5b3fb2432867cfe738c1d
SHA1 aa869b349e1cb254c21a4a0f73ae8ea0a1a0a4e6
SHA256 27ee8475b77ceb67b815e186029dd46601683d36f1fed7e2c9d8228eda8efcdd
SHA512 fae9b3392255b0d7be0d75cfcab8b97ff1278f79c811fc349483ba56592989d2a30788d2cb01873afc79adf28069fc684b797818f46090d1d8c3d3875ebc5bf9

memory/2724-35-0x0000000002000000-0x000000000208C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/2724-42-0x0000000002000000-0x000000000208C000-memory.dmp

memory/2724-44-0x0000000002270000-0x0000000002276000-memory.dmp

memory/2724-45-0x0000000004BE0000-0x00000000051F8000-memory.dmp

memory/2724-46-0x0000000005200000-0x000000000530A000-memory.dmp

memory/2724-47-0x0000000005320000-0x0000000005332000-memory.dmp

memory/2724-48-0x0000000005340000-0x000000000537C000-memory.dmp

memory/2724-49-0x00000000053B0000-0x00000000053FC000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4620 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe
PID 4620 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe
PID 4620 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe
PID 3568 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe
PID 3568 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe
PID 3568 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe
PID 1952 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5243225.exe
PID 1952 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5243225.exe
PID 1952 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5243225.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4.exe

"C:\Users\Admin\AppData\Local\Temp\ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5243225.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5243225.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
GB 142.250.187.202:443 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5396804.exe

MD5 5776e55e4d2ff7e0335f68bcca639c44
SHA1 753d68485b4b086ac1481ee1f1e4aa5f5d960afb
SHA256 9c4239bf16e8b8e477e8f53d5cbbe45c6818e87454274749788bb0369f47c590
SHA512 199d4116faf9a094a30ec1908612d7b695e4517ffc0890fd7c3de1b8d225fdb9e95b4edf862f0059f0448dc60f16928e3801b77031e607f32dfaf56f4a0ce020

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3011045.exe

MD5 12dc6d82b6ce257ffc4af0125bd14396
SHA1 ce273d0cee373800fea60a9c8f3795294bce4cf8
SHA256 428af94e3a3a6a7d70b98f99c7a4bf867ec190287f6062a34e0ba16c6c27521d
SHA512 0676e3dac90ff0bfd55f0fa3efbbe899ee1c8a6fdcfa6918654dbb47636b192ef0cff0877789c239a454ab2a0eea14e6d28cd53177a521a26b069dc4e3bf9d19

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5243225.exe

MD5 2c019fe9be415b2bd07d1c1493776a31
SHA1 73c6ed8cca7be66b903ff20b75479af6ad53f2c1
SHA256 8c613af780df9cae77d603395e79ebead4165d889ec7cc4a585bbffa0d817e96
SHA512 86542984fa994b61732092ecd148590d6321d6fb46d23e229906ff4219b34933c3a3558a3adbe121b8c08f2f81a346b87ff2224737896f31512fddbcf1fb3855

memory/4260-21-0x0000000000401000-0x0000000000404000-memory.dmp

memory/4260-22-0x00000000005C0000-0x000000000064C000-memory.dmp

memory/4260-28-0x00000000005C0000-0x000000000064C000-memory.dmp

memory/4260-29-0x0000000006B30000-0x0000000006B31000-memory.dmp

memory/4260-30-0x0000000002380000-0x0000000002386000-memory.dmp

memory/4260-31-0x0000000005140000-0x0000000005758000-memory.dmp

memory/4260-32-0x0000000004BB0000-0x0000000004CBA000-memory.dmp

memory/4260-33-0x0000000004CE0000-0x0000000004CF2000-memory.dmp

memory/4260-34-0x0000000004D00000-0x0000000004D3C000-memory.dmp

memory/4260-35-0x0000000004D70000-0x0000000004DBC000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4504 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe
PID 4504 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe
PID 4504 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe
PID 5096 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe
PID 5096 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe
PID 5096 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe
PID 4392 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4392 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4392 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 5096 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe
PID 5096 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe
PID 2672 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2672 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2672 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2672 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2416 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4504 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3798517.exe
PID 4504 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3798517.exe
PID 4504 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3798517.exe

Processes

C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe

"C:\Users\Admin\AppData\Local\Temp\30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3798517.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3798517.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.115:443 www.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 115.196.17.2.in-addr.arpa udp
BE 2.17.196.115:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5758399.exe

MD5 6092b931049705408b5c8b4669d207ff
SHA1 6e70b1118feec55ec6774e3203198eafe8f2bd13
SHA256 de3f6367da3dae76890a609db3de780da484f2c5f252d9c146af3053b68e960c
SHA512 0c3a783dd907f61b10c7e2612cbecefa53db9211e58d7c621fe27ff06eb1ac070ce78e5ff0e34906fb135b2bc3f76749290d0717b8c5cd5af52bc9fa1a7b18c2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6157500.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6319005.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4264-27-0x0000000000200000-0x000000000020A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3798517.exe

