Malware Analysis Report

2024-10-16 03:49

Sample ID 240509-sbvaysaf32
Target r1.zip
SHA256 c6ac7038f2b8acf3787a19170444be1ee943b1eebbf70e6d74758b47c73c4ab8
Tags
amadey healer redline smokeloader papik backdoor dropper evasion infostealer persistence trojan krast lamp lumma stealer 581694481 discovery spyware nasa 5345987420 lande @winbinlow diza 5637482599
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c6ac7038f2b8acf3787a19170444be1ee943b1eebbf70e6d74758b47c73c4ab8

Threat Level: Known bad

The file r1.zip was found to be: Known bad.

Malicious Activity Summary

amadey healer redline smokeloader papik backdoor dropper evasion infostealer persistence trojan krast lamp lumma stealer 581694481 discovery spyware nasa 5345987420 lande @winbinlow diza 5637482599

Modifies Windows Defender Real-time Protection settings

Lumma Stealer

RedLine

Detects Healer an antivirus disabler dropper

Healer

SmokeLoader

Amadey

RedLine payload

Windows security modification

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 14:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9b8496e95efc2095012f46230bd3642a47e89c4a73886f41db8e991f7fa863b6.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\9b8496e95efc2095012f46230bd3642a47e89c4a73886f41db8e991f7fa863b6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1772445.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1772445.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1772445.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3776 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\9b8496e95efc2095012f46230bd3642a47e89c4a73886f41db8e991f7fa863b6.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe
PID 3776 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\9b8496e95efc2095012f46230bd3642a47e89c4a73886f41db8e991f7fa863b6.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe
PID 3776 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\9b8496e95efc2095012f46230bd3642a47e89c4a73886f41db8e991f7fa863b6.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe
PID 1656 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe
PID 1656 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe
PID 1656 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe
PID 2216 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe
PID 2216 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe
PID 2216 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe
PID 3384 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe
PID 3384 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe
PID 3384 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe
PID 3384 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe
PID 3384 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe
PID 520 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 520 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 520 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2216 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1772445.exe
PID 2216 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1772445.exe
PID 2216 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1772445.exe
PID 4616 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4616 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4616 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4616 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4616 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4616 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 4692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 4692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 4692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 1080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1656 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8044210.exe
PID 1656 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8044210.exe
PID 1656 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8044210.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9b8496e95efc2095012f46230bd3642a47e89c4a73886f41db8e991f7fa863b6.exe

"C:\Users\Admin\AppData\Local\Temp\9b8496e95efc2095012f46230bd3642a47e89c4a73886f41db8e991f7fa863b6.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1772445.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1772445.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8044210.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8044210.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.156:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.124.156:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
FI 77.91.124.156:19071 tcp
FI 77.91.124.156:19071 tcp
FI 77.91.124.156:19071 tcp
US 8.8.8.8:53 152.141.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1260714.exe

MD5 d984c7940a44442b4d7afef3d6d4cdd5
SHA1 02fdae91ecc6d3ca7f1da121f83cc4c9330621b8
SHA256 d017ca7090aec571bd82579297335df90deb786e8aa8c9088c059ae16ae91f39
SHA512 c17cfb1593b44c23903d07082d76b6eae003181fbdfca4efad7eb936722cf05a57a1bf89a53c33f9e163352bf4e63021d4585b95fc4ce5ccba3634b8dae6e560

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7132344.exe

MD5 d0e0410ebfcc689dcfd74e4e508630ab
SHA1 fb7045a0d745f8d950b13b54c5e7c1f4ee572dd6
SHA256 e2d21623f09acb64c323da82fddd57e388bf46651f6fa141d376fe2acb2726f9
SHA512 6428097f6be3892c13d4550cc3a93400b1943121af6b6eead0ebbf6386f9009f98fc25e1c980eeb71abdee88c69e7e7e1d49501e98c7cbc1654a0f555d37517e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8133846.exe

MD5 994077589a518d935d9b4b83b4b4ca05
SHA1 1c446d0f2aaf3c46300b3282b2cb2f4132a79c0c
SHA256 8dcc82896ed3a37542a796366bd950361879e72098b364390c8e27fdf9ca80de
SHA512 1e22dae31dcf510584ea32d51fe6d129ff7c4d1c37b5940ab015b5b5856f92a400d7084b99fdd8660b8d803ddc77c35cb2d6b5a7af8bfbf1645e7696e00db3ed

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3645881.exe

MD5 ce87cbd393d973256a56185477416a4e
SHA1 b2f7712f2ebfbffa2862d86c558333109d4562bf
SHA256 92c0ad9fb84548bd8208f4065cc48b47c529d96be6ad85e3218b0ff5c2248635
SHA512 4bd8303126049dfaf519d21abb2a8f0cdc3a0b61bd2baab8fa0ce1e195ee77b8f96b325f5a4691b0980bb9eab06ce2cfe5555dc73aa91191dd4afb1dd719ebf7

memory/336-28-0x0000000000250000-0x000000000025A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0846215.exe

MD5 cb5d69ad622e711be17006c66281963e
SHA1 c8df5db525b15549e229d652ab4d41cb44dad7cc
SHA256 c076393bdaff7f5cb99ce88aef93eaee2557074b26c419689a97839a32c92567
SHA512 153278c55f2896104ea25e26bba04af75a79753e3f7907f966aad6bfc777a4cac966392c1f18903e1942de333ee2ba07dc37cbdb3876e501d08d050033531b33

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c1772445.exe

MD5 d4db464e6915280ed9d872a81d728b08
SHA1 15f7cab6684baed991b091f28077429c20d70977
SHA256 2967d1a8e4c9c866429b94b5a2b1ee334830888c054331ef6b544f1db607a2ec
SHA512 fca513c7041624c4077cd73a9acfb88a6fccd58456637ad498a6cd1b79a681f1649aa2aee3ac110259f7db4e6e8e7201b6d93aaff261c1293d5a3abb1aecd2d7

memory/1548-46-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d8044210.exe

MD5 b236be17c4491fd64716901958bff6e9
SHA1 95d7c7aad08d154498e75f9878191e664d22839f
SHA256 64092d0df386d5c80e587bcac699fc5455a615af089b21e4faa8b0ec5fd00ea1
SHA512 e4da1dc4c5aa34f998aa6f0acf28a0774196cf687112569831d13bd45cbbd0f444f6d97243e050800c76320a1f26d60dc3e6eefa6728ed40ecd65772092d33ce

