Malware Analysis Report

2024-10-16 03:44

Sample ID 240509-r593tsfb7x
Target red.zip
SHA256 b0775c8fcdd8ebb0123f9b03757952498595475777fac3bbde3e90ed10d13558
Tags
healer redline masha dropper evasion infostealer persistence trojan amadey lande smokeloader backdoor lumma stealer papik lamp lux3 7001210066 discovery krast 5195552529 spyware roma kira
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b0775c8fcdd8ebb0123f9b03757952498595475777fac3bbde3e90ed10d13558

Threat Level: Known bad

The file red.zip was found to be: Known bad.

Malicious Activity Summary

healer redline masha dropper evasion infostealer persistence trojan amadey lande smokeloader backdoor lumma stealer papik lamp lux3 7001210066 discovery krast 5195552529 spyware roma kira

Lumma Stealer

Healer

Amadey

Modifies Windows Defender Real-time Protection settings

RedLine

RedLine payload

SmokeLoader

Detects Healer an antivirus disabler dropper

Windows security modification

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Creates scheduled task(s)

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 14:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240426-en

Max time kernel

140s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\755b6a534ecd54fe181f1ec9de55ba3fba4d9177430ed1586a6ecc6183812e41.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\755b6a534ecd54fe181f1ec9de55ba3fba4d9177430ed1586a6ecc6183812e41.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3380 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\755b6a534ecd54fe181f1ec9de55ba3fba4d9177430ed1586a6ecc6183812e41.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe
PID 3380 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\755b6a534ecd54fe181f1ec9de55ba3fba4d9177430ed1586a6ecc6183812e41.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe
PID 3380 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\755b6a534ecd54fe181f1ec9de55ba3fba4d9177430ed1586a6ecc6183812e41.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe
PID 4232 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe
PID 4232 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe
PID 4232 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe
PID 1480 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe
PID 1480 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe
PID 1480 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe
PID 1540 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe
PID 1540 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe
PID 1540 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe
PID 1540 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe
PID 1540 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe
PID 1480 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9599982.exe
PID 1480 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9599982.exe
PID 1480 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9599982.exe

Processes

C:\Users\Admin\AppData\Local\Temp\755b6a534ecd54fe181f1ec9de55ba3fba4d9177430ed1586a6ecc6183812e41.exe

"C:\Users\Admin\AppData\Local\Temp\755b6a534ecd54fe181f1ec9de55ba3fba4d9177430ed1586a6ecc6183812e41.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9599982.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9599982.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
BE 88.221.83.217:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 217.83.221.88.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 193.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2323350.exe

MD5 0d85fc69da9324944242e79dbc1eefde
SHA1 395ff38307e576a0b6620f3af95ce1a6a661bcad
SHA256 2c0c54f060489cc82a15e95c8c2819583482cc493d3c58341453a173e8d87bb9
SHA512 7ca13450dfc269e0e858eeba715d8f191d98d36de1e9ade4f52ee415cc61ee31f0ecc7f92525ab058e4e057b97e0c229af58805c7d4d77fa049e4f3a3e8aa35f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4949453.exe

MD5 73c53ab529c8a6fa83de95bf5ebb304b
SHA1 c063d1e63fb64d020da7582a67e17a3357d2a819
SHA256 5be2d1bcc4d9ee4f6e33bee68338b55812fe96d3f854b6d950ea43fd16290d69
SHA512 884949c9e742b3c15268808da62d6323510159fc1066a6eee00f602731b6cd0e336638ea6e35410dbe9fdd057bfe28f746e69d23d0e3471ea49d60f4e4924a13

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6321787.exe

MD5 5ad3b8790bf7d920f98f4d64ff7c7412
SHA1 e999531a09f6856535a3adc0d90d796486a33b99
SHA256 42c8992894c5db50511241661e52512a2c55078102f8693fd4f229a1d868aec2
SHA512 f8ff9fa3cc42dccb6628b991b2ce1d37474f5e05d0f4dc8497a77d7c30d155862e4bc18626b95f9e08e0b6c814a31abf2870ee2feb605ebf4db918cf93ff78d5

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8252631.exe

MD5 d74cb65d452b63e69711a30e3f15ff47
SHA1 030a72a4b9dae5e353d720068c5eb7ef6080bdb3
SHA256 93b8bbb8698f84222d85143b6580eae2e743572ea364378b0322fe17f2400da2
SHA512 d038a10ac29af26469b85783072851390918de10dfb285ad794f034d4deef5c2e860ec16750685a11fde5ce2c886016bddbef8097db9f8f59fcd94a98fe47acd

memory/1788-28-0x0000000000420000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6285919.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4008-37-0x0000000000490000-0x000000000049A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c9599982.exe

MD5 475d0ecc8694f7095508c0bd5b0ae28e
SHA1 dc069c0912dcfbefd45a500cb3278e39c67c955e
SHA256 8712754417238e8bccd196c9235446c7bc25b95be69774d359b49057325e4f8d
SHA512 b11a2067a2f103df629fc030a32ceff4d0bdbbe040b01411fc060925225486a9a1c6a0a1cd72eb987bd8d0e3e64bf88d1938e7214cf365ffdc8a2b0edc1b26e9

memory/432-43-0x0000000000440000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/432-47-0x0000000002370000-0x0000000002376000-memory.dmp

memory/432-48-0x0000000009EF0000-0x000000000A508000-memory.dmp

memory/432-49-0x000000000A510000-0x000000000A61A000-memory.dmp

memory/432-50-0x000000000A640000-0x000000000A652000-memory.dmp

memory/432-51-0x000000000A660000-0x000000000A69C000-memory.dmp

memory/432-52-0x00000000044B0000-0x00000000044FC000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win7-20240221-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe

"C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 92

Network

N/A

Files

memory/2420-0-0x00000000011F9000-0x00000000011FA000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2588 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe
PID 2588 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe
PID 2588 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe
PID 4340 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe
PID 4340 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe
PID 4340 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe
PID 4340 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe
PID 4340 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe
PID 2148 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2148 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2148 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2588 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4310013.exe
PID 2588 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4310013.exe
PID 2588 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4310013.exe
PID 4760 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4760 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4760 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4760 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4760 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4760 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 1524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 1524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 1524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 1900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 1900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 1900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 4412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 4412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 4412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1512 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe

"C:\Users\Admin\AppData\Local\Temp\559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4310013.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4310013.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7041233.exe

MD5 183806bbe94ffb23e6c01226cd4915ee
SHA1 998b949e4c20f7ba170dea950bdae3b362d59bda
SHA256 ac3392df31711209fa4a6b0583d8e3db99d3338ef656d3323c32c66826ccaf11
SHA512 8243f4aba19476b089b4d59ab2ee4a7e461dc8e0aa0e6837c08369fecc1d76cbfb231c59a25abc155e892ab9c0caac755e2848fb7b33c44dac7d6a7dc15b6e01

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4362728.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1148-14-0x00007FFA53933000-0x00007FFA53935000-memory.dmp

memory/1148-15-0x0000000000A40000-0x0000000000A4A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2300210.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4310013.exe

MD5 5ff1425b42293387a69b84bac555297e
SHA1 d7c86fcedc65935563218b66e9df4a5c6e7e409f
SHA256 4b1981dd1b27cd2d082d28431e9362e0d3d435cb227fd209d28c56bf791c835e
SHA512 6c022f100a89b8a000596d7ab737d117b574e19126b907dd83c917ca85159baf207bc438bca6ac360cd86bfef925327cb3a573f47834e2a592343c16c4909265

memory/3864-33-0x0000000000460000-0x0000000000490000-memory.dmp

memory/3864-34-0x00000000028B0000-0x00000000028B6000-memory.dmp

memory/3864-35-0x00000000053B0000-0x00000000059C8000-memory.dmp

memory/3864-36-0x0000000004EB0000-0x0000000004FBA000-memory.dmp

memory/3864-37-0x0000000004DF0000-0x0000000004E02000-memory.dmp

memory/3864-38-0x0000000004E50000-0x0000000004E8C000-memory.dmp

memory/3864-39-0x0000000004FC0000-0x000000000500C000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2392 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe
PID 2392 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe
PID 2392 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe
PID 3380 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe
PID 3380 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe
PID 3380 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe
PID 3380 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe
PID 3380 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe
PID 4076 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4076 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4076 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2392 wrote to memory of 5660 N/A C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe
PID 2392 wrote to memory of 5660 N/A C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe
PID 2392 wrote to memory of 5660 N/A C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe
PID 1928 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 1928 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 1928 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 1928 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 5752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 5752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 5752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 5688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 5688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 5688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 6128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 6128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 6128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 5640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 5640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2020 wrote to memory of 5640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe

