Malware Analysis Report

2024-10-16 03:50

Sample ID 240509-n4bbbsba37
Target red.zip
SHA256 7cc4ca7df1354c5dcc6727cacfda8e239f161845dfb3a7cb9889f29fad4b792a
Tags
persistence amadey healer redline krast dropper evasion infostealer trojan lande smokeloader backdoor nasa 6077866846 discovery lumma stealer kira masha lamp
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7cc4ca7df1354c5dcc6727cacfda8e239f161845dfb3a7cb9889f29fad4b792a

Threat Level: Known bad

The file red.zip was found to be: Known bad.

Malicious Activity Summary

persistence amadey healer redline krast dropper evasion infostealer trojan lande smokeloader backdoor nasa 6077866846 discovery lumma stealer kira masha lamp

RedLine payload

Amadey

Lumma Stealer

Detects Healer an antivirus disabler dropper

SmokeLoader

Healer

RedLine

Modifies Windows Defender Real-time Protection settings

Loads dropped DLL

Executes dropped EXE

Windows security modification

Checks computer location settings

Adds Run key to start application

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 11:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240508-en

Max time kernel

95s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8a74314c35a7a341a4dec6d70e0d6801d49282a77f6ca44fee133e1d3ae7b45a.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Five_Nights_at_Sonic_s.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\8a74314c35a7a341a4dec6d70e0d6801d49282a77f6ca44fee133e1d3ae7b45a.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Five_Nights_at_Sonic_s.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Five_Nights_at_Sonic_s.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8a74314c35a7a341a4dec6d70e0d6801d49282a77f6ca44fee133e1d3ae7b45a.exe

"C:\Users\Admin\AppData\Local\Temp\8a74314c35a7a341a4dec6d70e0d6801d49282a77f6ca44fee133e1d3ae7b45a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Five_Nights_at_Sonic_s.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Five_Nights_at_Sonic_s.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x518 0x4b0

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.200:443 www.bing.com tcp
US 8.8.8.8:53 200.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Five_Nights_at_Sonic_s.exe

MD5 6a3914ec3fad2d6f1e3ffbc064b7bc76
SHA1 189239dce9541cd9d841e8da51b01b21d139a48e
SHA256 9a0ee5df414ad34b4671c34b200c82666ee4fcc37b4274417f103628fab0cb91
SHA512 29cd9ee42917c30464f69fad1e9a3da9beaf69f81dde7c857b7b0f87774253da899cbfbcf7e813a5dbdff236c104f15ce1633e393f4e22de99db08040444aff4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3dx9_43.dll

MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\options.ini

MD5 277a235426b5526cf6c57dfcab0fb833
SHA1 a727a52d5a992a216567597a62085b296b8d47f1
SHA256 7d296b234411bffd6ef6c9cf008ef28af44410bb9b5dc3e50948dcb5a58fae62
SHA512 a46395b66932a3953b0779c4703df3aef0c1b645f68f61f117704bf1f68167ee0bea739aa63fd416a051aa65737a98e3a8884c17d5d1c59bdf886abc23f497d4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rousrDissonance.dll

MD5 49069a0ab0892d2a4b1f5ff114571b5c
SHA1 f75c3ef3b3da8fe182307ebf650bf0aa05678429
SHA256 02224a4afa548de7b409d515dc4e9e7c5a60653f432639c568140a05cf84f045
SHA512 557f6e2fff9b11bbf5e3508fbd871b8d4d14a619e11b17738c414903412ec80d6b7f74f80a3d80cbff7956fbe0f83453f03d49edb1550d35a6754638a33c5cb1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZFile.dll

MD5 75f466753767c33e59f218d82660312b
SHA1 181da454addc1413f2eb0cf0bb8eeed860ff296d
SHA256 50bf531db3fae6dbe88f166b8aff11da18ef5a0ed6918bd23cb353068e56e2d4
SHA512 9203e932c46d5a6782a42c3ead5a61ae55774cab9f2ea2ba2d2c5d17baf4b782e45d50140303fc4d8f84c98e7ecdf7c8d0801abc565de46c5676c2cf9748d626

C:\Users\Admin\AppData\Local\Five_Nights_at_Sonic_s\sonic.ini

MD5 e8c0279160405830ca73dca4a4271135
SHA1 1d8e18776974906104e92dcdcb8ee3ca5085edd8
SHA256 0e4d2e3203c4131f78cfda913ba96b8708a31df2801552f6203ab4a311b5e35b
SHA512 49673e57429aa8e2e45277a8e131fe68a0984b8230a9347fb437aa01ea2f4f12da91e85ede29bfd725af3b0a348fca0254e8c0ce82d1b979bfa6d292a0b6011d

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4836 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe
PID 4836 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe
PID 4836 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe
PID 4788 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe
PID 4788 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe
PID 4788 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe
PID 4788 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe
PID 4788 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe
PID 3904 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3904 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3904 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4836 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9026158.exe
PID 4836 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9026158.exe
PID 4836 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9026158.exe
PID 3552 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3552 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3552 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3552 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3552 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3552 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 4776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 4776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 4776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 4544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 4544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 4544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2892 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe

"C:\Users\Admin\AppData\Local\Temp\01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9026158.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9026158.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.242:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 242.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
BE 88.221.83.242:443 www.bing.com tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 107.116.69.13.in-addr.arpa udp

Files

memory/1848-15-0x00007FFB22113000-0x00007FFB22115000-memory.dmp

memory/1848-14-0x0000000000010000-0x000000000001A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2541555.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9797946.exe

MD5 988a2da113515696f004529340b43ffe
SHA1 1ffdf2a07d85aa1f267b28edf38f44362d8b1d10
SHA256 f7cec4e6b0a00ddc265afbf7ba55bab26db1d2a196f6b07bd852cda5b2dc4e4c
SHA512 606c57ecc01f6ee18dbe7b0e1fe9f642c1f92e2c50f56170472eaf35b25c8c1da536cd1ea831a5ac727f49bd0d6398c52c3864f622c76a38712777659b3aaebc

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1893380.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9026158.exe

MD5 7fad00a85ec81f58fa7b4721900d0eb1
SHA1 7e20901afd21d3d54fecceffa1761b458f160a45
SHA256 c53bcc296ace033c0344609d42bb3d709d3676e61d0c6e7864584ed5e0d25307
SHA512 7e7eadc9836abafb796a346a7c143b8a4a16096b1835a4994230cd4466034131e2105a87b9129c18feb88e01257ccfdb634e1a6014c95db207367b1ca816beac

memory/3944-33-0x0000000000580000-0x00000000005B0000-memory.dmp

memory/3944-34-0x0000000002730000-0x0000000002736000-memory.dmp

memory/3944-35-0x0000000005530000-0x0000000005B48000-memory.dmp

memory/3944-36-0x0000000005020000-0x000000000512A000-memory.dmp

memory/3944-37-0x0000000004F10000-0x0000000004F22000-memory.dmp

memory/3944-38-0x0000000004F70000-0x0000000004FAC000-memory.dmp

memory/3944-39-0x0000000004FB0000-0x0000000004FFC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3632 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe
PID 3632 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe
PID 3632 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe
PID 3756 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe
PID 3756 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe
PID 3756 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe
PID 3756 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe
PID 3756 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe
PID 2452 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2452 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2452 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 3632 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9154178.exe
PID 3632 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9154178.exe
PID 3632 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9154178.exe
PID 3828 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 3828 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 3828 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 3828 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 3828 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 3828 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 4344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 4076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 1388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 1388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 1388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe

"C:\Users\Admin\AppData\Local\Temp\10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9154178.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9154178.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.193:443 www.bing.com tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 193.83.221.88.in-addr.arpa udp
BE 88.221.83.193:443 www.bing.com tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1441314.exe

MD5 ecdf0501309ebbe40bd5663865513891
SHA1 0caab1e4c53506c7a79d6cadf98b31822ef7306e
SHA256 4dec9215d11425136df166231deb391ca0421f5c0c6446d35c13ac3950d5c082
SHA512 64f5c2c296292b026f0eb78f310f11d30823d1a77a5a8713623680898c936bf79fafa049ed063f4d3ce62e0a087cf81ff933d64a2f034ef9102294d93eb24920

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4739101.exe

MD5 a1e5b03a27a558b91e76657c8e7a6515
SHA1 18a9cb7b4128c531f3ccab31c8c7899fe1fcdca2
SHA256 be926f903af8e981a765bb13eba07f7265eff632f361c8d79dfd674e95d0c9a9
SHA512 dadf9d67c59c2e6b6661b34feecdf51e7a11d0af0ee0da888927b9bea5a96b46bcd3d49f4683ec35731fc3f911edaf2dfee8b5b1d2b6f7f034a1520a952db837

memory/3936-14-0x0000000000A50000-0x0000000000A5A000-memory.dmp

memory/3936-15-0x00007FFCFF163000-0x00007FFCFF165000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7443412.exe

MD5 ea89359eecab843b6ab42eb46ac186c4
SHA1 dbb900ffc44da3d58d38d4be31e452cadc4599b0
SHA256 c9e75f65f89d5fabe9f48514562b195057bac2e066e890034cefcc2ba0ad1e86
SHA512 be442b3039721173c3fd9998d37987fdf3164ada6eba98de2fde62fa0b7e5076dbc9d5ad8981b4470d69c0323f53b507224feff60d981cebe62a9553ffdaad1b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9154178.exe

MD5 99e36e86747624ce7e5da55c03888ee3
SHA1 24d2ae5e591eba4a41e6179216f7e987db2a2c1b
SHA256 a19fd8defd322b6376247cc6286bdc3b148122352d7e5ef5558913e8eee15ef7
SHA512 da26ab769001c84b3fe54e28bb483bc883df1731a148b2d3b229150b7dabab35b067232a7ada0a2887af721812203cf499be3f70135a1550b4984737b222af26

memory/3204-33-0x0000000000CD0000-0x0000000000D00000-memory.dmp

memory/3204-34-0x0000000003100000-0x0000000003106000-memory.dmp

memory/3204-35-0x0000000005E30000-0x0000000006448000-memory.dmp

memory/3204-36-0x0000000005920000-0x0000000005A2A000-memory.dmp

memory/3204-37-0x0000000005690000-0x00000000056A2000-memory.dmp

memory/3204-38-0x0000000005810000-0x000000000584C000-memory.dmp

memory/3204-39-0x0000000005850000-0x000000000589C000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1808 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe
PID 1808 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe
PID 1808 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe
PID 4576 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe
PID 4576 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe
PID 4576 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe
PID 4576 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe
PID 4576 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe
PID 2392 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2392 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2392 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 1808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2834120.exe
PID 1808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2834120.exe
PID 1808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2834120.exe
PID 4504 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 4504 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 4504 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 4504 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4504 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4864 wrote to memory of 4768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 4768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 4768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4864 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe

"C:\Users\Admin\AppData\Local\Temp\12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2834120.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2834120.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.107.112:443 www.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 112.107.17.2.in-addr.arpa udp
BE 2.17.107.112:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2446112.exe

MD5 364248604545f0dc66ffd3d4bac576a8
SHA1 44478b199b4648a66ef938eab335bc2090186bc1
SHA256 4207e59ea3e623cd676b9ad039bacbc1078108aeb4de18ce87d2758c59a0ddfc
SHA512 628e26738cd5f937d90b772ad13e850c9c9aeb9103bacae55656e261ccb80cb5e8a846ea0fe193735bfca67be8a4c8f49700f88a919d7f43d26001499b558f77

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8201614.exe

MD5 1f5b40e345bc2490491355f3b4e2a03e
SHA1 ab03a56383442f7d8c200c47580f0be51181fdc3
SHA256 83dc57e2199b82e3772479fdfc95ed1c7077d2fe39444eb4ec9b45d015961bb1
SHA512 f1ac3def74e1cbd9e3d0215099c62d4035922fd6c5f705a27eb56b593cbf84a821ca92b4914688de39bee574885da4b00c937f04d5fe79951c36af32bf32d06a

memory/4212-15-0x0000000000140000-0x000000000014A000-memory.dmp

memory/4212-14-0x00007FFE0D463000-0x00007FFE0D465000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7380851.exe

MD5 730b758888c41104a59d74f1db7f264d
SHA1 e595ca8d9e7085b05dfb0a0d0793dd6abe2a4410
SHA256 faf9c0d96ab7bbd2824e20627978775f3a62f4ef8dc62d7a98680bae5da515e2
SHA512 3f165a8e95b661416ed6124671814ec351e4962c1262872aa3dbeda74e5f3558cc130a2a1792048f1ab8138a031cc263b46e1405633fa92d25686f88c441d2ef

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t2834120.exe

MD5 beb7d126b0887768422009d2bda06b70
SHA1 6183614981952d6a2835f879aaafa9034c045016
SHA256 b7dbf320107de3e89e2e1495302b612670903375663c37b7e0bacdd720a350d4
SHA512 ec85c56bd7585949aece9d22156710815a0193f29bab4bc2f9a882eee655353089be1e06dec5a829db1dfb0b657b7b0406604ad1613422f9c3ccb1c5c621e91c

memory/1632-33-0x0000000000C90000-0x0000000000CC0000-memory.dmp

memory/1632-34-0x0000000001310000-0x0000000001316000-memory.dmp

memory/1632-35-0x000000000B050000-0x000000000B668000-memory.dmp

memory/1632-37-0x000000000AA50000-0x000000000AA62000-memory.dmp

memory/1632-38-0x000000000AAB0000-0x000000000AAEC000-memory.dmp

memory/1632-39-0x0000000002E30000-0x0000000002E7C000-memory.dmp

memory/1632-36-0x000000000AB40000-0x000000000AC4A000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3490647.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3490647.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3490647.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4280 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe
PID 4280 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe
PID 4280 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe
PID 4140 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe
PID 4140 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe
PID 4140 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe
PID 4140 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe
PID 4140 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe
PID 1092 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1092 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1092 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4280 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3490647.exe
PID 4280 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3490647.exe
PID 4280 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3490647.exe
PID 2808 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2808 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2808 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2808 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1320 wrote to memory of 4880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1320 wrote to memory of 4880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1320 wrote to memory of 4880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1320 wrote to memory of 1760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 1760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 1760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1320 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1320 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1320 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1320 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe

"C:\Users\Admin\AppData\Local\Temp\2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3490647.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3490647.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8933544.exe

MD5 87521c8035ca421a6e47dcc31f8e4a89
SHA1 29252b1a00e300f880ed48836f54ad8644800bcf
SHA256 02b51800b95d6592f077610422908ae8e835af33b4c1c4cb292853108b572d3a
SHA512 6e61676726b127fedcadb1addbf4d149c7cfff0727b49edd53a08c572d214910030becbbdfd92e78b1fad71e35f8b385996f87ba8f638c598f489610a7ca29d4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4581101.exe

MD5 9120b06d028c4bf29570fe065160d155
SHA1 18b2f49a05731331ece3b0e5eb587d9c519ee990
SHA256 c2c2554038de21891c7ca2baa9e5edf95d41733f66965069d9ceb3e1f0728194
SHA512 829d7d6575f60398e7840cb167f84c53c6c1a6176d913cd8645b6badd458990ca59fce8edaea267c03ec2c4a39e253c640b24886be60c3f26a1807386bfb47b1

memory/5040-14-0x00007FF9D49B3000-0x00007FF9D49B5000-memory.dmp

memory/5040-15-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1678834.exe

MD5 741cf7533dc12b1edceeeb05d953dd4a
SHA1 b95c702ef75da4bd8eabd03b6431a423e4e4df3e
SHA256 1ce61973bbe1a0bd48a571ef3ad5f1e6472e53d50bbefaecf187842b192ea3d6
SHA512 b51f1eca818ca18fd5c1d9b6c595343f60d91d4f64eb98f12367c56825b6c162900f1a03ec690c5f0e2e42edebc6f4cd4112a495f11690af0432f63e379e6b62

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3490647.exe

MD5 3b99009b91884fe51364e5917d969b4f
SHA1 a13eaa174a8072b3d1aaa8bf8f31d16079b00d4c
SHA256 397d9b9ba6c9c4b9b55a0cde147074700c2b382a7f67b3d5b50903f323f60ce1
SHA512 8287dc3c7190eb551b1e3df9ecffd9a3e0b1a64141084432ce791a0d03016a75ef8d4585934f402b1772e2e5a0d604813ebc27a65447208ac60f7b718f74645f

memory/1424-33-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3872 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe
PID 3872 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe
PID 3872 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe
PID 912 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe
PID 912 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe
PID 912 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe
PID 4444 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4444 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4444 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 912 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe
PID 912 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe
PID 3948 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3948 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3948 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3948 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3948 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3948 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4716 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4716 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4716 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4716 wrote to memory of 3064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 3064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 3064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 1152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4716 wrote to memory of 1152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4716 wrote to memory of 1152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4716 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4716 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3872 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1902128.exe
PID 3872 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1902128.exe
PID 3872 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1902128.exe

Processes

C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe

"C:\Users\Admin\AppData\Local\Temp\68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1902128.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1902128.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.105:443 www.bing.com tcp
FI 77.91.68.3:80 tcp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 120.150.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6348756.exe

MD5 f16412cf9905524a284c51ba6af1d5d9
SHA1 d188b711b199258da3edbdbc77441474f600f17e
SHA256 64d0d5d3dc38d20687eb0ea65178102ed00e1bca4cae9424ab7f1d054072b671
SHA512 755a4b8b84b01bdca5ad37424dacb6303fa0d5e94a2b750fb9d62263439b9b5b4d3cf0b604d0d40535ad0aa0b72a66491e3a46f525fdc9985b95247419a5374c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3486364.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6504041.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2916-27-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1902128.exe

MD5 c46cbab42bf761623b416919665c6aa5
SHA1 9a56c4281c650241d042a19ddfd51299b81f9dc3
SHA256 3989d13dd4d83277a16e2e5f434c7ae96dabc2b3539c28ce84ef605ddb644b06
SHA512 2122a98d3717887645313e42bf415380366bcd04d61c93c744616cda75b94386d9b6b3a79ca3e721ce0e3846d7a3bdd0fa1d810be5f19447c75d48e41e758120

memory/4244-33-0x0000000000850000-0x0000000000880000-memory.dmp

memory/4244-34-0x00000000012D0000-0x00000000012D6000-memory.dmp

memory/4244-35-0x000000000AC10000-0x000000000B228000-memory.dmp

memory/4244-36-0x000000000A700000-0x000000000A80A000-memory.dmp

memory/4244-37-0x000000000A610000-0x000000000A622000-memory.dmp

memory/4244-38-0x000000000A670000-0x000000000A6AC000-memory.dmp

memory/4244-39-0x0000000002A40000-0x0000000002A8C000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win7-20240221-en

Max time kernel

117s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe

"C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 48

Network

N/A

Files

memory/2224-0-0x0000000001422000-0x0000000001423000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2308 set thread context of 3332 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2308 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2308 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe

"C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
BE 88.221.83.242:443 www.bing.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 242.83.221.88.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
BE 88.221.83.242:443 www.bing.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 tcp
US 104.20.4.235:443 tcp
US 104.20.4.235:443 tcp

Files

memory/3332-0-0x0000000000400000-0x0000000000422000-memory.dmp

memory/3332-1-0x000000007486E000-0x000000007486F000-memory.dmp

memory/3332-2-0x0000000005320000-0x0000000005386000-memory.dmp

memory/3332-3-0x0000000005E80000-0x0000000006498000-memory.dmp

memory/3332-5-0x0000000005A00000-0x0000000005B0A000-memory.dmp

memory/3332-4-0x00000000058D0000-0x00000000058E2000-memory.dmp

memory/3332-6-0x0000000074860000-0x0000000075010000-memory.dmp

memory/3332-7-0x000000007486E000-0x000000007486F000-memory.dmp

memory/3332-8-0x0000000074860000-0x0000000075010000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe"

Signatures

Lumma Stealer

stealer lumma

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4136 set thread context of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4136 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4136 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe

"C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4136 -ip 4136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 340