memory/4444-50-0x00000000005E0000-0x0000000000610000-memory.dmp

memory/4444-51-0x0000000002700000-0x0000000002706000-memory.dmp

memory/4444-52-0x000000000AA50000-0x000000000B068000-memory.dmp

memory/4444-53-0x000000000A590000-0x000000000A69A000-memory.dmp

memory/4444-54-0x000000000A4D0000-0x000000000A4E2000-memory.dmp

memory/4444-55-0x000000000A530000-0x000000000A56C000-memory.dmp

memory/4444-56-0x00000000048E0000-0x000000000492C000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5000538.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5000538.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5000538.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4840 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe
PID 4840 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe
PID 4840 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe
PID 2356 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe
PID 2356 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe
PID 2356 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe
PID 2476 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe
PID 2476 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe
PID 2476 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe
PID 3040 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe
PID 3040 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe
PID 3040 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe
PID 3040 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe
PID 3040 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe
PID 2476 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7857078.exe
PID 2476 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7857078.exe
PID 2476 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7857078.exe
PID 2356 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe
PID 2356 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe
PID 2356 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe
PID 3680 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3680 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3680 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4840 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5000538.exe
PID 4840 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5000538.exe
PID 4840 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5000538.exe
PID 2724 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2724 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2724 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2724 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4680 wrote to memory of 4928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 4928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 4928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4680 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe

"C:\Users\Admin\AppData\Local\Temp\2b559f1c510907c1a260b6482b36dce3ba603f08fd80d98ee793787a12104d29.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7857078.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7857078.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4300 -ip 4300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 148

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5000538.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5000538.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0068831.exe

MD5 b81ac533fd232a2f56893abde18d5ec7
SHA1 20498126ce49089a86fcf3c354aa78b2e1e06068
SHA256 d254a10f5de33418593597e66b1250e105e80481713e398c5eef16a3ffa0e495
SHA512 6f19e9f28db6abc792d3ac498ed75cf1eddcebbb933e53506a16412197afc2dc135dd9f291fa9f7e39198dc69b9e6446cbb54e21cd786357fcea54c165dcc430

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5550060.exe

MD5 3e687bae32fdb9c50e5e3934b5a6ca9c
SHA1 7e6d3cdc9246a9e21cab11b8a44a32c05bcb4f61
SHA256 23061041c2fd39ae3f3b91178ea7f8fca0b970101138b956ff5597f0ca25f95a
SHA512 6235acf467b1c85a2329a4fec19100efe3b9c4651a0668e8592cce7de78fc0f7a2abc40c50065bcf796c66e89b1428a4babdc0d45d593ef0f22b02835cbfc871

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2959317.exe

MD5 890589a430ca372533f594d5f6e5365e
SHA1 2682226e935ce560f22b1b7c63c650c00d94347e
SHA256 1505e178fd996dc966a092457fc4bdd23c9369d8dcb15734f0ac7451d1e5c90f
SHA512 66dc7b41cd8d030c9241064e6bac2f7def908b15ba6efae7bce504368832622020b1618f2a088064f323518111e6b61914dda53e8e44e3dc757b22af9abef6ea

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7493921.exe

MD5 b8ea0d90ffee22d62d55821ad4708489
SHA1 fd41d0739630a1ac13016ebb310011b34b16853d
SHA256 d1a8bf854ac371b6bbbdf4b43d2301f80b02c89cce9f9d0cce400fed1ef8d118
SHA512 afbb6f78a79b0e4a628e789ce4698268a0d7bbac0e38d9761538d156ae299e19611ec1778566317fab72d19231620089a4dc6ab34841aea7a8d97617adca1bef

memory/3412-28-0x0000000000500000-0x000000000050A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7560369.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4972-37-0x0000000000B00000-0x0000000000B0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7857078.exe

MD5 a4e6eae5b7a3efff9f0924e4a07039b1
SHA1 41b26a0054c1876183d42a5df4cd33fbda7f7979
SHA256 9f25017ed10528ca31216bc326bfa3e4c1ea0bcb9078399a4a1bc1d2c5536bb7
SHA512 315a55c670dc00824d1e78230786472977ef573ecd6c946eebbbc4c47ac7853262a6fcaa821e577fa2d473bd5733a3a2268ca091732a364c3e6491ad4b4a8bc6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d5025650.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5000538.exe

MD5 35a15fad3767597b01a20d75c3c6889a
SHA1 eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA256 90ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512 c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577

memory/1728-58-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win7-20240419-en

Max time kernel

120s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe

"C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 36

Network

N/A

Files

memory/992-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 388 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe
PID 388 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe
PID 388 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe
PID 1916 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe
PID 1916 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe
PID 1916 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe
PID 1916 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe
PID 1916 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe
PID 5048 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 5048 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 5048 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 388 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t3924005.exe
PID 388 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t3924005.exe
PID 388 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t3924005.exe
PID 884 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 884 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 884 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 884 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 884 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 884 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 4844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 4844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 4844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 2156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4476 wrote to memory of 3424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 3424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 3424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4476 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe

"C:\Users\Admin\AppData\Local\Temp\7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t3924005.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t3924005.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.193:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 193.83.221.88.in-addr.arpa udp
BE 88.221.83.193:443 www.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 52.111.227.11:443 tcp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5999342.exe

MD5 74cf4e828722915d39950a63ca6c80f8
SHA1 582a746b86eb777881930995aa4ec3ed0ad926cc
SHA256 4b59a06745d3c2f1faa403b4d156ae1020932cf66d7671f36c7e1638b359033f
SHA512 2afefd5b4287823ba81bf36e6554f11e1f84a6bdfa2fb0447999a6b12cb06a274822e6a4ae76f7afcf10f01e3939bbb9fab0b9c043cb7db410131583189b7ed6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4494081.exe

MD5 3427c2353c23b81398f6351b1b43b798
SHA1 7bbc11d829a06c646c022db871db482cfaca627d
SHA256 53f7cf122426d1324a9f8ad70b0067c04cfd1fe4a3027ab5bd04d2c35b9cd7f5
SHA512 3e1fa6af8d38c42aead93ed3d670a903023c5bbf7240073367365239abb3a9cf65d7b4b1e887f38f5e1614e15d2b0c24df186ce408a50d921ff8dea280044f2e

memory/1320-14-0x00007FFB34C93000-0x00007FFB34C95000-memory.dmp

memory/1320-15-0x00000000003C0000-0x00000000003CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0060218.exe