"C:\Users\Admin\AppData\Local\Temp\6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.131:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 131.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4192759.exe

MD5 f6c9e67f472f01eccc2c794be5bc61cf
SHA1 65ca30935f69dd98e136485fa24ecd00dd2afdef
SHA256 079faabeddf8ac54de6accc9d09b63bf543afdcaf395234f1dbfcf46c5d56d99
SHA512 ba9c4a04454db187a5fbfd64068729523b364bf72085e6b08607970e4cad972691dafc125981b52178f4fd8ea0d5314e42e61d7852ed4c912521a5a4809bfac6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7507750.exe

MD5 f5773b2b65f54e39abe894025d6c9885
SHA1 3f9d26e35dff7640478119ff8550b6ad5363dfde
SHA256 9788cb0fcb4b0bb8086babe2cf499aec511ce0a867ad0c79e79c5c9d9a57d561
SHA512 27a9015725854d7740536c7d403bd4b01f1baa4e4d6bf195f6b25e9055d58b397303d8aef8d833d761eb1ed62563fe4b7c7a12af0edbf80ba1dea3eb24dfb016

memory/2360-15-0x00007FF8C52C3000-0x00007FF8C52C5000-memory.dmp

memory/2360-14-0x0000000000180000-0x000000000018A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3281386.exe

MD5 1ff19e67a2ae75ad45eebf9693ec503d
SHA1 3f3da59265845f64d1f29c92706acf35fb4ab1b5
SHA256 d0ecd3340d3c57da9d342be0aef3027e74adbb8834be7d05c28942eda33f8708
SHA512 9810192a9a0b4410edb1726150f94fdb9091889b656a79cdbe8bb78d2b041c0a173c8f36baa7e52b1d0bb4731fe3a749bc84b3b671a425a0f905a3707f0e9571

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c8559996.exe

MD5 499339c2340f225b81aa84b57a06c69f
SHA1 602c6e3a1ca624caa1ec4cc92dfd62ebde523033
SHA256 31c962983a5dcb34c366ea726a6e4defcf6db78d259516edcc1b6336a297bbba
SHA512 a60cedbdb39bec49434526a46369199fa6e41cec24c30764821818e1335fc107123430c61190a265747118e54de289691912c1fa89fc89a79e350813e419838e

memory/5660-33-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5660-34-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe"

Signatures

Lumma Stealer

stealer lumma

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4308 set thread context of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4308 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4308 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe

"C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4308 -ip 4308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 348

Network

Country Destination Domain Proto
US 8.8.8.8:53 plasterdaughejsijuk.shop udp
US 188.114.96.2:443 plasterdaughejsijuk.shop tcp
US 8.8.8.8:53 productivelookewr.shop udp
US 104.21.11.250:443 productivelookewr.shop tcp
US 8.8.8.8:53 tolerateilusidjukl.shop udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 250.11.21.104.in-addr.arpa udp
US 172.67.147.41:443 tolerateilusidjukl.shop tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 shatterbreathepsw.shop udp
US 104.21.95.19:443 shatterbreathepsw.shop tcp
US 8.8.8.8:53 shortsvelventysjo.shop udp
US 172.67.216.69:443 shortsvelventysjo.shop tcp
US 8.8.8.8:53 incredibleextedwj.shop udp
US 104.21.86.106:443 incredibleextedwj.shop tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 41.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 19.95.21.104.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 69.216.67.172.in-addr.arpa udp
US 8.8.8.8:53 alcojoldwograpciw.shop udp
US 104.21.48.243:443 alcojoldwograpciw.shop tcp
BE 88.221.83.211:443 www.bing.com tcp
US 8.8.8.8:53 liabilitynighstjsko.shop udp
US 104.21.44.3:443 liabilitynighstjsko.shop tcp
US 8.8.8.8:53 demonstationfukewko.shop udp
US 172.67.147.169:443 demonstationfukewko.shop tcp
US 8.8.8.8:53 106.86.21.104.in-addr.arpa udp
US 8.8.8.8:53 243.48.21.104.in-addr.arpa udp
US 8.8.8.8:53 3.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 211.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 169.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp

Files

memory/4308-0-0x00000000002C4000-0x00000000002C6000-memory.dmp

memory/3320-1-0x0000000000400000-0x000000000044E000-memory.dmp

memory/3320-3-0x0000000000400000-0x000000000044E000-memory.dmp

memory/3320-4-0x0000000000400000-0x000000000044E000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240226-en

Max time kernel

156s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4596 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe
PID 4596 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe
PID 4596 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe
PID 2708 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe
PID 2708 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe
PID 2708 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe
PID 2420 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe
PID 2420 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe
PID 2420 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe
PID 4848 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe
PID 4848 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe
PID 4848 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe
PID 4848 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe
PID 4848 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe
PID 3684 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3684 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3684 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2420 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe
PID 2420 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe
PID 2420 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe
PID 2692 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2692 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2692 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2692 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 4236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 4236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 4236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 4792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 4792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 4792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 3880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 3880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2576 wrote to memory of 3880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2708 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5091095.exe
PID 2708 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5091095.exe
PID 2708 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5091095.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe

"C:\Users\Admin\AppData\Local\Temp\b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5091095.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5091095.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
GB 142.250.178.10:443 tcp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
FI 77.91.68.29:80 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
FI 77.91.68.29:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.124.156:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.156:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp
FI 77.91.124.156:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1769708.exe

MD5 7a2d3c4a82a09a3031f4ba34ace60c29
SHA1 a97778e12316ea6554509a2200499acac34cfbbb
SHA256 abde4ab5556453d1f8f112395377eaff87c54b72538ebde8bbeb4bc0b7a69643
SHA512 50e3fef3cb681e269699cf81d4fe965bf01eefee37bd8d7ec17a899cbd901402c7a1794428275d84b0f126f847990626e5bbab548b2927d13e37f283abe6126e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4782366.exe

MD5 f58247eeab098420f0857249f1e0de7f
SHA1 838acb6b4b150c188445b7633052f1f02f253f9d
SHA256 84524e515655961d6aadd8b4173620b3245cd58d564b626b301326593acc0845
SHA512 1413d573006ca4993d4ef208ebdd5c694579fccfe266347eead146bd14a0193229c6f37da80c65561a00555ab8cbcc63755fa923da68a5f219b8820d5d408eca

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7478463.exe

MD5 b694261037fec3d2c30c15f1b3eda248
SHA1 1e3c35842413c2ec08f97e150956a18819d7acf1
SHA256 bdc64d77e90c043aaa78be6f2fad11aee100deb0001da671327d0ea5cda6e7fc
SHA512 8cdf12baf9cc54be2993f89fe8d0c3fa9aa097fdb212b12b074b6b13769aef67e7f5bc0591c316f81a7c89986f911ad86808d2bf2ea72460a1083a61d0bf7984

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4475769.exe

MD5 1cdbf941ccc9de4b1f14c24e1cfaff47
SHA1 f63e35492fa97f4b9728546932366314e79b624f
SHA256 28379a18f1fefd2841c051f8a3b6da73ef4d8bb2861d0f211ea83c21cad6a56e
SHA512 5078a541e90e2addda10dace672170769caf0b25190b4c11d82ae8c0f858d6c0b98e0017087a0d9e206777805c499bb903d858594754952602b9e2fa14e494c5

memory/1180-28-0x00000000008E0000-0x00000000008EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5727213.exe

MD5 87864bdd796fa4ac12de1d9bef05a67d
SHA1 d789bdf46f33cf4d91cec44045deff80c3eac473
SHA256 578289200cb71983c1b6ce725ac7feed77c69671ac929c37b6af407dfbfc6b7a
SHA512 40c6053ce764d5e2cd7a83af290ba53f06822fb785f02cefd489d584f76ae0d0d167754415d1e403b3903895f80b030746af8ccb83c3f8457c5d79782e8f02e7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2075048.exe