MD5 8635a57d17ac00b9bda1d2f0b424bb32
SHA1 c1c7115c10c9328a94e486c3a0c8d5fc3f3768b2
SHA256 7dbe20e520b746881df808b5a7b0c5ae306a65e2095fc951675e223b6a550022
SHA512 7c61254cc1bb2a1aa5ece011b3751cf3391167fc39fee095c580a41f642cbcb76c90066c1ca25a4a0a0fbd899b9fd3bfd9b370e8f93656684ec3e78e49d9a950

memory/3052-32-0x0000000000740000-0x0000000000770000-memory.dmp

memory/3052-33-0x0000000004F60000-0x0000000004F66000-memory.dmp

memory/3052-34-0x000000000AA90000-0x000000000B0A8000-memory.dmp

memory/3052-35-0x000000000A5B0000-0x000000000A6BA000-memory.dmp

memory/3052-36-0x000000000A4F0000-0x000000000A502000-memory.dmp

memory/3052-37-0x000000000A550000-0x000000000A58C000-memory.dmp

memory/3052-38-0x0000000004A20000-0x0000000004A6C000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-09 10:51

Reported

2024-05-09 10:56

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5132843.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5132843.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5132843.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3724 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe
PID 3724 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe
PID 3724 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe
PID 4380 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe
PID 4380 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe
PID 4380 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe
PID 1992 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe
PID 1992 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe
PID 1992 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe
PID 1992 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe
PID 1992 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe
PID 3740 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3740 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3740 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4380 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5132843.exe
PID 4380 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5132843.exe
PID 4380 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5132843.exe
PID 4928 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4928 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4928 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4928 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4928 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4928 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 3628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 3628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 3628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3724 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8390114.exe
PID 3724 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8390114.exe
PID 3724 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8390114.exe

Processes

C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe

"C:\Users\Admin\AppData\Local\Temp\68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4184,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5132843.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5132843.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8390114.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8390114.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 96.196.17.2.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 7.242.123.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3918201.exe

MD5 6e73bdbfa5d08ebf1d73023e9ee727dc
SHA1 b9ee6a750155a8c2642b5bf3437fda9007678507
SHA256 609302e9708f446dc5473b29cacf3c8e4187ad07ea6c88850f242573287ab897
SHA512 1277e15f9c2e89d70209034f19533481c9576603e00dedb10867197b1ace4fdf99104b950d8b464010dd3e564cbfdc41fed20f5b06cab637156852ecd05f9d7e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8728502.exe

MD5 7e1c0acf0982e20ee5997894b1883c97
SHA1 85725fed96c43bdf60406f80227d08694c86a72b
SHA256 e0977088957e4b9c31b6b71eb74f47c24b020d3ab8378b8fedf317a4aa03e2fa
SHA512 c0385b7b09d6f892a22485bcde9a5779182e34b4ada86e89387556a0631e35f89e816c49537a0acee712e8da896b98a1f229dcfbbfaaa0395508bbd7e7130040

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1520981.exe

MD5 1064c8e873b8ef7b683a5228cbc88b8b
SHA1 18fd3ab0f542ae640f158b5ac20615c4b1940699
SHA256 cad5902d256fd6e9f3a64166925193a0ffbe66db4ec317b38bb76050f3367787
SHA512 db04baf087525ab2c23221a977d970ea6c280975c94895d007f676af4ed66b9787c0ab23cf2282046504ef40cf7e936dbd6b57a777f4039ebaf6de17f0fd327d

memory/3968-21-0x0000000000430000-0x000000000043A000-memory.dmp

memory/3968-22-0x00007FFB3FC93000-0x00007FFB3FC95000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7964864.exe

MD5 e520652f2d0117c0399e40ecdd867ef2
SHA1 efdc1c767bb298ecad98b0c88e4e0e960559e23c
SHA256 72b1c2d3c1dc93b72614111d2a82ac0573112f98c20dd78ccb292860c1ccb8e0
SHA512 060d151bfc6576b6c87def2260c34a90c17d9d3b3384cba446fad221c6994e0989f61ae25b00450384f24813b3014027f391b6d4e829baeb0ab1af891a41bbc6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5132843.exe

MD5 e4310852aa5e6ffcec01b7a96a99f8d3
SHA1 9061a6968a4c1d86c6c566306067507bbb9a3e5c
SHA256 242c37b2da275f6caf39aee903155e18501a605549ee169cb0a9086f23fa6250
SHA512 ec96f4c0008a67bed43278dd18e28c599e52ff75645377afa7292c4223329ed543f303160ac565d32e155a6df1ed084352d78c786d44c00d23a7dadade9bd614

memory/2580-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8390114.exe

MD5 8057a194266577b4c40a403b7132883d
SHA1 48e608a3d8318d958ff39e6d86c92300f25697b9
SHA256 97ffdc0bcd30df2761422c722ec2b0cbd18671e1e76aa4fc3e4074869c6cd644
SHA512 b49ec55343454f6e1ca92c7b5617ab73465d9953750757b51d78f40468d3aa1314e4f2ff567a348331bbf3111e3d7f9a642a7935b0d7e1d91fc35bcda1694ea6

memory/1284-45-0x0000000000DC0000-0x0000000000DF0000-memory.dmp

memory/1284-46-0x0000000003070000-0x0000000003076000-memory.dmp

memory/1284-47-0x000000000B220000-0x000000000B838000-memory.dmp

memory/1284-48-0x000000000AD70000-0x000000000AE7A000-memory.dmp

memory/1284-49-0x000000000ACB0000-0x000000000ACC2000-memory.dmp

memory/1284-50-0x000000000AD10000-0x000000000AD4C000-memory.dmp

memory/1284-51-0x00000000051B0000-0x00000000051FC000-memory.dmp