MD5 a5399195a7433f195453fe5574560fdc
SHA1 6faed26c43db672446054b2884778c897f367f7e
SHA256 80f6b671e1faa000f7c15b01a13a213e80dd4ed1db7f31cfce36ad82ea813abe
SHA512 42bc1e7adf121544f2cd17c60d5d08266fd60f36daa30dbc4b9ecbf06660c6d0d30074493b9c6b7baed482c4cdff755cedc6ebc3b790c16b3700b4fdfd13670c

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t3924005.exe

MD5 f5f9a88e2b0414bcb59289b488669256
SHA1 a6d9d953fada6c1a55924c13192c3acfc0aa5ebe
SHA256 18fd321b3cb6df408aba5135ef92144e32e95a103903dc2608f40a4c64162024
SHA512 81370ba57a2186edb4039fed39935b5011d5b85b8393a306a56bbb0beacf20420fcc8c5af8871c9f5a2e00209acaa1a658311b7294f5d81d645819b83c6523c7

memory/1204-33-0x0000000000710000-0x0000000000740000-memory.dmp

memory/1204-34-0x0000000000F10000-0x0000000000F16000-memory.dmp

memory/1204-35-0x0000000005670000-0x0000000005C88000-memory.dmp

memory/1204-36-0x0000000005160000-0x000000000526A000-memory.dmp

memory/1204-37-0x00000000050A0000-0x00000000050B2000-memory.dmp

memory/1204-38-0x0000000005100000-0x000000000513C000-memory.dmp

memory/1204-39-0x0000000005270000-0x00000000052BC000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d77888ac75d20228b7b7d9e6605425cfb9f51ecf0f39863b19981b1598b3a57b.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d77888ac75d20228b7b7d9e6605425cfb9f51ecf0f39863b19981b1598b3a57b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5080 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\d77888ac75d20228b7b7d9e6605425cfb9f51ecf0f39863b19981b1598b3a57b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe
PID 5080 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\d77888ac75d20228b7b7d9e6605425cfb9f51ecf0f39863b19981b1598b3a57b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe
PID 5080 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\d77888ac75d20228b7b7d9e6605425cfb9f51ecf0f39863b19981b1598b3a57b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe
PID 3924 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe
PID 3924 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe
PID 3924 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe
PID 4576 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe
PID 4576 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe
PID 4576 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe
PID 4576 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9832720.exe
PID 4576 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9832720.exe
PID 4576 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9832720.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d77888ac75d20228b7b7d9e6605425cfb9f51ecf0f39863b19981b1598b3a57b.exe

"C:\Users\Admin\AppData\Local\Temp\d77888ac75d20228b7b7d9e6605425cfb9f51ecf0f39863b19981b1598b3a57b.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9832720.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9832720.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 93.65.42.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4199648.exe

MD5 af6e9fb430a5cc56680227a7f94310aa
SHA1 a6c0e4ed159807678144a63f4ab9ea7d1bf22530
SHA256 b91e172be8a42cc58aa76b4b06e6f5f8ee11514cd52c61c61f6f200b982272d1
SHA512 e0f92b4418e5fb47fd4c52be2c2fd5fb2ecdceb4c06f43701e927aa7bfb4c1491be9a9b990e766017cb4575b00f9c6e3316e565b1ed3591266de0ea27821da0c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7832952.exe

MD5 70c2d38d4547cfdda21e5a0ecb834188
SHA1 97e074f5aa166a3bf5e7a91311c5b5d091c430c5
SHA256 d33bc366cf55b54588d2d5d038cd4124b36e834e9b61a65c7b1d4fca42d29287
SHA512 ccc1cab1b58925d29026dd78f06c2c2df8177fb5fc8b5d465d5b2a0601bbb546446722ecc69c04b29121dd8b40127ca51c919350e9b4953042a24d7bfc56b760

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7566094.exe

MD5 c43930fbf73244831a96682aba907e8c
SHA1 44db4ec9c11a04d56d2bfab7f993abf37a23e6fe
SHA256 9beeaf6651baa5e2597a933df6eee18cf168ba41865e18001185613e0949bba3
SHA512 6cb91d5c9317f693a04eec12cddef55760619ed65944df60986b009eb1c782833d121788d4352519e6391bed2a06f0f602b1f4a753623c7ac92dd0440dd307af

memory/2064-21-0x0000000000401000-0x0000000000404000-memory.dmp

memory/2064-23-0x0000000000570000-0x00000000005AE000-memory.dmp

memory/2064-28-0x0000000000570000-0x00000000005AE000-memory.dmp

memory/2064-29-0x00000000025A0000-0x00000000025A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9832720.exe

MD5 1bc0f3239045d44d169496f3b247f881
SHA1 1884266973607585ec1b134f6009c17e54f3b18f
SHA256 8d09dd356bd29f5d38121849999e828d955e116d03542444d0b4f40073596e7f
SHA512 dc3a2358d4d2613bb82c60362c409590a8699d53625efd9fd8b853f5e19afed07c798cf66b59d38bd526a80559bc4cc486b23b0f40f3fb120bd61a67946f87a9

memory/4460-35-0x0000000001F70000-0x0000000001FFC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4460-42-0x0000000001F70000-0x0000000001FFC000-memory.dmp

memory/4460-44-0x0000000004390000-0x0000000004396000-memory.dmp

memory/4460-45-0x0000000007330000-0x0000000007948000-memory.dmp

memory/4460-46-0x0000000006D10000-0x0000000006E1A000-memory.dmp

memory/4460-47-0x0000000006A90000-0x0000000006AA2000-memory.dmp

memory/4460-48-0x0000000006AB0000-0x0000000006AEC000-memory.dmp

memory/4460-49-0x0000000006B40000-0x0000000006B8C000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe"

Signatures

Lumma Stealer

stealer lumma

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4920 set thread context of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4920 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4920 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4920 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4920 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4920 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4920 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4920 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4920 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4920 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe

"C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4920 -ip 4920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 320