MD5 ef042fef96b5cb05413692409bdaf626
SHA1 62c2af43ebdf12cabaeadf5a248fd9a48dd776cd
SHA256 bff49c60ff35728524aa8e23017134eda8d3d07482d459f608e7ebe9131ec850
SHA512 4f89f0461bb7b505c2cc97ba428ce8e0342b4f76321ed5195974a46ea7880e682a8d36a751c1c970207edd9549ab8bef0eafe04a279d9ef7215559336d30e9ee

memory/3404-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3240-47-0x0000000002B00000-0x0000000002B16000-memory.dmp

memory/3404-50-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5091095.exe

MD5 028af37cd70bf53962253470737ee3af
SHA1 06e00855be95cb487667d40b10de22e5c12f91bd
SHA256 022b7a9e00824d70dd61582c52945dcc1361b7da607af6b9c96c33fe432dd951
SHA512 7dae9d88f2b7902fb9ecddbc5d3615baf26159a3778f3b1bae0824eb3e45880426e9c4650165c387ed752a7ce61a4c8e981303f0ea82874f63496ecbb59c406f

memory/3356-54-0x0000000000270000-0x00000000002A0000-memory.dmp

memory/3356-56-0x0000000002600000-0x0000000002606000-memory.dmp

memory/3356-57-0x000000000A6E0000-0x000000000ACF8000-memory.dmp

memory/3356-58-0x000000000A220000-0x000000000A32A000-memory.dmp

memory/3356-59-0x000000000A160000-0x000000000A172000-memory.dmp

memory/3356-60-0x000000000A1C0000-0x000000000A1FC000-memory.dmp

memory/3356-61-0x000000000A330000-0x000000000A37C000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

127s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4500 wrote to memory of 6084 N/A C:\Users\Admin\AppData\Local\Temp\67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe
PID 4500 wrote to memory of 6084 N/A C:\Users\Admin\AppData\Local\Temp\67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe
PID 4500 wrote to memory of 6084 N/A C:\Users\Admin\AppData\Local\Temp\67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe
PID 6084 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe
PID 6084 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe
PID 6084 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe
PID 3284 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe
PID 3284 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe
PID 3284 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe
PID 4800 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe
PID 4800 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe
PID 4800 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe
PID 5060 wrote to memory of 6040 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe
PID 5060 wrote to memory of 6040 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe
PID 5060 wrote to memory of 6040 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe
PID 5060 wrote to memory of 5604 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe
PID 5060 wrote to memory of 5604 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe
PID 4800 wrote to memory of 5296 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4075312.exe
PID 4800 wrote to memory of 5296 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4075312.exe
PID 4800 wrote to memory of 5296 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4075312.exe

Processes

C:\Users\Admin\AppData\Local\Temp\67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe

"C:\Users\Admin\AppData\Local\Temp\67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4075312.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4075312.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.235:443 www.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 235.83.221.88.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe

MD5 2c2992bee297eb92a1c30c47f171520d
SHA1 1aa27a41eb69ed9a6ab90e36fcfb302fd0fd89af
SHA256 1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396
SHA512 efb5cd6594ce8dbc6635cc04210e5e362f0a3ae2c65d5bc161ec903cd96cd58ffaee72fef87fd72fd71e67e09cb7ee0255e82d9944940d6cdb96277f4eacbbb7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe

MD5 e4759911e541d7a543ea033b0928ddf4
SHA1 e39c427a6cf47b16cddabfd2c7fb00038e1dbe1f
SHA256 f8dfa98c4e38deff7955c243f9db7b01692e43c0997eca9e5e141cc565cf05be
SHA512 7760d634d8a8b0a2e2c9847c4c367589607de2d7ac43112830289dbf3585902dd0f824ebfcab04040f701afa6b86884824aed2f032e6c09714ac8575b7bf9e42

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe

MD5 f4f787db36502a2e05f39da6a313e914
SHA1 4f842c75ce854d86420f9790c47c81bdcecd7c5d
SHA256 3df74027fece0dd6e6c9f46260e3c886ecbcfd4dce43ac64a90f1211d78fe588
SHA512 0728509f9668750a075e73175e48f90625f5e62ef3d1e95641d654d43f749dacb1012110c6e445aa64308a64b0d23c447041ab0ec994300a6b06a1091523d52b

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe

MD5 a11dbc01603450452854f17aa7ea1eef
SHA1 18436f7c4a7a4477c0baa93ddc108babce9491bf
SHA256 2d2e176ff101b33e0adec2558415b76c1425ba9502c4b652c64b4751dd11181c
SHA512 1ac3b35ac7b8742c8eded217595f30ae25eff216409bddd3cc18809ff6e5d873c7feae6e1e3501dc02bebe2205f9f9e8db9718c76315b679ca8ce73aca2135bf

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe

MD5 175e3db636d9fd541cc11991815ea662
SHA1 c5e30c78f298c1aa26768bc036795e19ed7e60d7
SHA256 c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e
SHA512 06b1bc8a9746e8dfd1a4d72e98b8b76a1f543ae0c72c9e0233dce81451d7521f586da373e69459170a8d9442da4883f8247cfb9714227744c765c892583ac5c9

memory/6040-35-0x0000000000560000-0x000000000059E000-memory.dmp

memory/6040-41-0x0000000000560000-0x000000000059E000-memory.dmp

memory/6040-42-0x00000000023A0000-0x00000000023A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe

MD5 06d9b8f9236b959006976da775fea5e7
SHA1 46d5c5e6a3e7de6138cd764509a6754ce24d9484
SHA256 77353ead4144432dfd0e8fc833c458c8b88fb5d6bf7c9818ac430be40983b7f5
SHA512 ec0c6135f2b39d70cb35bd713d5fd9a0876055b46584f3535067f0f162be149024770c990e61ee041eabe5d3daf53aac49e747bb96189c3fa17346774a5edc6d

memory/5604-48-0x0000000000A70000-0x0000000000A7A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4075312.exe

MD5 dd10174f7fa3d017558c8310bf07d851
SHA1 08d795a3d2334906da989e46a7e57d4ba9aa9f41
SHA256 cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604
SHA512 a714e8babdc8d8a0a9f8e6ef6430d4f1cde70d3d80a902a1e247eb93bdf76e91fa89c4132708e0c632469b725c625ae65e30a908f02018f10b23460a02ec9d05

memory/5296-53-0x0000000002010000-0x000000000209C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/5296-60-0x0000000002010000-0x000000000209C000-memory.dmp

memory/5296-62-0x00000000043B0000-0x00000000043B6000-memory.dmp

memory/5296-63-0x0000000005E20000-0x0000000006438000-memory.dmp

memory/5296-64-0x0000000004A80000-0x0000000004B8A000-memory.dmp

memory/5296-65-0x0000000006460000-0x0000000006472000-memory.dmp

memory/5296-66-0x0000000006480000-0x00000000064BC000-memory.dmp

memory/5296-67-0x00000000064F0000-0x000000000653C000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win7-20240221-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe

"C:\Users\Admin\AppData\Local\Temp\db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe"

Network

Country Destination Domain Proto
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp

Files

memory/1432-4-0x0000000000401000-0x0000000000402000-memory.dmp

memory/1432-0-0x0000000000220000-0x0000000000250000-memory.dmp

memory/1432-5-0x0000000000400000-0x0000000000446000-memory.dmp

memory/1432-6-0x00000000004E0000-0x00000000004E6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5068 set thread context of 3260 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5068 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5068 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe

"C:\Users\Admin\AppData\Local\Temp\1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 104.20.3.235:443 pastebin.com tcp
BE 88.221.83.225:443 www.bing.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 225.83.221.88.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
BE 88.221.83.225:443 www.bing.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 tcp
US 104.20.3.235:443 tcp
US 104.20.3.235:443 tcp