Network

Country Destination Domain Proto
US 8.8.8.8:53 alcojoldwograpciw.shop udp
US 104.21.48.243:443 alcojoldwograpciw.shop tcp
US 8.8.8.8:53 productivelookewr.shop udp
US 104.21.11.250:443 productivelookewr.shop tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 tolerateilusidjukl.shop udp
US 104.21.89.202:443 tolerateilusidjukl.shop tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 shatterbreathepsw.shop udp
US 104.21.95.19:443 shatterbreathepsw.shop tcp
US 8.8.8.8:53 shortsvelventysjo.shop udp
US 104.21.16.225:443 shortsvelventysjo.shop tcp
US 8.8.8.8:53 243.48.21.104.in-addr.arpa udp
US 8.8.8.8:53 250.11.21.104.in-addr.arpa udp
US 8.8.8.8:53 202.89.21.104.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 19.95.21.104.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 incredibleextedwj.shop udp
US 172.67.218.63:443 incredibleextedwj.shop tcp
BE 88.221.83.193:443 www.bing.com tcp
US 8.8.8.8:53 liabilitynighstjsko.shop udp
US 104.21.44.3:443 liabilitynighstjsko.shop tcp
US 8.8.8.8:53 demonstationfukewko.shop udp
US 172.67.147.169:443 demonstationfukewko.shop tcp
US 8.8.8.8:53 225.16.21.104.in-addr.arpa udp
US 8.8.8.8:53 63.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 193.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 3.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 169.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/4136-0-0x0000000000C44000-0x0000000000C46000-memory.dmp

memory/2968-1-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2968-3-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2968-4-0x0000000000400000-0x000000000044E000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a777a11027afe934646141f176344a5c05c946b740bea45e9684b9a8b98f6676.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8588036.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f1916005.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\a777a11027afe934646141f176344a5c05c946b740bea45e9684b9a8b98f6676.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8588036.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a777a11027afe934646141f176344a5c05c946b740bea45e9684b9a8b98f6676.exe

"C:\Users\Admin\AppData\Local\Temp\a777a11027afe934646141f176344a5c05c946b740bea45e9684b9a8b98f6676.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8588036.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8588036.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f1916005.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f1916005.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.234:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 234.83.221.88.in-addr.arpa udp
BE 88.221.83.234:443 www.bing.com tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8588036.exe

MD5 62abca3fe0025c12495c94f52585a80e
SHA1 a59905051821af2c9af66e82ce282db14df62230
SHA256 6cbda37d29d4962610dc350d392d80019ab19ac2aa687ea354d0b4594fbb4e6a
SHA512 8718ce5d6443d37c388292919efa6bb733f4a6197eab3b25cc79b7dc7dba8674d02c3bfb7526099c469ac57b545b3737e42b27e26ebc7613908f4fc677097ddf

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f1916005.exe

MD5 0a7419bbcc27729e3ca4a40d7c394c22
SHA1 8b802177100ce4235b53b66589119f2e2f0e54b6
SHA256 3a444fda406f1ecc4c2830d4c2522dcd402b759b92bf2eb87d421c959b4dc125
SHA512 37cfbd1ee0dac0a9929041eecae14c00559de7e5cdecfbd2db3753f91d47c413febbd783904ba35ad87d70f4fb1e82d84f774d0c4db986536599a2aa5e8e2cd1

memory/5040-15-0x0000000000510000-0x0000000000540000-memory.dmp

memory/5040-14-0x0000000000401000-0x0000000000402000-memory.dmp

memory/5040-19-0x0000000000400000-0x000000000043A000-memory.dmp

memory/5040-20-0x0000000002430000-0x0000000002436000-memory.dmp

memory/5040-22-0x0000000005180000-0x000000000528A000-memory.dmp

memory/5040-21-0x0000000004B60000-0x0000000005178000-memory.dmp

memory/5040-23-0x00000000049E0000-0x00000000049F2000-memory.dmp

memory/5040-24-0x0000000004A00000-0x0000000004A3C000-memory.dmp

memory/5040-25-0x00000000052E0000-0x000000000532C000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win7-20240221-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5410c580a81399010c4afd0cb43116c8c6e79ed10a16ace6ca24b1180f130b5.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e5410c580a81399010c4afd0cb43116c8c6e79ed10a16ace6ca24b1180f130b5.exe

"C:\Users\Admin\AppData\Local\Temp\e5410c580a81399010c4afd0cb43116c8c6e79ed10a16ace6ca24b1180f130b5.exe"

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5498200.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5498200.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5498200.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 936 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe
PID 936 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe
PID 936 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe
PID 4292 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe
PID 4292 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe
PID 4292 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe
PID 732 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe
PID 732 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe
PID 732 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe
PID 1420 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe
PID 1420 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe
PID 1420 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe
PID 1420 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe
PID 1420 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe
PID 732 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3058882.exe
PID 732 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3058882.exe
PID 732 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3058882.exe
PID 4292 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe
PID 4292 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe
PID 4292 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe
PID 4060 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4060 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4060 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 936 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5498200.exe
PID 936 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5498200.exe
PID 936 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5498200.exe
PID 460 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 460 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 460 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 460 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 460 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 460 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3260 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3260 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3260 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3260 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 4640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 4640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 4640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 2140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3260 wrote to memory of 2140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3260 wrote to memory of 2140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3260 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3260 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe

"C:\Users\Admin\AppData\Local\Temp\e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3058882.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3058882.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 224 -ip 224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 152

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5498200.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5498200.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 187.83.221.88.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.3:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0379225.exe

MD5 6da221892326d0c4b92030b4ccc320cf
SHA1 5db258cd9e23e85f695648b65bfad6e3f6bfccb2
SHA256 ac958276b7b0a4d7de3ccab51113f9039aa63a0cbf17f838e5c8efe2d7e52262
SHA512 5ca31f0715467afcd04fac402c038f033fab0b68f9fbe457c3e3b338a21d709d2ec95455d1e66746bba881c64ec9dc694868d0cf0db55bcf974a34bcb91c4c48

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3886035.exe

MD5 d3aa94c05fe5ac55327c2eef950a061b
SHA1 ce1eca66cc00bc82384e24552b7315b93ab07d22
SHA256 7a385e472250c4e90045dae042678176959b102c4e79fa8b059daee8f0b0efb3
SHA512 90e69c9c23f9c31308d25e252d26a508b07172e0785742671db74bf3cebfd48578f612ea1efa8b452f9a81cfd593a40874d42a853a7c00277122a9ce8170316a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5225605.exe

MD5 06e2c473dd9f4d4ca74cadd7c9852a6f
SHA1 a0240d2e49a8228eb85ef0ae96d0209d6ba7fb0f
SHA256 861e995073e133de6ad84b51adb67332fb57b24bb10e69a3065ced97c8b64883
SHA512 73a8c60ac78e2eff3d748d60ab91a6e064ee286c8782deb129520f2c3cbb6594432acaea11be97f961db56e27fc9314aa2870e9c1dd12735264d1bc69cf28e1e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7964473.exe

MD5 0fad0731a17584b272fefdee36f9593f
SHA1 79df231268357fbd8f63924f286fdc9536d9d8f5
SHA256 79d075ad246bae27993c2040fb2008bbecaa571010dfb9da2df3e7a95d64a1ff
SHA512 ec50ff97f98a0dcad74b0de24311e44dd629f096d0cca43d92d0e298d9e713986552b19ea6ee6bcd0e63b628648dd03e94dfd2d6c38c7511f1660531b590de35

memory/4992-28-0x0000000000500000-0x000000000050A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0872850.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1460-37-0x0000000000910000-0x000000000091A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3058882.exe