Network

Country Destination Domain Proto
US 8.8.8.8:53 sideindexfollowragelrew.pw udp
US 8.8.8.8:53 productivelookewr.shop udp
US 172.67.150.207:443 productivelookewr.shop tcp
US 8.8.8.8:53 tolerateilusidjukl.shop udp
US 172.67.147.41:443 tolerateilusidjukl.shop tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 shatterbreathepsw.shop udp
US 172.67.169.43:443 shatterbreathepsw.shop tcp
US 8.8.8.8:53 207.150.67.172.in-addr.arpa udp
US 8.8.8.8:53 41.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.226:443 www.bing.com tcp
US 8.8.8.8:53 shortsvelventysjo.shop udp
US 188.114.96.2:443 shortsvelventysjo.shop tcp
US 8.8.8.8:53 incredibleextedwj.shop udp
US 104.21.86.106:443 incredibleextedwj.shop tcp
BE 88.221.83.226:443 www.bing.com tcp
US 8.8.8.8:53 alcojoldwograpciw.shop udp
US 172.67.157.23:443 alcojoldwograpciw.shop tcp
US 8.8.8.8:53 43.169.67.172.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 226.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 106.86.21.104.in-addr.arpa udp
US 8.8.8.8:53 liabilitynighstjsko.shop udp
US 188.114.97.2:443 liabilitynighstjsko.shop tcp
US 8.8.8.8:53 demonstationfukewko.shop udp
US 104.21.33.174:443 demonstationfukewko.shop tcp
US 8.8.8.8:53 2.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 23.157.67.172.in-addr.arpa udp
US 8.8.8.8:53 174.33.21.104.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 35.166.122.92.in-addr.arpa udp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp

Files

memory/4920-0-0x0000000000DE4000-0x0000000000DE5000-memory.dmp

memory/4316-1-0x0000000000400000-0x000000000044D000-memory.dmp

memory/4316-3-0x0000000000400000-0x000000000044D000-memory.dmp

memory/4316-4-0x0000000000400000-0x000000000044D000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240508-en

Max time kernel

93s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3196 set thread context of 2312 N/A C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3196 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3196 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3196 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3196 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3196 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3196 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3196 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3196 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe

"C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3196 -ip 3196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 216

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 omnomnom.top udp
DE 195.201.252.28:443 omnomnom.top tcp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
BE 88.221.83.249:443 www.bing.com tcp
US 8.8.8.8:53 28.252.201.195.in-addr.arpa udp
US 8.8.8.8:53 249.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/3196-0-0x0000000000E9A000-0x0000000000E9B000-memory.dmp

memory/2312-1-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2312-2-0x00000000747AE000-0x00000000747AF000-memory.dmp

memory/2312-3-0x0000000005370000-0x00000000053D6000-memory.dmp

memory/2312-4-0x0000000005EC0000-0x00000000064D8000-memory.dmp

memory/2312-5-0x0000000005940000-0x0000000005952000-memory.dmp

memory/2312-6-0x0000000005A70000-0x0000000005B7A000-memory.dmp

memory/2312-7-0x00000000747A0000-0x0000000074F50000-memory.dmp

memory/2312-8-0x0000000006870000-0x00000000068AC000-memory.dmp

memory/2312-9-0x00000000068B0000-0x00000000068FC000-memory.dmp

memory/2312-10-0x0000000006BF0000-0x0000000006DB2000-memory.dmp

memory/2312-11-0x00000000072F0000-0x000000000781C000-memory.dmp

memory/2312-12-0x0000000006DC0000-0x0000000006E52000-memory.dmp

memory/2312-13-0x0000000007DD0000-0x0000000008374000-memory.dmp

memory/2312-14-0x0000000006EE0000-0x0000000006F56000-memory.dmp

memory/2312-15-0x0000000006E60000-0x0000000006E7E000-memory.dmp

memory/2312-16-0x0000000006FE0000-0x0000000007030000-memory.dmp

memory/2312-18-0x00000000747A0000-0x0000000074F50000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

145s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2852 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe
PID 2852 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe
PID 2852 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe
PID 2464 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe
PID 2464 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe
PID 2464 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe
PID 2464 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe
PID 2464 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe
PID 4888 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4888 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4888 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2852 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3462548.exe
PID 2852 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3462548.exe
PID 2852 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3462548.exe
PID 4136 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4136 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4136 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4136 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4136 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4136 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 4076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 4076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 4076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 4740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 4740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 4740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 4340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 4340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 4340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe

"C:\Users\Admin\AppData\Local\Temp\bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3462548.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3462548.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 88.221.83.211:443 www.bing.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
BE 88.221.83.211:443 www.bing.com tcp
US 8.8.8.8:53 211.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6637579.exe

MD5 30c37f591e0e8a3ed8b8ad1e68348f74
SHA1 5d9721d0957a7226f1c623f6ebcea94f85b0e3f2
SHA256 b47b4dc33ed5936c521918534d9d74d60400b457306a28777a07953ec4de9915
SHA512 59d8a567dec16ef16816c83ea9a4047e51252ac07ab297374681a6960f308277c9abfa994b8aa25d88fa14d14af176628cce65a87d3db28d6b507c7bbae90219

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9005778.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2788-14-0x0000000000410000-0x000000000041A000-memory.dmp

memory/2788-15-0x00007FF8251A3000-0x00007FF8251A5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0231860.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3462548.exe

MD5 ea394b5aa07b5b2b24be4e0195fafbce
SHA1 2d5cd94ec5277b0be1edee8a98c4e0b9859c6e2f
SHA256 33024d71a4ba3d3b6452789fee01532089a129a3135f166487d313886ccdcdb5
SHA512 5fcedb4e0079394f05a11ac84c437528d4dd16431baeefda473941029ae5707f4455cc8c1e137ebb54db98dd7c712c72c96aa2febab5692ea6671399af7dc117

memory/3532-33-0x0000000000490000-0x00000000004C0000-memory.dmp

memory/3532-34-0x0000000004DB0000-0x0000000004DB6000-memory.dmp

memory/3532-35-0x00000000054D0000-0x0000000005AE8000-memory.dmp

memory/3532-36-0x0000000004FC0000-0x00000000050CA000-memory.dmp

memory/3532-37-0x0000000004E10000-0x0000000004E22000-memory.dmp

memory/3532-38-0x0000000004EB0000-0x0000000004EEC000-memory.dmp

memory/3532-39-0x0000000004EF0000-0x0000000004F3C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe

"C:\Users\Admin\AppData\Local\Temp\0f5fae471624fdc2019d0988b658e0832f13a78b6b310cc8c3c1314c3e0c9f8d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 116

Network

N/A

Files

memory/2116-0-0x0000000000184000-0x0000000000185000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2776 set thread context of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2776 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2776 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2776 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2776 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2776 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2776 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2776 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe

"C:\Users\Admin\AppData\Local\Temp\2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
BE 88.221.83.208:443 www.bing.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 3.166.122.92.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp

Files

memory/2408-0-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2408-1-0x000000007469E000-0x000000007469F000-memory.dmp

memory/2408-2-0x0000000005760000-0x00000000057C6000-memory.dmp

memory/2408-3-0x0000000006270000-0x0000000006888000-memory.dmp

memory/2408-4-0x0000000005CF0000-0x0000000005D02000-memory.dmp

memory/2408-5-0x0000000005E20000-0x0000000005F2A000-memory.dmp

memory/2408-6-0x0000000074690000-0x0000000074E40000-memory.dmp

memory/2408-7-0x000000007469E000-0x000000007469F000-memory.dmp

memory/2408-8-0x0000000074690000-0x0000000074E40000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4756 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe
PID 4756 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe
PID 4756 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe
PID 1312 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe
PID 1312 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe
PID 1312 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe
PID 1312 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe
PID 1312 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe
PID 4948 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4948 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4948 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4756 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5000238.exe
PID 4756 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5000238.exe
PID 4756 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5000238.exe
PID 2496 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2496 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2496 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2496 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2496 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2496 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4404 wrote to memory of 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4404 wrote to memory of 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4404 wrote to memory of 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4404 wrote to memory of 4692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 4692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 4692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4404 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4404 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4404 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 1920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 1920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4404 wrote to memory of 1920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe

"C:\Users\Admin\AppData\Local\Temp\536536221030ca60a298f443a202be11047ecd20614f20fb85ec8e3b3915e013.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5000238.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5000238.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.200:443 www.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.83.221.88.in-addr.arpa udp
BE 88.221.83.200:443 www.bing.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0660174.exe

MD5 c1d11838fc188d25c2f77a9258117be8
SHA1 d464ecc65e6b82602b68a05529386b93d0a0364f
SHA256 3951efd4829f7794f2699bf2c2fe46d9da0b90d098a7575c7dbba075eb68e340
SHA512 fd1c54b37a5ea2d080d21160fafc920b1546abcf15d55612ce01c52fa5bdb1653bcb82b4bc30fea49bf88e368cc06abaa2911495fdf79475998baaaaf85c350b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1666088.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4304-14-0x0000000000D50000-0x0000000000D5A000-memory.dmp

memory/4304-15-0x00007FF991F93000-0x00007FF991F95000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0861454.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5000238.exe

MD5 c7512b29baf79f0cc12021551da6b3ed
SHA1 0d846e372f1bd982bdab2cb29e11a28ece7209e1
SHA256 afd709dcbc9ca54b205f0ae67b3fe827014b4452d0e121cb53c792a17083f73f
SHA512 dd1e9327fe9d8bafe6c8c3786e399ef9b0b3db503af6358c58fd7362cf6f3b452623681ef1d58c6c9c63dba7cd81b9763538acc67eaaaecd1f52ac5e87fb948f

memory/3256-33-0x00000000000F0000-0x0000000000120000-memory.dmp

memory/3256-34-0x0000000002580000-0x0000000002586000-memory.dmp

memory/3256-35-0x0000000005100000-0x0000000005718000-memory.dmp

memory/3256-36-0x0000000004BF0000-0x0000000004CFA000-memory.dmp

memory/3256-37-0x0000000004970000-0x0000000004982000-memory.dmp

memory/3256-38-0x0000000004AE0000-0x0000000004B1C000-memory.dmp

memory/3256-39-0x0000000004B20000-0x0000000004B6C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4368 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe
PID 4368 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe
PID 4368 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe
PID 4056 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe
PID 4056 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe
PID 4056 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe
PID 1772 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1772 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1772 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4056 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe
PID 4056 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe
PID 4364 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4364 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4364 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4364 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4364 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4364 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3452 wrote to memory of 4896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3452 wrote to memory of 4896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3452 wrote to memory of 4896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3452 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3452 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3452 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3452 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 4516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 4516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3452 wrote to memory of 4516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4368 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3846350.exe
PID 4368 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3846350.exe
PID 4368 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3846350.exe

Processes

C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe

"C:\Users\Admin\AppData\Local\Temp\036028e38619a2b41891058cbbec38bbd4ebcfca4ce732fb7db9ad8f372c62a7.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3846350.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3846350.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.211:443 www.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
BE 88.221.83.211:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 211.83.221.88.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7942199.exe

MD5 71e355dcb8a6ca1632fc7b7f55a728c3
SHA1 0a568ede66e04ed51dc95b44cd900318625beca4
SHA256 da5e505715186a330533cddaf6bff5e76de846b0b0e339f1755abf92474cc2e9
SHA512 cd62460a83aa1dd6294852b555c4362d1f7dec66c7af7e18be334c490bf0ad49ee3eced6c4f36ffc210938daaf9a905a21cceb7104fe7f7ba9443e4b49172cc7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5586348.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8113955.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1432-27-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3846350.exe

MD5 6c40ab23c5708723c1f08921412fdebc
SHA1 cf417551a661f52c6995767472ad8dd8210c62eb
SHA256 b564d4bb1dee73e2580c0ca4ac47e6a776185beb7a09e4978bb1b650609d58b5
SHA512 523828b98f53258f7dcee13367f56cb308c64ebb543dda19f2c7ac8b5a9a1180c69886284054ac3dca6ddd88a02a420f07abcea49cef0eadc528165e1d5b3efe

memory/3312-33-0x00000000007D0000-0x0000000000800000-memory.dmp

memory/3312-34-0x00000000010C0000-0x00000000010C6000-memory.dmp

memory/3312-35-0x000000000AD40000-0x000000000B358000-memory.dmp

memory/3312-36-0x000000000A830000-0x000000000A93A000-memory.dmp

memory/3312-37-0x0000000005330000-0x0000000005342000-memory.dmp

memory/3312-38-0x000000000A720000-0x000000000A75C000-memory.dmp

memory/3312-39-0x0000000002BE0000-0x0000000002C2C000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4496 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe
PID 4496 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe
PID 4496 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe
PID 1796 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe
PID 1796 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe
PID 1796 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe
PID 552 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 552 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 552 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1796 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe
PID 1796 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe
PID 2032 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2032 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 4580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 4580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1068 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 3300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 3300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1068 wrote to memory of 3300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4496 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4554213.exe
PID 4496 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4554213.exe
PID 4496 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4554213.exe

Processes

C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe

"C:\Users\Admin\AppData\Local\Temp\69b4a9447365c1cc607cb7e8de4957fcb1ce9841892d9533740403ef7e5af76c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4216,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4554213.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4554213.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BE 88.221.83.249:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 249.83.221.88.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 98.56.20.217.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0593342.exe