Files

memory/5068-0-0x0000000000509000-0x000000000050A000-memory.dmp

memory/3260-1-0x0000000000400000-0x0000000000422000-memory.dmp

memory/3260-2-0x000000007468E000-0x000000007468F000-memory.dmp

memory/3260-3-0x0000000005040000-0x00000000050A6000-memory.dmp

memory/3260-4-0x0000000005B90000-0x00000000061A8000-memory.dmp

memory/3260-5-0x0000000005610000-0x0000000005622000-memory.dmp

memory/3260-6-0x0000000005740000-0x000000000584A000-memory.dmp

memory/3260-7-0x0000000074680000-0x0000000074E30000-memory.dmp

memory/3260-8-0x000000007468E000-0x000000007468F000-memory.dmp

memory/3260-9-0x0000000074680000-0x0000000074E30000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1880 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe
PID 1880 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe
PID 1880 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe
PID 876 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe
PID 876 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe
PID 876 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe
PID 876 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe
PID 876 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe
PID 4232 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4232 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4232 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0213700.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0213700.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0213700.exe
PID 4940 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 4940 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 4940 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 4940 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4940 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4940 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 3576 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3576 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3576 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3576 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3576 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3576 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3576 wrote to memory of 4468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 4468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 4468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3576 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe

"C:\Users\Admin\AppData\Local\Temp\1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0213700.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0213700.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
BE 88.221.83.217:443 www.bing.com tcp
US 8.8.8.8:53 217.83.221.88.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 152.141.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3352497.exe

MD5 859530ca071eca4d755d51e586e8e887
SHA1 de62d33ce5bdbcaee3969c0b7f5923be57f65b18
SHA256 51fe2b44092632d15df632de06f77403d4ed876e788b6b513102a552a4fd7532
SHA512 acd81f2a81bdf865b7ae581034c813d41e694cd942ceca7c5ce801d427c5163803da91d0d06e6eeef5b7906af6dcd075aa869eb5901c96fb162a9031cb0621c1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9107253.exe

MD5 9df47b120c7025ec8ffdc3338bf3371a
SHA1 18c9a5590d838f935ea38598118558686094db80
SHA256 cc881b7786c962ef44b2394705f24fbf1f7964505b2d3322a522a62d838ff829
SHA512 a70ea602160af906fa5958b9d01ee0ddd93bda62c8f5c1ec2632471561df5290ecd8f428f0b3c87bb2fa8a5546bd9e2e5200faa708d62a3ee36df69390227dc4

memory/3432-14-0x0000000000860000-0x000000000086A000-memory.dmp

memory/3432-15-0x00007FF8495B3000-0x00007FF8495B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5880657.exe

MD5 a748d210956507aaeb3aa55c796c4493
SHA1 6536facee8829b5d0cab1bcb31c9bb528812c0eb
SHA256 970a4c051a4e15f2fb1aef52a2916e417719475bf3bf076194c3978ca526ac83
SHA512 e117d4e660e74fafee8aab8cc412969b6f27287ce9efd787a72aa40d4128853b46e5a04e5217f1d72cbd5b69ac5570d49c823134776aa9f9cb297b71061aed25

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t0213700.exe

MD5 b8c5d95c1f7a38803ce7e06a3163b115
SHA1 8f5850e40c86222637fdf8fe190880eb203bd546
SHA256 dca8ac02fa9e6017548cee8be5c5073643fb1096ed887ac87301018c8f663f61
SHA512 2d55b6393a16147be65d6f5dd8b35bbea1b06b6aafd32256a2accb59877156de41dec5d48f8d05a22abb2853f32ac79932fc43cca7d38a83e89e2f14c55b823c

memory/1372-33-0x0000000000C80000-0x0000000000CB0000-memory.dmp

memory/1372-34-0x0000000003050000-0x0000000003056000-memory.dmp

memory/1372-35-0x0000000005DF0000-0x0000000006408000-memory.dmp

memory/1372-36-0x00000000058E0000-0x00000000059EA000-memory.dmp

memory/1372-37-0x0000000005740000-0x0000000005752000-memory.dmp

memory/1372-38-0x00000000057D0000-0x000000000580C000-memory.dmp

memory/1372-39-0x0000000005810000-0x000000000585C000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240426-en

Max time kernel

143s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2984 set thread context of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2984 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2984 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2984 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2984 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2984 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2984 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2984 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2984 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe

"C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2984 -ip 2984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 320

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 omnomnom.top udp
DE 195.201.252.28:443 omnomnom.top tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.106:443 www.bing.com tcp
US 8.8.8.8:53 28.252.201.195.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 106.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
BE 2.17.107.106:443 www.bing.com tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/2984-0-0x0000000000196000-0x0000000000197000-memory.dmp

memory/4876-1-0x0000000000400000-0x0000000000422000-memory.dmp

memory/4876-2-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

memory/4876-3-0x00000000057A0000-0x0000000005806000-memory.dmp

memory/4876-4-0x00000000062E0000-0x00000000068F8000-memory.dmp

memory/4876-5-0x0000000005D20000-0x0000000005D32000-memory.dmp

memory/4876-6-0x0000000005E50000-0x0000000005F5A000-memory.dmp

memory/4876-7-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/4876-8-0x0000000006B40000-0x0000000006B7C000-memory.dmp

memory/4876-9-0x0000000006B80000-0x0000000006BCC000-memory.dmp

memory/4876-10-0x0000000006E90000-0x0000000007052000-memory.dmp

memory/4876-11-0x0000000007590000-0x0000000007ABC000-memory.dmp

memory/4876-12-0x0000000008070000-0x0000000008614000-memory.dmp

memory/4876-13-0x0000000007060000-0x00000000070F2000-memory.dmp

memory/4876-14-0x0000000007100000-0x0000000007176000-memory.dmp

memory/4876-15-0x0000000006E60000-0x0000000006E7E000-memory.dmp

memory/4876-16-0x00000000074A0000-0x00000000074F0000-memory.dmp

memory/4876-18-0x0000000074DB0000-0x0000000075560000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3932 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe
PID 3932 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe
PID 3932 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe
PID 5004 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe
PID 5004 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe
PID 5004 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe
PID 5004 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe
PID 5004 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe
PID 4688 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4688 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4688 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3932 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1840542.exe
PID 3932 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1840542.exe
PID 3932 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1840542.exe
PID 2308 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2308 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2308 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2308 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2984 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2984 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2984 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2984 wrote to memory of 3344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 3344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 3344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 4812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 4812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 4812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2984 wrote to memory of 372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2984 wrote to memory of 372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2984 wrote to memory of 1240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 1240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 1240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2984 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe

"C:\Users\Admin\AppData\Local\Temp\40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1840542.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1840542.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.249:443 www.bing.com tcp
BE 88.221.83.249:443 www.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 249.83.221.88.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2880669.exe

MD5 c8cfe696d6173274c79a660a29b9be95
SHA1 bee86e989f103573235d0b39db635ea2c301a03a
SHA256 22039df1bc738e444cfc8735d37274a7139694ea18bb2ff6fa24cacc2ccf442b
SHA512 2a15cb710410fd58b94a61de6dd99f0e43062744eff4a0658832b8f077969d465e08c98e78a9a42f1de3dbc04c4ee3e9acab47bc374b5caf98f15f13e0ac113d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3576899.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2988-15-0x00007FFF773E3000-0x00007FFF773E5000-memory.dmp

memory/2988-14-0x0000000000CD0000-0x0000000000CDA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6102624.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1840542.exe

MD5 95ca51b76440641c3e7e663c9663e967
SHA1 b7ebaaf375e975f52fc18154fd6c978fb4960925
SHA256 17904d2a50e82f1730de9e8298862b552db96df383c6f5ae272de26f929c9594
SHA512 35ea16a2f61d29405393ae64bbed480abcf0d11d5e1cd49e5d7fb1a6f4d82b29faea7170ebf6dee553e2e811b9c4c36c1f505f3e7d394437dc3e9d500619d0eb

memory/2312-33-0x00000000005A0000-0x00000000005D0000-memory.dmp

memory/2312-34-0x0000000002AB0000-0x0000000002AB6000-memory.dmp

memory/2312-35-0x000000000AAC0000-0x000000000B0D8000-memory.dmp

memory/2312-36-0x000000000A5B0000-0x000000000A6BA000-memory.dmp

memory/2312-37-0x000000000A4A0000-0x000000000A4B2000-memory.dmp

memory/2312-38-0x000000000A500000-0x000000000A53C000-memory.dmp

memory/2312-39-0x0000000002870000-0x00000000028BC000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win7-20240419-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe

"C:\Users\Admin\AppData\Local\Temp\77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 116

Network

N/A

Files

memory/1704-0-0x0000000001454000-0x0000000001456000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4564 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe
PID 4564 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe
PID 4564 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe
PID 1240 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe
PID 1240 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe
PID 1240 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe
PID 2960 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe
PID 2960 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe
PID 2960 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe
PID 2960 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8276002.exe
PID 2960 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8276002.exe
PID 2960 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8276002.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe

"C:\Users\Admin\AppData\Local\Temp\ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8276002.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8276002.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.107.129:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 129.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe

MD5 e9c35fad007c9abb695cdf32a6ef8350
SHA1 d97cc8e389c68e9aff8d28d0691db3da4b56e93d
SHA256 a7e240048e51d605d4c92f47e4dae2c31558849be479794c2ee0761e240ef03d
SHA512 c6e80f476737b9d56d884438fe2045c3b42ce5e2ebc0833ec786f4c75df10934c67e0b194b79174e6588de14de2d651da5b788553ac3e7a619f3effc110c0ef7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe

MD5 eac44c7b9549f1b58cf25c60ee304435
SHA1 bf66fe6604311066fd2d8de1743af49c8f902edf
SHA256 7adab0943d097033395ba73d8760b3f523fd636a0bb13c8ac0dd37f0a63be91d
SHA512 c32120a4fbeb8b9bff77a9d5fb8f324752524fb8edd87387a28780c0e6eb0affad63a26860f682abac7835ddbcee4cdb9b67f2ecb3a22bdc57802509b5af5ade

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe

MD5 82c2b3a4497da45e69dce662504c47f7
SHA1 068c99cc9b40709f9967d393edd5a9e56b269015
SHA256 cc13fa7cc073a8810513c3fc4bea322132f6c659785cc68a6d11368fe4b11e7d
SHA512 b99991a938c78a90830c08285e98a552c5e0f7eb7717c1a2d4f89f4553bc452944b8b0bf91ad3b930fd9b2c21422fad73b975779c8a7e7a6932b6100fc13e55b

memory/1296-21-0x00000000004A0000-0x00000000004DE000-memory.dmp

memory/1296-27-0x0000000000401000-0x0000000000404000-memory.dmp

memory/1296-28-0x00000000004A0000-0x00000000004DE000-memory.dmp

memory/1296-29-0x0000000004450000-0x0000000004451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8276002.exe

MD5 6d30780150b36e2b9c70bcf294a2fba7
SHA1 60555be1736e34f14a4fb14aa8f1196d982dd29f
SHA256 fcf9145080af193ac72b17a81c9a76688e37ebd172c6b47e39a4ecd1aedd17fd
SHA512 2dc7a5f53794b4c548861f10fad1f0d79e7485cb2bb4de388f3109f8b82d22d1b87456d2e4f9d19d356180fc8cbebb74d3cd696059bd0c1c60284e45895cc58c

memory/1788-35-0x00000000005B0000-0x000000000063C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/1788-42-0x00000000005B0000-0x000000000063C000-memory.dmp

memory/1788-44-0x00000000043D0000-0x00000000043D6000-memory.dmp

memory/1788-45-0x0000000004B20000-0x0000000005138000-memory.dmp

memory/1788-46-0x00000000052E0000-0x00000000053EA000-memory.dmp

memory/1788-47-0x00000000051F0000-0x0000000005202000-memory.dmp

memory/1788-48-0x0000000005210000-0x000000000524C000-memory.dmp

memory/1788-49-0x0000000005280000-0x00000000052CC000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5161115.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5161115.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5161115.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2724 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe
PID 2724 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe
PID 2724 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe
PID 2880 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe
PID 2880 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe
PID 2880 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe
PID 2880 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe
PID 2880 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe
PID 4932 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4932 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4932 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2724 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5161115.exe
PID 2724 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5161115.exe
PID 2724 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5161115.exe
PID 904 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 904 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 904 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 4124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 4124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 4124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 4780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 4780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1380 wrote to memory of 4780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe

"C:\Users\Admin\AppData\Local\Temp\d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5161115.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5161115.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.129:443 www.bing.com tcp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 129.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1616978.exe

MD5 3e7d88e75923b3a43c0dc45edbd01687
SHA1 7e2a6719ee8a4518c9586e07d2861cfc1281beb0
SHA256 b9c7a7b367eac344e59e867953a12db0ef2bffa4f94334a89d46d1a9269669c7
SHA512 ba53f9d6954573dc7342944c24a475220eb11da0061abf2ca63ac2fd7727a7e1b02f52d59172ae1a0b96c8c8bc7cee14ad0c1b5e836212b056e8da2dfd48c6e9

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6376919.exe

MD5 4270b56d1cba3f64652be5749da3e078
SHA1 c416d45406184faacc5151b4ea58d5caafa1014d
SHA256 d2d155ac521e832b52466eeb0a22b34dec223edcd15b8ce1f9dbb9543ac2709e
SHA512 606411a690a5bbcf483173f601335211bda18081b71158aab6ab2bf7d2e9fd3640fe4299c2ff4b2abc6405f3a84f43167a8531b6cfe075466846f209a20b4a8d

memory/4684-14-0x0000000000750000-0x000000000075A000-memory.dmp

memory/4684-15-0x00007FF9176A3000-0x00007FF9176A5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7062692.exe

MD5 42df4bc7fa8cfaebce73b13076cf8b25
SHA1 5db3580f7a851e328410833e934f41870c102b1e
SHA256 aead07fe023fc99f873faa9ecdfb165bc0b1a7ad795aa9c05294aa2a41609443
SHA512 4524ae72bd1c620da0bb90c0e83480cf933dc3f511908e0eed8cfbfbe9d8eab0bec540ec887417329195f65fbb74a6d0ccf5dc836d1c080b4596f421e12fa2b2

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5161115.exe

MD5 e94edffe362eed8baeaa80020f5548ad
SHA1 776cab8f4b6833f83ca82ba582677795ed881751
SHA256 5ba23cfcd045ec7a30c6b1c3c7e05ad6dd764e6feb4e23293982867c3b873b21
SHA512 4afb388548f3508294589b99953c8ef6b15dacd8bfac1ceaff0a601817cb3d75378c456f73c3a0a7bd60cbe8abf647ec8b5ccd5d29644ebb7dd1e48a06fe95d0

memory/4244-33-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2128 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
PID 2128 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
PID 2128 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe
PID 4332 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
PID 4332 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
PID 4332 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe
PID 216 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe
PID 216 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe
PID 216 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
PID 216 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
PID 216 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe
PID 1824 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1824 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1824 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4332 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe
PID 4332 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe
PID 4332 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe
PID 3576 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3576 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3576 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3576 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3576 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3576 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 5084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 5084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 5084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 3196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 3196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 3196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 3684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 3684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 3684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 3680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 3680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4472 wrote to memory of 3680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2128 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe
PID 2128 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe
PID 2128 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe

"C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe

MD5 88bee46f431c014c1e45417f6b13e124
SHA1 07588e0723944e251a6a2d9db4ed8e45d5f563f1
SHA256 f4dfc88066f344cec64c3c5076b4e1e051af9f333c455aa2f96daacc1d732999
SHA512 5a0c53df34632e2d21c12e572460d54bfe7de21035d44bc36764ed3c6410d661ee50c758366cc8b86c2447b54efab7c41479fb04468afee6b70b9cbbaf55e79e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe

MD5 8f620f99bbeba489fc4bddc2af02f9b8
SHA1 2e97752a24581dd229306cfad5763cf82f9c4f96
SHA256 26a1717813eedfd0569c474064d1e14eeba61b97bb26866c53a19428a448a3f5
SHA512 b5065ed02a3bdcb68461265bb56f9173a7f9a1c75d12cf1ae53c43224cf2aada5586a4ee122779d7c83b8e8130cc6a980080cd03c2cc751ce19ac5ea3b2caa03