MD5 0019a8984589495412bcf3aec163cb87
SHA1 69f8038ade6c8518fc5efa76de6cb5d8040ba15e
SHA256 e345e5341d98cb42a620e75171d372217fdd203bdb75b2d5971049b42853174b
SHA512 c8dc2e742182ce76848571ba2ac2e1ef4e207db8cbbfecff9d0704e3c3d1fb8f1de253986f08fe10e2dcf7904898676760bf7b23245a499a2b8f05a88d3dca1f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d2062415.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5498200.exe

MD5 35a15fad3767597b01a20d75c3c6889a
SHA1 eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA256 90ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512 c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577

memory/3576-58-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3576-59-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

112s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5410c580a81399010c4afd0cb43116c8c6e79ed10a16ace6ca24b1180f130b5.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e5410c580a81399010c4afd0cb43116c8c6e79ed10a16ace6ca24b1180f130b5.exe

"C:\Users\Admin\AppData\Local\Temp\e5410c580a81399010c4afd0cb43116c8c6e79ed10a16ace6ca24b1180f130b5.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.122:443 www.bing.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 122.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
BE 2.17.107.122:443 www.bing.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d2e176ff101b33e0adec2558415b76c1425ba9502c4b652c64b4751dd11181c.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\2d2e176ff101b33e0adec2558415b76c1425ba9502c4b652c64b4751dd11181c.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2d2e176ff101b33e0adec2558415b76c1425ba9502c4b652c64b4751dd11181c.exe

"C:\Users\Admin\AppData\Local\Temp\2d2e176ff101b33e0adec2558415b76c1425ba9502c4b652c64b4751dd11181c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.242:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
BE 88.221.83.242:443 www.bing.com tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 242.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 28.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2651355.exe

MD5 175e3db636d9fd541cc11991815ea662
SHA1 c5e30c78f298c1aa26768bc036795e19ed7e60d7
SHA256 c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e
SHA512 06b1bc8a9746e8dfd1a4d72e98b8b76a1f543ae0c72c9e0233dce81451d7521f586da373e69459170a8d9442da4883f8247cfb9714227744c765c892583ac5c9

memory/3008-7-0x0000000000560000-0x000000000059E000-memory.dmp

memory/3008-13-0x0000000000401000-0x0000000000404000-memory.dmp

memory/3008-14-0x0000000000400000-0x000000000044E000-memory.dmp

memory/3008-15-0x0000000000560000-0x000000000059E000-memory.dmp

memory/3008-16-0x0000000002450000-0x0000000002451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7896309.exe

MD5 06d9b8f9236b959006976da775fea5e7
SHA1 46d5c5e6a3e7de6138cd764509a6754ce24d9484
SHA256 77353ead4144432dfd0e8fc833c458c8b88fb5d6bf7c9818ac430be40983b7f5
SHA512 ec0c6135f2b39d70cb35bd713d5fd9a0876055b46584f3535067f0f162be149024770c990e61ee041eabe5d3daf53aac49e747bb96189c3fa17346774a5edc6d

memory/3940-23-0x00007FFF387A3000-0x00007FFF387A5000-memory.dmp

memory/3940-22-0x0000000000E70000-0x0000000000E7A000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 448 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe
PID 448 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe
PID 448 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe
PID 1072 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe
PID 1072 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe
PID 1072 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe
PID 1072 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe
PID 1072 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe
PID 3856 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3856 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3856 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 448 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4481990.exe
PID 448 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4481990.exe
PID 448 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4481990.exe
PID 3088 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3088 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3088 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3088 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3088 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3088 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 4864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 4864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 4864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 1628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 2172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 2172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 2172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 4480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 4480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 4480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1392 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe

"C:\Users\Admin\AppData\Local\Temp\2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4481990.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4481990.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7851656.exe

MD5 b2756133ba3a2a3b73d52b9deb78ff16
SHA1 a8246d03686a1b75621f401da5165d6bb47afb7d
SHA256 255316c9f74f070748abf245a610ec6bf446f4e6440bf0b687be9a3a62a475bc
SHA512 fd02f6296f93e40e8377e1c7c99bb3855e4045585b77e9f95783cc9b9a8d402b3a30617b1702b478cdc28c182f25de015435f082dea2da0a35df5b09a488ae0f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4124944.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2232-15-0x00007FFCACA73000-0x00007FFCACA75000-memory.dmp

memory/2232-14-0x0000000000F10000-0x0000000000F1A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2482875.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4481990.exe

MD5 8abfeb7aeec2b33dc3801c808ab5da2e
SHA1 1cce5142a0452d218c9e5bc7a6fac9090b6ae356
SHA256 d588da610e5cfc5f40d829f6a2427536662f0d55ed17f244e1ded7ecc2b8f5aa
SHA512 4a0cbd0d79bee2b40be9dc2b0e54c8d3eb1b6df7b29a1a4c73d4f07a69bb58353539161ce1627974e86267022c30a96ce8ea0665fd5877b8e2b12583538d014d

memory/852-33-0x0000000000210000-0x0000000000240000-memory.dmp

memory/852-34-0x0000000004C70000-0x0000000004C76000-memory.dmp

memory/852-35-0x00000000052B0000-0x00000000058C8000-memory.dmp

memory/852-36-0x0000000004DA0000-0x0000000004EAA000-memory.dmp

memory/852-37-0x0000000004CE0000-0x0000000004CF2000-memory.dmp

memory/852-38-0x0000000004D40000-0x0000000004D7C000-memory.dmp

memory/852-39-0x0000000004EB0000-0x0000000004EFC000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2816 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe
PID 2816 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe
PID 2816 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe
PID 1488 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe
PID 1488 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe
PID 1488 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe
PID 1028 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1028 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1028 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1488 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe
PID 1488 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe
PID 3952 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3952 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3952 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3952 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3952 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3952 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 3956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 3956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 3956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 1328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 1328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 1328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1216 wrote to memory of 4332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2816 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0348313.exe
PID 2816 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0348313.exe
PID 2816 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0348313.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe

"C:\Users\Admin\AppData\Local\Temp\2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0348313.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0348313.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4653641.exe

MD5 895ae5261d9e8cd94412d0d01c97bcba
SHA1 d555f1c1ff0e72ba1ac905218feda7dfae5443f8
SHA256 1b71d6f10e19c0a6c23648995a720dd29c6555711e0a25e7b998601c1f2d18ae
SHA512 ddb7815388934879180be58843137d37f20fc692013374e5c9473d727ec8114e315c52a9de2e480aeb3a727fc3c410aaef9af657b5997aef67aed521652832a2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9901543.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1832284.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4492-27-0x0000000000A00000-0x0000000000A0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0348313.exe

MD5 6efc9a0d81d3664ff4ec54086cfea6a4
SHA1 3fa4bcfa54501619b683f5b9abe78aaba8bc9b2e
SHA256 000608d875638ba7d6c467ece976c1496e6a6ec8ce3e7f79e0fd195ae3045078
SHA512 4a4e362eb22a803ade24ffd935f607f3bebf3b3022fec00825985a531364db22358d95603cd71aba3ff9ece998a5371e062c52bc19c3e204ec0bcbee42f5e84d

memory/912-33-0x0000000000B90000-0x0000000000BC0000-memory.dmp

memory/912-34-0x0000000003000000-0x0000000003006000-memory.dmp

memory/912-35-0x000000000B050000-0x000000000B668000-memory.dmp

memory/912-36-0x000000000AB40000-0x000000000AC4A000-memory.dmp

memory/912-37-0x000000000AA80000-0x000000000AA92000-memory.dmp

memory/912-38-0x000000000AAE0000-0x000000000AB1C000-memory.dmp

memory/912-39-0x0000000005040000-0x000000000508C000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