MD5 2b13f062150e7b89e82d923c2ecd887f
SHA1 f1bba69a28947aeeca9ebc7f73df686b3c6217f4
SHA256 0cf0d2983962ac8d613bf65c2a436a88b2ccc7e9a4d43881a17401c7e18aece5
SHA512 ea4650c2dc37ae1b91b7e9a349fa04a988768a27f3b25f32183efbe1d33860976592dfc14472d50e00b7c15edeec2b3f8511e9f939ebcb1e0c28ce732a629b0a

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7263863.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7640791.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4652-27-0x00000000002A0000-0x00000000002AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4554213.exe

MD5 966c82ff356214d6d80c6aa71575a069
SHA1 94f42f99c588218aab5dc1a1764affa37e0ca801
SHA256 44910df07d9d43fd7a105679626af86512dee3f36dbd9aff9c89714ea50384d0
SHA512 12d1e66da6e470614e4a4e735afdbd7775c88d872110ec0e11edd42513a65c1326464ff1b8bf84ab3ca3dc578914965a3239b6d59cd9f3e2b93fa6c84cde3e76

memory/4976-33-0x0000000000A10000-0x0000000000A40000-memory.dmp

memory/4976-34-0x0000000002B70000-0x0000000002B76000-memory.dmp

memory/4976-35-0x000000000AD40000-0x000000000B358000-memory.dmp

memory/4976-36-0x000000000A880000-0x000000000A98A000-memory.dmp

memory/4976-37-0x000000000A7C0000-0x000000000A7D2000-memory.dmp

memory/4976-38-0x000000000A820000-0x000000000A85C000-memory.dmp

memory/4976-39-0x0000000004D40000-0x0000000004D8C000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4880 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe
PID 4880 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe
PID 4880 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe
PID 4124 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe
PID 4124 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe
PID 4124 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe
PID 4124 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe
PID 4124 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe
PID 2452 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2452 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2452 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4880 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1676617.exe
PID 4880 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1676617.exe
PID 4880 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1676617.exe
PID 1960 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1960 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1960 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4392 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4392 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4392 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4392 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 1304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 1304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 1304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4392 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4392 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4392 wrote to memory of 3776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 3776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 3776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4392 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe

"C:\Users\Admin\AppData\Local\Temp\d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1676617.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1676617.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 152.141.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1529737.exe

MD5 4cd9023a6db3d9fcb9bd9d8cfc4157e5
SHA1 48f1f69a5c6aaf9fee489f5f7d65fefa3b554666
SHA256 3b54dcdbe445b1feddee94cc93cabf1250e5acb2686dfe24cee9c805515232f1
SHA512 f5dfff690bb3ee16da0830d196904246bcf4224396df01f7645759b678119f8c54b19d492819e03423b1a4fcf17c449b547e1ef02e60244dd25386284740d882

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6347393.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4532-14-0x00007FFB9C983000-0x00007FFB9C985000-memory.dmp

memory/4532-15-0x0000000000D90000-0x0000000000D9A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5984147.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1676617.exe

MD5 9d0719ec08c81017d841bce338a09224
SHA1 8053df92d48336df2514a0e1a97ff93bb12da98b
SHA256 4a6c0896e173d47fe5c9bc542a7e777ca85efca78636c0018e56bc785111ee14
SHA512 aa140689d7c274a5aa1d785c3df16b161ef84342dc108632782d5eaa437b9ab10c76e06b761cc1af17174655d7b16668ffc89f1a28682d0db9e812332a4ed9f1

memory/436-33-0x0000000000FC0000-0x0000000000FF0000-memory.dmp

memory/436-34-0x00000000057A0000-0x00000000057A6000-memory.dmp

memory/436-35-0x000000000B3F0000-0x000000000BA08000-memory.dmp

memory/436-36-0x000000000AF70000-0x000000000B07A000-memory.dmp

memory/436-37-0x000000000AEB0000-0x000000000AEC2000-memory.dmp

memory/436-38-0x000000000AF10000-0x000000000AF4C000-memory.dmp

memory/436-39-0x0000000003170000-0x00000000031BC000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win7-20240215-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe

"C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 120

Network

N/A

Files

memory/2268-0-0x00000000001E1000-0x00000000001E2000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37.exe

"C:\Users\Admin\AppData\Local\Temp\5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
RU 45.9.74.149:48852 tcp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
RU 45.9.74.149:48852 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 3.166.122.92.in-addr.arpa udp
RU 45.9.74.149:48852 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
RU 45.9.74.149:48852 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 45.9.74.149:48852 tcp
RU 45.9.74.149:48852 tcp

Files

memory/1816-0-0x0000000000401000-0x0000000000402000-memory.dmp

memory/1816-1-0x00000000001C0000-0x00000000001F0000-memory.dmp

memory/1816-5-0x0000000000400000-0x0000000000447000-memory.dmp

memory/1816-6-0x0000000002650000-0x0000000002656000-memory.dmp

memory/1816-7-0x0000000005130000-0x0000000005748000-memory.dmp

memory/1816-8-0x0000000004B10000-0x0000000004C1A000-memory.dmp

memory/1816-9-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

memory/1816-10-0x0000000004C20000-0x0000000004C5C000-memory.dmp

memory/1816-11-0x0000000004CC0000-0x0000000004D0C000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0246191.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0246191.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0246191.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4988 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe
PID 4988 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe
PID 4988 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe
PID 3948 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe
PID 3948 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe
PID 3948 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe
PID 3056 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe
PID 3056 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe
PID 3056 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe
PID 3056 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe
PID 3056 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe
PID 1476 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1476 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1476 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3948 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0246191.exe
PID 3948 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0246191.exe
PID 3948 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0246191.exe
PID 2900 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2900 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2900 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2900 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2900 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2900 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3532 wrote to memory of 4728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3532 wrote to memory of 4728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3532 wrote to memory of 4728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3532 wrote to memory of 3964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 3964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 3964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 4708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 4708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 4708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 4528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3532 wrote to memory of 4528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3532 wrote to memory of 4528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3532 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 3256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 3256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3532 wrote to memory of 3256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4988 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7150468.exe
PID 4988 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7150468.exe
PID 4988 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7150468.exe

Processes

C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe

"C:\Users\Admin\AppData\Local\Temp\82e326156adec2026e8e0aa855442e0ad0ba79d30fd32edc514718586f8c6f5b.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0246191.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0246191.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7150468.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7150468.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5597139.exe