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe

MD5 12803f40ef0b813626de6e5eb0ec05b2
SHA1 27e32adac36ba9f4d54ecbf53e112158d4e988b5
SHA256 d320fcef46ae85d5f06133a3b8d4f5a7d2dff0886a86d981f3186f464fbb7abb
SHA512 84d7c28b03fdceb94e00fbcc838f203f6cd9e091b67b7ea8dad577a529a0d96eecf3b246a8548c9b7bef1e063aa96525f6b2148b5d0bb79b32a3415e9f151e0a

memory/3040-21-0x00007FFD84CC3000-0x00007FFD84CC5000-memory.dmp

memory/3040-22-0x0000000000880000-0x000000000088A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe

MD5 2b7ed1055ddd27afe675dd11da92357a
SHA1 3809cb22cbdda5ba5707892163217563020df5ca
SHA256 9d69e620d8bb7cb24c7d4831312351d09872badc8331594ce05afe46ff56ab3d
SHA512 549602e7e10ae1b006fafe9d6c1c09d35280a3af8815157dfa9b7664f16bf1682cc782585a24202dd150955073b5e648f0ad8a39add3f95ceeb51a5eb26fc641

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe

MD5 88331cf94b56745070654ca04d4c7d98
SHA1 248ac76afce09c34082bad3fbd01ce73e4056f65
SHA256 32e850a828611bdf20e34f0ac6c397507ff4b140c2b13732b5bf389249693334
SHA512 a3173aaeb138cb46f951d1e6b103a424c91ee05b416cdc9080e3ac5ba6db33dd0431d1ba0b8228b379f6ea6631b5c6622a4875459ce1105a0b959722e7717f96

memory/2188-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe

MD5 35c0945f8c70c870c070eb2261d6bc04
SHA1 bfc1ffae759330be5a50c22829fb342bfc644aab
SHA256 e296c73bc0d4abe0e58a2200d0c1839c210debd4deb8b26aa83abc5a2f0aaa1d
SHA512 8c9e5e646dfcd6b592d516524128d34af326c55a153d77d240ddbe6f418f01be473231e78a1707d72b0fbe3ad367085fc76ff329d8d80515ac07288b5eda73b7

memory/4928-45-0x0000000000440000-0x0000000000470000-memory.dmp

memory/4928-46-0x0000000004C20000-0x0000000004C26000-memory.dmp

memory/4928-47-0x000000000A730000-0x000000000AD48000-memory.dmp

memory/4928-48-0x000000000A2B0000-0x000000000A3BA000-memory.dmp

memory/4928-49-0x000000000A1F0000-0x000000000A202000-memory.dmp

memory/4928-50-0x000000000A250000-0x000000000A28C000-memory.dmp

memory/4928-51-0x0000000002700000-0x000000000274C000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 228 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
PID 228 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
PID 228 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe
PID 3284 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
PID 3284 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
PID 3284 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe
PID 676 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe
PID 676 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe
PID 676 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
PID 676 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
PID 676 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe
PID 4112 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4112 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4112 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2460 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3284 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
PID 2460 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3284 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
PID 2460 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3284 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe
PID 2460 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3080 wrote to memory of 3376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3080 wrote to memory of 3376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3080 wrote to memory of 3376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3080 wrote to memory of 4876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 4876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 4876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3080 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3080 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3080 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 4928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 4928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3080 wrote to memory of 4928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe
PID 228 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe
PID 228 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe

"C:\Users\Admin\AppData\Local\Temp\1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.29:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.29:80 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.169.217.172.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.56:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5770759.exe

MD5 e5fee7b57e9630eb6cbe1861cb6d1a82
SHA1 de69d6c77a4db78be5c7239199528da46bd4a9b9
SHA256 e7da30afc9870af8478dffe8cb7c3517dbcd725d83d3c9e7435cc5bcfaa1a76d
SHA512 c7af1fd9383094548929920e18b2adeb6d07fded702fc748f557d913ad8521c666e419aee611d994ec94154830967e39d797a98ba0cd18ab10548ce85f6a02ba

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1936485.exe

MD5 b3f0cfa1b2d4fab75074fe1a7b426ebb
SHA1 61d950a5d649826b8b646453df4398cdd56189b9
SHA256 0bd882b9fd1549e5b281cbaa19a8a2a2952a03219737db0af5cadf4e817c0561
SHA512 0141c9f835859df5fa0d8a04d010482961a693bada72d57e60677ee84b79bc86e59b523b3a4f9168fb240a815d9f80fbba05cc0d5f5a7f7d0415d0eabef699d0

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7008015.exe

MD5 c9767fb557c8496da35f32149019f254
SHA1 dc206616148aad4e06dd3fb380d34b4ba15a9c6d
SHA256 d039e2510d33b0cca9b9d06c2be8152c5e126660c7860649dd966e1a7b375e9c
SHA512 f9c225248b0a8f9766b936694f71b347a0f006110928d26717d886d6b78f1b9ea3b3518a3123004cb20c4d4ffa5eb394bd169641163b297046a967f1ac9c4445

memory/3020-21-0x00007FF9EA473000-0x00007FF9EA475000-memory.dmp

memory/3020-22-0x0000000000120000-0x000000000012A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7865879.exe

MD5 9728e9852854da025b4314bd0fd3687c
SHA1 6a87c09c8e29b6ca1c336416088f12cce0c206f8
SHA256 2c0f306d091f752e409e8bcbe20934ffa23430a90dea79c62aff27ee1b3035cf
SHA512 23df44bd9f5ae665f2d4c320603162b1d98b30b5610e99b5a9082843d76f0a6444e83e1c1792c2febf20d771b297777af8faa0403ba80f2f3f8b1c487abf7144

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5034781.exe

MD5 c4c414d786976435cb8561c43d8dc57d
SHA1 fd73133d3509d1a6982b000a75b9dbdc7769ec22
SHA256 129a6c5e5a8d98619b5be3818dfde6bab9c5345171d9d8401b886fed0660817a
SHA512 744106f95b8f57ea59e2906a7cbaf2e1a172cee013be12f0752b3308c428f92f9824a2497f3fced82d9124d3ab52448d3b240889fdad26925e710aa47f67b028

memory/3676-39-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3240-41-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/3676-44-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3489522.exe

MD5 fd61776b34b5a58e732533da17d122d0
SHA1 336015c059047a658ea57b6ebe49418d23a65593
SHA256 64faeec435f51816cff0efdacc9e777d677400fd7a59bc1e037a24ec7ae7cb4b
SHA512 afbd9465a721b8e447359c88451f9525ecc5f3aedf79be424b49d4a93d5921797854471257fb1f1ea7d967e56d54aec7b712773875f92fd4335e5a12afd4fc68

memory/1640-48-0x00000000005F0000-0x0000000000620000-memory.dmp

memory/1640-50-0x0000000000DB0000-0x0000000000DB6000-memory.dmp

memory/1640-51-0x000000000AA60000-0x000000000B078000-memory.dmp

memory/1640-52-0x000000000A5A0000-0x000000000A6AA000-memory.dmp

memory/1640-53-0x000000000A4E0000-0x000000000A4F2000-memory.dmp

memory/1640-54-0x000000000A540000-0x000000000A57C000-memory.dmp

memory/1640-55-0x000000000A6B0000-0x000000000A6FC000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3608 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe
PID 3608 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe
PID 3608 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe
PID 1524 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe
PID 1524 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe
PID 1524 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe
PID 1232 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe
PID 1232 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe
PID 1232 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe
PID 1232 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9973435.exe
PID 1232 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9973435.exe
PID 1232 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9973435.exe

Processes

C:\Users\Admin\AppData\Local\Temp\41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe

"C:\Users\Admin\AppData\Local\Temp\41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9973435.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9973435.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
BE 88.221.83.241:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 88.221.83.241:443 www.bing.com tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 95.16.208.104.in-addr.arpa udp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe

MD5 95e4a8f41bca6bb2d6a28fefff8a6f14
SHA1 5e8cc68b5720ee13aeb6419a1fa41bc09b99ec3d
SHA256 bb6484b52078d8b2107fd568f7d0c871021ac1c82ec70d295e602e8f50bcb7c8
SHA512 e390a6d632aad87666985827761e4c69ac39899845e1f6abb13cda37d1ec1fa8a4ffa0992d885e5415a372a4c5f7755d61ec5122aee4724d9161301041c8ea51