165s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3d5d854d7b4667609b1a4eb70e50a6f99578a6ede0809793fc835cf2aebd7221.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3d5d854d7b4667609b1a4eb70e50a6f99578a6ede0809793fc835cf2aebd7221.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2594826.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3d5d854d7b4667609b1a4eb70e50a6f99578a6ede0809793fc835cf2aebd7221.exe

"C:\Users\Admin\AppData\Local\Temp\3d5d854d7b4667609b1a4eb70e50a6f99578a6ede0809793fc835cf2aebd7221.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2594826.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2594826.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6341956.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6341956.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4188 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 91.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2594826.exe

MD5 c81976d3b76689126f23736196ac2a1e
SHA1 3aecc10ee9a90060cef86fad04a38970af4a2367
SHA256 fbf1bec98035284be58ed37cdbcfed35f51e5469097bf35ee29d9b7d1ff39f8f
SHA512 3e4f47f2bf251d3117220bb0d5f0cc5d92b73b9adea5345904c7c043c1c85deb5ac8df0b6dd6c65bb5b01be443c34f95d2b21e90b20717568e22016f2cb30c3e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4617027.exe

MD5 9e76099f7a4247de6b058279692b5e32
SHA1 5bea3724c057e7378cf436869280cc8634d837a0
SHA256 34f0e00129636feb6a1913658b43cf7ce9470b02f19c5c443e8d92e4ae566727
SHA512 3e468e7ff9bcfec0e8561ebbd17cb55de2ac4f6ba6f8852114a9a833d67ba1bc655b77c5b36a130f5f3495f2c10e5fcc45e5d0e2896a8fcf3b6542530d2d09cc

memory/4600-14-0x00007FF970CE3000-0x00007FF970CE5000-memory.dmp

memory/4600-15-0x00000000005F0000-0x00000000005FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6341956.exe

MD5 2c37b9d6ca82651a983b3c6f4452f058
SHA1 18334afa58e1db710f21403cebfc87c8fb4ed6a7
SHA256 67ee8d11ae7cb18e54501025e1a3d0faaabf267f59e59599fc76dce395395515
SHA512 204ac8b1a7c57003c1e26c76261c060d9f89885294bd369eb29231e1b7ab9544fa6a75c052723c69f0351ff1e83788b2e641b7fa82bf0498537fd4acca3e348c

memory/3552-20-0x0000000000BF0000-0x0000000000C20000-memory.dmp

memory/3552-21-0x00000000078A0000-0x00000000078A6000-memory.dmp

memory/3552-22-0x000000000B2A0000-0x000000000B8B8000-memory.dmp

memory/3552-23-0x000000000AD90000-0x000000000AE9A000-memory.dmp

memory/3552-24-0x00000000054C0000-0x00000000054D2000-memory.dmp

memory/3552-25-0x000000000AC80000-0x000000000ACBC000-memory.dmp

memory/3552-26-0x000000000ACC0000-0x000000000AD0C000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2604 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe
PID 2604 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe
PID 2604 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe
PID 2860 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe
PID 2860 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe
PID 2860 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe
PID 3068 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe
PID 3068 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe
PID 3068 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe
PID 4576 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe
PID 4576 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe
PID 4576 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe
PID 4576 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe
PID 4576 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe
PID 3068 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0933471.exe
PID 3068 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0933471.exe
PID 3068 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0933471.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe

"C:\Users\Admin\AppData\Local\Temp\c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0933471.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0933471.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.193:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 193.83.221.88.in-addr.arpa udp
BE 88.221.83.193:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe

MD5 424a3a9e388e8d4a143b78c18ca1b2c6
SHA1 7ab6f901d0d5d4fa7975097a215f37f2db0ceef6
SHA256 ef55c277b76336f83cf5f0b3e52fba5619ed8d90bc5166f3f9faefa34ac9f0ee
SHA512 64582f5fd930e7e42eb98dfffe330270446c6b1ca32b734907b1eddcbce93d04cee79c40f91a8f4704a4824dc5b7087875f961f652f4683a73e048eaaeea9786

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe

MD5 c2009317a168ce808f1b4abba0b792b1
SHA1 c16efb6d091d2a71ee9ba39d21d7617ddb324c28
SHA256 6429cbb349f93b5aef577412bc38be6d99a71362715c37dec7f671bfd2d43f8f
SHA512 40e5c0baa82bd300077d009af450ac76c1c602fe688cd65293565e3fc013151380ee334bd25e1a4505207a4547a1c2e9c95a5e18c71ea4de5ce5cf394ad49d58

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe

MD5 391fd1a83e790f6dd27276d9cf6d62f9
SHA1 ef4797b43151a8843647edbf32ee73f615d07dfe
SHA256 82f9a9ce84ade18863aa0e160ca1dd14cf2281d7602b34d0bf2e1c398f5d832a
SHA512 87e214f7090817f36b1db1faaf4e823be086f22fa7149619774e1995df7d2d0b61f9e9fafda658979016a66dec65a5d2ca68c1ee97493bc51c445a3cbd3d2a57

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe

MD5 dc806f3ebddbe8981ea2d83a522f13f5
SHA1 1c1b91044afdca07c99bece215fa8775c2d53084
SHA256 e3fe09c60edbad4bfcc881428c8425e91b9287e2b3116817a6dcc1f39b8ccc50
SHA512 20d4a7963ce40638369fa0a8a5633a4d1125947aa874c9ec6f57f0ceca307534ba7bec3ee95b96a7e22c65cb234f13c68536afd783995d0236f7139f1b0884ba

memory/808-28-0x0000000000420000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3124-37-0x0000000000D50000-0x0000000000D5A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0933471.exe

MD5 214c73137cc743a9c012c1c8cf932769
SHA1 d0b1f04df8dcb6804a1fed0898ddf2b5b159605c
SHA256 5677c49a17a767d7de2e2d88fc5a4fc8bfd93744afd46e6e321df03d5af6b6de
SHA512 42ab7caca363775508335667be71f41b8207ffcd96310b1f41e70e0ee4616c8279913e3e44ce5499e718b996df86cb506fb181cc9a248f34760d6a038726958a

memory/4524-42-0x0000000000460000-0x0000000000490000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4524-47-0x0000000004A60000-0x0000000004A66000-memory.dmp

memory/4524-48-0x0000000005110000-0x0000000005728000-memory.dmp

memory/4524-49-0x0000000004AF0000-0x0000000004BFA000-memory.dmp

memory/4524-50-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/4524-51-0x0000000004C20000-0x0000000004C5C000-memory.dmp

memory/4524-52-0x0000000004CC0000-0x0000000004D0C000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4572 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe
PID 4572 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe
PID 4572 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe
PID 3764 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe
PID 3764 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe
PID 3764 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe
PID 3764 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe
PID 3764 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe
PID 4964 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4964 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4964 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4572 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2614975.exe
PID 4572 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2614975.exe
PID 4572 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2614975.exe
PID 552 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 552 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 4672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 4672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 4672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 3520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 3520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 3520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 3808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 3808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 3808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2096 wrote to memory of 384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe

"C:\Users\Admin\AppData\Local\Temp\de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2614975.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2614975.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6500803.exe

MD5 d8d4f787eef9c74ac2375bb1fa9753cf
SHA1 07a9d651bcbcebbf3cb749e91f2e49ddbf0a5431
SHA256 d5afc35430e2079810111fe316383e704b1305ad493a978e487e22ed020bdcca
SHA512 330676c98345b50a77cdeb49f32c07ad079bf31b6aa3d47cff9521a8683ab7b5740f5a77eddc7a62973c97623ff6f647c32511ba881d58958998982ba63618d7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0737666.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3152-14-0x00000000009A0000-0x00000000009AA000-memory.dmp

memory/3152-15-0x00007FF800B33000-0x00007FF800B35000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5310511.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2614975.exe

MD5 8f0c994ca24d275d8a6bb30e904d20c6
SHA1 5c194b77949bb584fb64aa453419afa4bd3b1092
SHA256 5a58766cfd7b4e93669849142e7a7ccf23381fcaef17115e642ccc83a43b1794
SHA512 9079b4879a6b49c0335a65f4241b922956c788ab795e449b5cd6efd4d9c519ba8dc78a45a8341444f5aaac9e42e3d132c31d316baf8585f3c8c4e22b78060e64

memory/2956-33-0x0000000000800000-0x0000000000830000-memory.dmp

memory/2956-34-0x0000000005160000-0x0000000005166000-memory.dmp

memory/2956-35-0x0000000005980000-0x0000000005F98000-memory.dmp

memory/2956-36-0x0000000005470000-0x000000000557A000-memory.dmp

memory/2956-37-0x00000000051C0000-0x00000000051D2000-memory.dmp

memory/2956-38-0x0000000005360000-0x000000000539C000-memory.dmp

memory/2956-39-0x00000000053A0000-0x00000000053EC000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2112 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe
PID 2112 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe
PID 2112 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe
PID 2404 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe
PID 2404 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe
PID 2404 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe
PID 4992 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe
PID 4992 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe
PID 4992 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe
PID 4992 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe
PID 4992 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe
PID 796 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 796 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 796 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2404 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe
PID 2404 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe
PID 2404 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe
PID 2112 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1158735.exe
PID 2112 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1158735.exe
PID 2112 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1158735.exe
PID 3836 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3836 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3836 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3836 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 1052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 1052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 1052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 4360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 2924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 2924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 2924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe

"C:\Users\Admin\AppData\Local\Temp\2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1158735.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1158735.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 23.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 52.111.227.11:443 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.184:443 www.bing.com tcp
US 8.8.8.8:53 184.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BE 88.221.83.184:443 www.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6567793.exe

MD5 9b204b2174a61c3e2815e3569c80bb85
SHA1 966c4bddfe02f4c8cc982884dcf3bd67ac3163b6
SHA256 bc129c8b7d126c4cb90fbd9f6833d826970e1bb867a54ecb2679e877a00d74aa
SHA512 c6d93ae2ba32808382103db707769f98c6d8e7b7b7672c8c9533b0b4492c1c16c993136dc0c3343a0cd48207c532aaad3ace719de3477af4c864e6f18bd94c10

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4958607.exe

MD5 82d30b790fbf41a0838164d7ffd6afdc
SHA1 6c5785fc27a3d2caa6ced1e70a661ee11cafec7b
SHA256 903f6fb97cf39c429be2a66afa9a5e2915d9ecde0bc5da8ecd0a3872da801a96
SHA512 1b353ab7c21ea6d9289043beba7ff5ddab454b5b31987fe77e304f8c912b43acb984d793638b0d2b76d3420c9f88d81a09a688bd0dc7aabfdbefd079fbb13e90

memory/436-21-0x00007FFA0EB83000-0x00007FFA0EB85000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a9197909.exe

MD5 62866370b0dc6f5041d08f2d38047782
SHA1 a50c4d603103ec5861f7d5ef39f18cb9a03d7801
SHA256 be1539a435f623d28287b7f6b21eb1a3fc044164f4d0b4f3685e6e6c79e20bcf
SHA512 e6153a4c8bc463da3fded770678a092318721d953de295d3a541aaf6a01e949d54f94b93f64d86db4053ece3f4878fdfd56770e11db67269071afbf47dd86350

memory/436-22-0x0000000000980000-0x000000000098A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8495749.exe

MD5 9a84e9c91a6baaade040329fb470db95
SHA1 8ac38c6258357a0ae4e2eacdaa9987bad9851bfd
SHA256 0fd1eecbbdff423485bceb15920b4d531d34a1046afca08cdf5850e63254505b
SHA512 1cff7df39f350b7d5a8e8613d900019bd0f3236bf96f90153b760a4d770e0325f4a19fe2dc1a3ce6b17f6cc0313562525039cad3d44bbb77a99adcc4529b120d

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1158735.exe

MD5 725c8322fe9260d7b3f57fa0f56ce592
SHA1 2aed692c51508d505fa5c329171d4d6a7610a9df
SHA256 087e6a20031a0e98fd0fd3cd088158189422fd89925aff5974f8b0a075e8d2f1
SHA512 2f7cc3c3025bb5994df3c285fffb316cb883aec22be5f63865122ce0d0ea0b4ac7814ca50422918c382ddddfe79f60cbe359066ae8f438394a1b41a124244ca9

memory/4616-45-0x0000000002CE0000-0x0000000002CE6000-memory.dmp

memory/4616-46-0x000000000AE60000-0x000000000B478000-memory.dmp

memory/4616-47-0x000000000A9B0000-0x000000000AABA000-memory.dmp

memory/4616-48-0x000000000A8F0000-0x000000000A902000-memory.dmp

memory/4616-49-0x000000000A950000-0x000000000A98C000-memory.dmp

memory/4616-50-0x0000000004EA0000-0x0000000004EEC000-memory.dmp

memory/4616-44-0x0000000000A00000-0x0000000000A30000-memory.dmp

memory/3548-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4014415.exe

MD5 b41a7e3a97626db737fd17b391b48ca3
SHA1 6dacf3209a223ce1c0a241886fe89d65dcf7e471
SHA256 fc94039a0791b8a000dcc26e26e873d66cb879352e52b1ac4cdce6c708f7dab3
SHA512 3a75b8490b5eb1765a54751352d598cc5d2c4eada1dd2d70018bc45c97c21d6e9b237409094cd56c12bbb11e5789a57acb403daf4c864229ccfaacb6532afad0