MD5 cab728fa98fec88f33be698c2cddaf3c
SHA1 ef9703b198fa1f0d54e56e9b03e802e75fdb9615
SHA256 91cf97de04afbe15cf8856a726f6be2acc43274d754f63b843ae137da8f69a79
SHA512 2f6980921c4b602fd929ad6d13ea2758d4d1e3e60b8e2395a6c5a15927dc25acf108fe3c3cf9da30f958bdfc286494ba6c161d047154950342ad3d1702181382

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8504057.exe

MD5 b05a0a5c2c53c412e1d7b67b4c6fbe82
SHA1 819f9b76b84dc174b2f6151e93bc59d34a63a060
SHA256 e092b604300c73a5fa16eabc59ac080a58fc0b7f001af82454a285d28e1d3ad1
SHA512 f89c82e6683b8e05cd45cc0b7a91b6bd7d21dae9e9c54e1257103f15a94843fee5a513e3be94b0e7b103c122180dc6ad3bdc1b883d566a28facacc06771b3786

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4664645.exe

MD5 84e650ddd721a43754b2aaf521d0bf0a
SHA1 e661e5e02471f422b0b90a4bef17c6508ef2556b
SHA256 8f34156f8e4061f7b72216c33d79a27f64ff512c0bf1016d6934cb318d72d246
SHA512 de206a6c627d00f8535420338a198daede8108d46298877aaaa3b6763099e2b1929367106b1bd6eff6038f3b55a6e2c6f9b66a9fd5df76e9b5d3f5d9b7d07bd9

memory/3160-21-0x00007FFB15AC3000-0x00007FFB15AC5000-memory.dmp

memory/3160-22-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6788799.exe

MD5 cd0a4e8768e6d3a4296de951ab949ab5
SHA1 47f6d7cc658e0888243a3c40f2d823162a756ef0
SHA256 56de36e7a6759bcc4b288d6ef04f802b9dd2ae3ae2417fd842c5d0e8f34fc448
SHA512 75a0f7c2e39f6e32c14c2814a4f615997f8f88c22ac9a6cde5fa4aab54466c89afd91ba5df6437073a98157519ab6b06e7cc9d9fc72af4b341042c6979873d9b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0246191.exe

MD5 727b6b4e28c2fd0161e905b6dd5b639a
SHA1 548bd23eb203e6367b2500fff336117a4f669b00
SHA256 6e61ec74bc18a709c6e168941eee7383dcbbb7b3314f75f7622ad7638c3ceb8b
SHA512 02a8e99bf89c53adafa70df24cfd4d980b30a2caaad3f8b3a8ff7bfd633158d901e70bff692a0a66156eb59a62fbc3f7336bbeff129d0a06c21ebaa56e735437

memory/2720-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d7150468.exe

MD5 a1e19ff59ed931bae67890e77f4d2958
SHA1 259b4f997269faadb314bfbebd5db0fc7fceeeef
SHA256 0eace3131a0a974dda247eecdde73ebb4ecfe825e3b3163d01bbb2e900fcf725
SHA512 4b9a6b91b31bdeb5153c0a33332d1b59d6ea6b7f52d738175488d1f667e98c1cf5ec4fe2642d8b389bfdc15a8616822d1dc87120c0b95769482719543b667165

memory/4716-44-0x0000000000F40000-0x0000000000F70000-memory.dmp

memory/4716-45-0x0000000003310000-0x0000000003316000-memory.dmp

memory/4716-46-0x000000000B390000-0x000000000B9A8000-memory.dmp

memory/4716-47-0x000000000AEF0000-0x000000000AFFA000-memory.dmp

memory/4716-48-0x000000000AE30000-0x000000000AE42000-memory.dmp

memory/4716-49-0x000000000AE90000-0x000000000AECC000-memory.dmp

memory/4716-50-0x00000000031D0000-0x000000000321C000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82e97b51cae4985f5a2abc5bbe0fe4c23fb25fa8072e45d5e34ec789cb7fcc5f.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\82e97b51cae4985f5a2abc5bbe0fe4c23fb25fa8072e45d5e34ec789cb7fcc5f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1328 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\82e97b51cae4985f5a2abc5bbe0fe4c23fb25fa8072e45d5e34ec789cb7fcc5f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe
PID 1328 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\82e97b51cae4985f5a2abc5bbe0fe4c23fb25fa8072e45d5e34ec789cb7fcc5f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe
PID 1328 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\82e97b51cae4985f5a2abc5bbe0fe4c23fb25fa8072e45d5e34ec789cb7fcc5f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe
PID 760 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe
PID 760 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe
PID 760 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe
PID 2884 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0964284.exe
PID 2884 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0964284.exe
PID 2884 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0964284.exe

Processes

C:\Users\Admin\AppData\Local\Temp\82e97b51cae4985f5a2abc5bbe0fe4c23fb25fa8072e45d5e34ec789cb7fcc5f.exe

"C:\Users\Admin\AppData\Local\Temp\82e97b51cae4985f5a2abc5bbe0fe4c23fb25fa8072e45d5e34ec789cb7fcc5f.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0964284.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0964284.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
FI 77.91.68.56:19071 tcp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3861992.exe

MD5 f8fd51a60aeb20176c23847c641bd685
SHA1 cfa7f926a0eaaaab32d12089a30a8686cd4781c8
SHA256 df3628ba060a96d1d39c4c3fe2a35d166fbfbf13e1e71bf02a4061c4b85d2a8a
SHA512 cb6365432e6c1670419a941e6830eb0254572c50d5e22ca330564858a7e67b6480152a4ea86c4b54c7067994ed29ae7a3eaf65fbe33e4dc67cad093820a2a52c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0499880.exe

MD5 cb02179f1b4ec56ac46106ab3c8a6da4
SHA1 a158e77fd9fe8bc718ae3a53c107e61b5d74685c
SHA256 53778a922e24dc3e0446fc86ddfa3f04e6592e7fbc71dd416c928c8bd3c87de4
SHA512 c4279e99940ad08636c24bc5d6abf8da86ae924ceae3ca4486cbdd9138234ab4f4ada98065610cd6cb53c6b00dfeaba7c007120d465fcdf510d8198d65d6a6f7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0964284.exe