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe

MD5 ae7dcaf31955b10f6ecba5f649dd83e2
SHA1 38a7be9d4965aa1866db417951a2a5217f0ebe92
SHA256 b8e5590b23a408b05b4bfe00e5eb1c7b8b657f1e9ab6565c6a6d30147ab4f5cb
SHA512 d7d6aacde25996ddbd08df92f8e1306ea24abfeb290e985303e7009b889337c2aa2f1080cca2366627feb10de24c903b8cc5db35d2c181fb3837a308072c82bd

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe

MD5 dd329a91731d29291b0e49aac30b1ade
SHA1 2e11d485b3a6752b765f9ca9a230b9f611e96579
SHA256 6e283bcf7c2fcb9c137ccc493a52dfe1299bb1879c5bd53fed57d015b23724b8
SHA512 833ce95679282a3d51dc2d99ae7044ee9db27b0dde6741db74fdd8b8982da303d8ca58c733aff6397fb788067513040a7157227ff2749833bf18f40e7d36e2de

memory/3620-21-0x00000000005B0000-0x00000000005EE000-memory.dmp

memory/3620-27-0x0000000000401000-0x0000000000404000-memory.dmp

memory/3620-28-0x00000000005B0000-0x00000000005EE000-memory.dmp

memory/3620-29-0x0000000006A90000-0x0000000006A91000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9973435.exe

MD5 1e8e5d3012e149936d72e9d2d0ca74d7
SHA1 bef43c6355793a6a89d9904dd3ffef9515975d2f
SHA256 baed1016d2a42a5e79500e392455218b03840fcfc6b4117ac07cf7580a98b2dd
SHA512 93ae2c02a62d985386537943088f252beb26231d7567813695c9664f841a506877329a32b0cd7063327dc22f02348b2192b74760b325f64cb413ab4d9e34aa63

memory/3492-35-0x0000000001FF0000-0x000000000207C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/3492-42-0x0000000001FF0000-0x000000000207C000-memory.dmp

memory/3492-44-0x00000000023D0000-0x00000000023D6000-memory.dmp

memory/3492-45-0x00000000080A0000-0x00000000086B8000-memory.dmp

memory/3492-46-0x00000000086C0000-0x00000000087CA000-memory.dmp

memory/3492-47-0x00000000087F0000-0x0000000008802000-memory.dmp

memory/3492-48-0x0000000008810000-0x000000000884C000-memory.dmp

memory/3492-49-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3060 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe
PID 3060 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe
PID 3060 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe
PID 1504 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8967941.exe
PID 1504 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8967941.exe
PID 1504 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8967941.exe
PID 1504 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2279023.exe
PID 1504 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2279023.exe
PID 1504 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2279023.exe

Processes

C:\Users\Admin\AppData\Local\Temp\55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648.exe

"C:\Users\Admin\AppData\Local\Temp\55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8967941.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8967941.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2004 -ip 2004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 564

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2279023.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2279023.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4460,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
BE 88.221.83.201:443 www.bing.com tcp
BE 88.221.83.201:443 www.bing.com tcp
US 8.8.8.8:53 201.83.221.88.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 17.14.97.104.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1348556.exe

MD5 e7120a5ecda86ee9f60aed86cad3e00d
SHA1 9dd5ef64c93c0284610524423b42c5d3319c709c
SHA256 ff9c22d310c7e662a90528b3c48247f4a7ecb778e47e973c78b4e96b470050ce
SHA512 f4236179c94fa39b11af95555e1365849045d90c24d69c1d4e2f759c034212b91049b5395be2d11c2684cca70f2077ff60d87861aefcab7417e28dce04c3312a

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8967941.exe

MD5 42f76fcbbe29a053e5573deeb881b0be
SHA1 8d57734e21f05a2ed4fa29088d425ded2b17255f
SHA256 6c36cda2ca341875c08a67bf09a1f0a54351e1c3cf352a2d4be872714262c1e0
SHA512 c1acf03c05b9f8372f2a90264b868d82a7cc1b7e330b09490d256f951bab001e20ede613d84b2511e4ae88522d54c00a1e955099e3dac5c47c056adbff175225

memory/2004-14-0x0000000000401000-0x0000000000402000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2279023.exe

MD5 5a4c5cff7fad2fd06529fd8c510b115e
SHA1 13ae83ee05332bdc2f043dfd526c9ab756898b29
SHA256 cdea919a9bb1835bdfe1f9b9a72ee18c2c8e775c3001b0eefef4c416dc9863e9
SHA512 6a13957ea8688bb5b0549f131e056e5ac65372d3b542b7bfa86aa64679ea30d990a71c6751178e19d533b0ab2cd4c5f4c7645876514923f02088ad1b2041b166

memory/948-18-0x0000000000510000-0x0000000000540000-memory.dmp

memory/948-22-0x0000000000400000-0x000000000043A000-memory.dmp

memory/948-23-0x0000000002410000-0x0000000002416000-memory.dmp

memory/948-24-0x00000000050E0000-0x00000000056F8000-memory.dmp

memory/948-25-0x0000000004AC0000-0x0000000004BCA000-memory.dmp

memory/948-26-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/948-27-0x0000000004C20000-0x0000000004C5C000-memory.dmp

memory/948-28-0x0000000004CC0000-0x0000000004D0C000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4437139.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4437139.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4437139.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4496 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe
PID 4496 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe
PID 4496 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe
PID 4756 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe
PID 4756 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe
PID 4756 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe
PID 4756 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe
PID 4756 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe
PID 3808 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3808 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3808 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4496 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4437139.exe
PID 4496 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4437139.exe
PID 4496 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4437139.exe
PID 3112 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3112 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3112 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3112 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3112 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3112 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3996 wrote to memory of 5036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3996 wrote to memory of 5036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3996 wrote to memory of 5036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3996 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3996 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3996 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3996 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3996 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe

"C:\Users\Admin\AppData\Local\Temp\cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4216,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4437139.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4437139.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
BE 88.221.83.241:443 www.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
BE 88.221.83.241:443 www.bing.com tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.61:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8334746.exe

MD5 6272ed0ac9418facb951444fa58d7ad8
SHA1 6df1d87de7a5bc9d553082e96b570794abe0a07d
SHA256 f4ba14597a5790ac21e3b1ba4e331c02598261c024b1209dc02c0ec208f80227
SHA512 e67d928b291912c0a8a5402dd240b38d7b9a84d1d8cdee2f39c9358bc528d062d27dd95066720cee1793392fdc2b27f051a77c10dec12bc0664cccd3c9af9fa1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2281918.exe

MD5 30750e622ca049a1011e86a10bd77ee6
SHA1 23e2b1894d0197327257c90f1ccbf962d075241b
SHA256 12aceb308b19b16a287f051e037668318a71081df2ff364a489e0b3c81f307db
SHA512 ccea67e56b9ae2623aa840aca461d13a569e2c2ee47c98f8dacedb69ddb8377341d20b59bd9635f8f45a8b444857c8a646c59723db9061a5a7af44387550c815

memory/2920-15-0x00007FFF16003000-0x00007FFF16005000-memory.dmp

memory/2920-14-0x00000000009D0000-0x00000000009DA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0364715.exe

MD5 409567cc75a506738f67d83ea9d869d5
SHA1 f1e57c0d90e74d3e176c8db2ba04a9834bde1f38
SHA256 436ddab3efdb34eda8d48b0a7fb8c18df973fe7654c565da27cd0f5bd2651cc3
SHA512 0c3094f0155b35cec55549af51a4978f5e23b757882db9639a3a90d1afbf502233ccb5799f9bb8d13be8e040c5156e1b6bebcc8c3d0f2358f30a63763fb117b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4437139.exe

MD5 9c20ed3f55c14c873cd05f8502e42296
SHA1 9a3fef2eed238316b8849f79a3c0cb79d0f4e283
SHA256 d5be28a70403999daf238358ea7d167389471330dc4497c7eb621154929ae74d
SHA512 77e812652ad2a1008c11ac9b616383172ee0d2f70893050eb44307e9564fa2fc3ae2e2f6a7fffa20d2194a4531ced75ab369b6715cb12f374ad7dea728028cee

memory/888-33-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win7-20240221-en