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3a0ceb2aa80172e3223e5154bd251fc1909cd353262609fa6bfeeb684d7761f5.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3a0ceb2aa80172e3223e5154bd251fc1909cd353262609fa6bfeeb684d7761f5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3304 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\3a0ceb2aa80172e3223e5154bd251fc1909cd353262609fa6bfeeb684d7761f5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe
PID 3304 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\3a0ceb2aa80172e3223e5154bd251fc1909cd353262609fa6bfeeb684d7761f5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe
PID 3304 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\3a0ceb2aa80172e3223e5154bd251fc1909cd353262609fa6bfeeb684d7761f5.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe
PID 3516 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe
PID 3516 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe
PID 3516 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe
PID 4876 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4387079.exe
PID 4876 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4387079.exe
PID 4876 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4387079.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3a0ceb2aa80172e3223e5154bd251fc1909cd353262609fa6bfeeb684d7761f5.exe

"C:\Users\Admin\AppData\Local\Temp\3a0ceb2aa80172e3223e5154bd251fc1909cd353262609fa6bfeeb684d7761f5.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4387079.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4387079.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
FI 77.91.68.56:19071 tcp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 203.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3451041.exe

MD5 85e427c9257b0a8c8bedf49c79cce243
SHA1 27b41475c02ae0b7101248183190fc85f67f27e6
SHA256 3b28862d97c3be0a36fd1fb19283a3f5ec02c1ce450fedab6193832042bba304
SHA512 55163548c386076b28f57b5c7607dde49596cfeb6eb8121faa33aa841847153fab7cdcecce05a8263d8c5b8c82ab01105d3a09cf020d83bd5ea0637831a36292

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4387079.exe

MD5 e76acee1a8aec03021a19b513b2840eb
SHA1 0f7f101568ba939c3dde1bbee456ef558e005960
SHA256 11d122567336ec2641f0f38b47fb9f469d9b4ffee8a017f996a028b8989a597b
SHA512 dcd6da202bbcf52fadfd1d12a25eb88383e76274dbd09044e9dc40e36542b4c0791234bbb3101e1e61f48958b00dac26e7c266a65bf3bd54ddec37e2fcd8a3eb

memory/3104-27-0x0000000000401000-0x0000000000404000-memory.dmp

memory/3104-21-0x0000000001F70000-0x0000000001FFC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9533140.exe

MD5 057890c139b53466ef5bbcb05515c57e
SHA1 17d1c24af2d4b793379e6327284ee17cd83085a4
SHA256 24469b80d067dd8f3702e4e57f38768755b7eda20faf24a55577313b6a13b420
SHA512 efc310031c8e7a19b33af06d33baec7474f359fdb33905f19c135564f59ac030968ef4cfa59697836211a4d26e36820899c2c9da4a8d36f2f5e6996635813b28

memory/3104-29-0x0000000004660000-0x0000000004661000-memory.dmp

memory/3104-30-0x0000000004670000-0x0000000004676000-memory.dmp

memory/3104-28-0x0000000001F70000-0x0000000001FFC000-memory.dmp

memory/3104-31-0x0000000004B30000-0x0000000005148000-memory.dmp

memory/3104-33-0x0000000005310000-0x0000000005322000-memory.dmp

memory/3104-34-0x0000000005330000-0x000000000536C000-memory.dmp

memory/3104-32-0x00000000051E0000-0x00000000052EA000-memory.dmp

memory/3104-35-0x00000000053A0000-0x00000000053EC000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7732b3137a721cb543261e9c4ecb5c90b51aa6d810c2df0104df6b11e319dbd8.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\7732b3137a721cb543261e9c4ecb5c90b51aa6d810c2df0104df6b11e319dbd8.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1436 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\7732b3137a721cb543261e9c4ecb5c90b51aa6d810c2df0104df6b11e319dbd8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe
PID 1436 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\7732b3137a721cb543261e9c4ecb5c90b51aa6d810c2df0104df6b11e319dbd8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe
PID 1436 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\7732b3137a721cb543261e9c4ecb5c90b51aa6d810c2df0104df6b11e319dbd8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe
PID 4840 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe
PID 4840 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe
PID 4840 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe
PID 4840 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2172114.exe
PID 4840 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2172114.exe
PID 4840 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2172114.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7732b3137a721cb543261e9c4ecb5c90b51aa6d810c2df0104df6b11e319dbd8.exe

"C:\Users\Admin\AppData\Local\Temp\7732b3137a721cb543261e9c4ecb5c90b51aa6d810c2df0104df6b11e319dbd8.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2172114.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2172114.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 23.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.186:443 www.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 186.83.221.88.in-addr.arpa udp
BE 88.221.83.186:443 www.bing.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2690955.exe

MD5 04bd608be3bfa271d618996bbde53d41
SHA1 42c61c4a3e542a8f462faf5f962e65b24cb24266
SHA256 346670d3d21a3e2c75c20aea1c1dccaa6d0a72b695b279d36b73fe2694651f34
SHA512 364a37baf2ec0e2cd54ec1b59b89bcbdc0474f5881b271459ac492c8573e75205df6e03da2cadebaf9b0fc169212d7e1a0eb1b1c571e70f3315498e8d244e561

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2233386.exe

MD5 3a6f33984527cca829cade6f92cbf484
SHA1 cefab0f24b72175e252607c714877c224cdff00c
SHA256 5bc14adb029c8f7153917dbb2f7b72a4a3d1bc008299456008d4beedd9faa487
SHA512 2688e9d048defe7a36e9e6db4436c62093dc47eb2370637f258c6f57d06e1369a096adeb5ce9672b5acc36ff1aac8faf55dd6a6a3ec08afbb0419454bcc015ef

memory/4964-14-0x0000000000401000-0x0000000000402000-memory.dmp

memory/4964-15-0x0000000000420000-0x000000000042A000-memory.dmp

memory/4964-19-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2172114.exe

MD5 5e4afb01943414fdbf3779e670279789
SHA1 55ca31778a2566d6e7616afaf354c691deb01ba1
SHA256 2a2d61669452638be6bfaaf64e619e5393ff569eea221cac2e6a84833faff9f2
SHA512 2740c5b66eb4fc883435947584f42f7db7962d82eded12b8ed0c8fbe260a5aebb73f3c3120a7833e7e40ff40da5eb3b76b35142a1095bb516c2232c32e254b66

memory/4176-25-0x0000000000510000-0x0000000000540000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4176-30-0x00000000020D0000-0x00000000020D6000-memory.dmp

memory/4176-31-0x000000000A4E0000-0x000000000AAF8000-memory.dmp

memory/4176-33-0x000000000A020000-0x000000000A032000-memory.dmp

memory/4176-32-0x0000000009F00000-0x000000000A00A000-memory.dmp

memory/4176-34-0x000000000A040000-0x000000000A07C000-memory.dmp

memory/4176-35-0x00000000043F0000-0x000000000443C000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-09 11:56

Reported

2024-05-09 12:00

Platform

win7-20240220-en

Max time kernel

122s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe

"C:\Users\Admin\AppData\Local\Temp\9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 116

Network

N/A

Files

memory/1856-0-0x0000000001434000-0x0000000001436000-memory.dmp