Max time kernel

122s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe

"C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 116

Network

N/A

Files

memory/2124-0-0x0000000000929000-0x000000000092A000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe"

Signatures

Lumma Stealer

stealer lumma

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2912 set thread context of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2912 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2912 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe

"C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2912 -ip 2912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 352

Network

Country Destination Domain Proto
US 8.8.8.8:53 sideindexfollowragelrew.pw udp
US 8.8.8.8:53 productivelookewr.shop udp
US 172.67.150.207:443 productivelookewr.shop tcp
US 8.8.8.8:53 tolerateilusidjukl.shop udp
US 172.67.147.41:443 tolerateilusidjukl.shop tcp
US 8.8.8.8:53 207.150.67.172.in-addr.arpa udp
US 8.8.8.8:53 shatterbreathepsw.shop udp
US 104.21.95.19:443 shatterbreathepsw.shop tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 shortsvelventysjo.shop udp
US 104.21.16.225:443 shortsvelventysjo.shop tcp
US 8.8.8.8:53 incredibleextedwj.shop udp
US 8.8.8.8:53 41.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 19.95.21.104.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 225.16.21.104.in-addr.arpa udp
US 104.21.86.106:443 incredibleextedwj.shop tcp
BE 88.221.83.211:443 www.bing.com tcp
US 8.8.8.8:53 alcojoldwograpciw.shop udp
US 104.21.48.243:443 alcojoldwograpciw.shop tcp
US 8.8.8.8:53 liabilitynighstjsko.shop udp
US 188.114.97.2:443 liabilitynighstjsko.shop tcp
US 8.8.8.8:53 demonstationfukewko.shop udp
US 104.21.33.174:443 demonstationfukewko.shop tcp
US 8.8.8.8:53 106.86.21.104.in-addr.arpa udp
US 8.8.8.8:53 211.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 243.48.21.104.in-addr.arpa udp
US 8.8.8.8:53 2.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 174.33.21.104.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/2912-0-0x00000000004D9000-0x00000000004DA000-memory.dmp

memory/4552-1-0x0000000000400000-0x000000000044E000-memory.dmp

memory/4552-3-0x0000000000400000-0x000000000044E000-memory.dmp

memory/4552-4-0x0000000000400000-0x000000000044E000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4556430.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4556430.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4556430.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 232 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe
PID 232 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe
PID 232 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe
PID 724 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe
PID 724 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe
PID 724 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe
PID 2628 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe
PID 2628 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe
PID 2628 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe
PID 2628 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe
PID 2628 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe
PID 3200 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3200 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3200 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 724 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4556430.exe
PID 724 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4556430.exe
PID 724 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4556430.exe
PID 232 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1853109.exe
PID 232 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1853109.exe
PID 232 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1853109.exe
PID 4836 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4836 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4836 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4836 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4836 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4836 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 3372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 3372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 3372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 4660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 4660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 4660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe

"C:\Users\Admin\AppData\Local\Temp\b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4556430.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4556430.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1853109.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1853109.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
BE 88.221.83.217:443 www.bing.com tcp
US 8.8.8.8:53 217.83.221.88.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6653264.exe

MD5 e7fa26de9c820baea690459babf2fbe2
SHA1 2ef86403777796d2dc2751f4abb0b42e483a9a90
SHA256 630b3bd990cf3a7b799c0a8757ec0da95eb2bc811a803790cd5dd59b96a6ae12
SHA512 eaa136102af8ce5e1c93a08854c3ca6b768a546bde6b9ba123b0f7f23509155daebbcf221f299c1a44cac81a9690796d317baef311c7fd96c8403d1d6b1f441b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2222652.exe

MD5 ef013b3a532e703d4d2c2b5cd426bc90
SHA1 74f878cbd5dcd5ebdabf43c262f95ae0c1a697ae
SHA256 a264decd1d4218a6f799938cf789727b2fd2fc2a2f5d29abdbbb3a582213a875
SHA512 d92fc62a03d6ab3fd5b676c2c5eb6da3dad100a6d5753a364ab1196742b20b66f993c649ef7bf9b96b233935bc2a8698c1ae3af2cf86d6a133f44eb85dc69233

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7534464.exe

MD5 64fef4cf6fc7cd982c1e3967385b6dc8
SHA1 30f307ad0ff6a2bf5c90743f09fb2b53705e9660
SHA256 f7ce92d9f78ff144184570d99e5951f58f6f3b8bcab899f785cea40643e43243
SHA512 b4875804448ce8d04f4b4138cf4228f25986f6e84bd0523706a4283def46be864ba07584019afbb7e52cb0b2dc997de0288f7062962c11a8515d12f1c1f0119c

memory/4856-22-0x00007FFA4BAE3000-0x00007FFA4BAE5000-memory.dmp

memory/4856-21-0x0000000000A50000-0x0000000000A5A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3015164.exe

MD5 9ecc4e0e5e82fc7bc093b19a6f4de2eb
SHA1 1f6e4556dee5c075dfb06bbd4f9bbfbffc926347
SHA256 eb6991a258a7ae91ffb2d4d170508562eff82c059cf2c58e6500730183cc34bc
SHA512 9c93be0e7e18c7a5f27a68da43ca5a926c71b14468d8e66b3fff51458996f7ed9d3a9c0a9e12ef947ea130ad53787606afe50f307e0efdabda52755ed8323bd7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4556430.exe

MD5 99e4fbaf61eda1a131a0fb9d2db25f6e
SHA1 dfbba00b8a56e4405fa1911cf4d1f3466fcdf0e9
SHA256 51e82b55c6b0908e8c31d12c5d8160a29addde641ea77b11ab4e229d67d89df3
SHA512 bf0d17b89b745982ecd8c0773c63fa68e86e3893f3ee4829e50cf7ea647f54b236fb1c4a16811d2e91b5f2b32bd119968eb905e34bb59ba17badbe4c5a043ff5

memory/2320-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1853109.exe

MD5 257b3b2a8fd11a9c26682c5c34ff230f
SHA1 c19af2e2d29a96cbf73a54941f398a14c6ba8f14
SHA256 2a55756c92b3e9e68116c3617777d07720069a3e0fae13d59412a03f7f5f42c1
SHA512 35c8ff10783734d68ae3036845e28f2114f60623aeec5dda81f62adadcf26338fa53fbda810bfa94b1530f30cd44018ae608407de2951177357552d9bfdf4368

memory/2500-44-0x0000000000F60000-0x0000000000F90000-memory.dmp

memory/2500-45-0x00000000031B0000-0x00000000031B6000-memory.dmp

memory/2500-46-0x000000000B260000-0x000000000B878000-memory.dmp

memory/2500-47-0x000000000ADD0000-0x000000000AEDA000-memory.dmp

memory/2500-48-0x000000000AD10000-0x000000000AD22000-memory.dmp

memory/2500-49-0x000000000AD70000-0x000000000ADAC000-memory.dmp

memory/2500-50-0x0000000003110000-0x000000000315C000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win10v2004-20240426-en

Max time kernel

139s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe

"C:\Users\Admin\AppData\Local\Temp\db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
BE 2.17.107.128:443 www.bing.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 128.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp

Files

memory/2892-1-0x00000000001C0000-0x00000000001F0000-memory.dmp

memory/2892-4-0x0000000000401000-0x0000000000402000-memory.dmp

memory/2892-5-0x0000000000400000-0x0000000000446000-memory.dmp

memory/2892-6-0x0000000002550000-0x0000000002556000-memory.dmp

memory/2892-7-0x000000000A650000-0x000000000AC68000-memory.dmp

memory/2892-8-0x000000000A030000-0x000000000A13A000-memory.dmp

memory/2892-9-0x000000000A150000-0x000000000A162000-memory.dmp

memory/2892-10-0x000000000A170000-0x000000000A1AC000-memory.dmp

memory/2892-11-0x0000000002410000-0x000000000245C000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-09 14:47

Reported

2024-05-09 14:51

Platform

win7-20240221-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe

"C:\Users\Admin\AppData\Local\Temp\e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 116

Network

N/A

Files

memory/2124-0-0x0000000000186000-0x0000000000187000-memory.dmp