MD5 f543fa9e3d44db6851ca3a1af6a094c2
SHA1 4aa6879c80ef145d11f95810c41b7c5733e81f7a
SHA256 408ef900484b44fb7d41ebe3c3a8c06ce8f13cfc791803374666b15847272736
SHA512 efda8c364c056a0b12ac94f3606f9f93bfc6325378e57f148ae3b400cb6a31774705d083fb9ffa739c2b8c7441aba58c03481202e9df63fc14cb1fcd9aac0aa6

memory/5048-21-0x0000000000401000-0x0000000000404000-memory.dmp

memory/5048-22-0x0000000001F50000-0x0000000001FDC000-memory.dmp

memory/5048-29-0x00000000024A0000-0x00000000024A1000-memory.dmp

memory/5048-28-0x0000000001F50000-0x0000000001FDC000-memory.dmp

memory/5048-30-0x0000000002380000-0x0000000002386000-memory.dmp

memory/5048-31-0x0000000004A40000-0x0000000005058000-memory.dmp

memory/5048-32-0x00000000050B0000-0x00000000051BA000-memory.dmp

memory/5048-33-0x00000000051E0000-0x00000000051F2000-memory.dmp

memory/5048-34-0x0000000005200000-0x000000000523C000-memory.dmp

memory/5048-35-0x0000000005270000-0x00000000052BC000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1392 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe
PID 1392 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe
PID 1392 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe
PID 4856 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe
PID 4856 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe
PID 4856 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe
PID 2456 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe
PID 2456 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe
PID 2456 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe

"C:\Users\Admin\AppData\Local\Temp\b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
RU 185.161.248.37:4138 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.224:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 224.83.221.88.in-addr.arpa udp
RU 185.161.248.37:4138 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 35.166.122.92.in-addr.arpa udp
RU 185.161.248.37:4138 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
RU 185.161.248.37:4138 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
RU 185.161.248.37:4138 tcp
RU 185.161.248.37:4138 tcp
US 8.8.8.8:53 63.141.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1101592.exe

MD5 a71d1485c6def63e3a12a56cef3df216
SHA1 6356ae641fe06783171f255072b3f06c3e53fe5a
SHA256 f71aeabbf5f3f4fa0a150bad2b24cd2db183e723cecd2296815fdc1582b31297
SHA512 b7f7ab9fada5915189862df412f319de2f1958606d40c24bb31060352d07f94c4300c849aa9e61efb3a0e30a458c17afad573a145a326ee56c02c5e19fb19393

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5310347.exe

MD5 59758d08e26d80f2b560b43915a196e7
SHA1 191e46484309a701c87f826cfeca3c5590f41c75
SHA256 2b21dfe635c66e24e5cbba2203c09083e228789c3bed18a1dde42d38b19ee924
SHA512 548c92ed1205a43648fa218af44b77811a149e4c82a48943a164e3464f035b2ef56a89aa1270311a7410aaf8c98e1b7383290a796a53dc3da450edd6f77f618d

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6752633.exe

MD5 fc89ffae6d5ecc9374ef6b75d0d09edb
SHA1 8440ad5c070d5bb75d10308525777a70d42d18fc
SHA256 5d2c14e89b6b1b95fead94182a17aebfeaca900df36f4eb7cb87cd52829196da
SHA512 558f2e2b7ed661b8f486c980483d04148f09e1c692469d978e6efc98425f5cd32393351684f90cc3ba6611193a4ac58724e31310f358055e75dca30ced3d8752

memory/216-21-0x0000000000650000-0x000000000067A000-memory.dmp

memory/216-22-0x00000000054A0000-0x0000000005AB8000-memory.dmp

memory/216-23-0x0000000004FE0000-0x00000000050EA000-memory.dmp

memory/216-24-0x0000000004F10000-0x0000000004F22000-memory.dmp

memory/216-25-0x0000000004F70000-0x0000000004FAC000-memory.dmp

memory/216-26-0x00000000050F0000-0x000000000513C000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ef11bf7b35a28054917643092a94f68ccdbc57cd68005df66e6d81a0d2d012d4.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ef11bf7b35a28054917643092a94f68ccdbc57cd68005df66e6d81a0d2d012d4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8044384.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ef11bf7b35a28054917643092a94f68ccdbc57cd68005df66e6d81a0d2d012d4.exe

"C:\Users\Admin\AppData\Local\Temp\ef11bf7b35a28054917643092a94f68ccdbc57cd68005df66e6d81a0d2d012d4.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8044384.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8044384.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5275281.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5275281.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.249:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
BE 88.221.83.249:443 www.bing.com tcp
US 8.8.8.8:53 249.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8044384.exe

MD5 c8b9665121b73a485f79a2de1628661c
SHA1 bd0d783f55f37e8737343bb00b49ee8cf2fa0ba4
SHA256 40c4c723b4d0c89645ae299cab3530bc2ef9c57d9150449fe0c8c6aead004937
SHA512 9b5eed29972830c26142a8bbbe0dd7b850854dfaeb6c1d0b8e2597f874df5cea1737de4b52142527e6da33dc9f10275113c66b694faf153613929f28bd9d2862

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe

MD5 7cd0e92a3344c81e96123ea28d0acb91
SHA1 71c25bf1f5eb3e3f23ed2bde5ae76c853bcc16c2
SHA256 f4c25888b594f3e771c892db06734e7a18adc87a4dc9e2ab0488322307844584
SHA512 4965602e6ea39d53b3044432ac9ca2a58b8d556ffa5295bc75b065d8db6df21e6ef6578cc7bc47f2a239b067ae6226fc2fa8dc9315ca5b16cad6e842fd6c9cc2

memory/4920-14-0x00007FFBFE223000-0x00007FFBFE225000-memory.dmp

memory/4920-15-0x00000000007A0000-0x00000000007AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5275281.exe

MD5 88902ec73df2239eb1b5444e9faca32e
SHA1 708b48c5f20fb8929510495b969f77cf7f990061
SHA256 d68f96f7972e2a8c02ed03bf9cb5bdba900bb7dde262eeddc9a31cd30722f3bf
SHA512 b88c8e41ffd91482882d22569af4c86302e483ccc0cc0f1931080c126a1794a6e2183880a153107911c28526782faf1fb5f59efa4cf5d32eb1a9ec9125084fe6

memory/4056-20-0x0000000000B60000-0x0000000000B90000-memory.dmp

memory/4056-21-0x0000000002E00000-0x0000000002E06000-memory.dmp

memory/4056-22-0x000000000B080000-0x000000000B698000-memory.dmp

memory/4056-23-0x000000000AB70000-0x000000000AC7A000-memory.dmp

memory/4056-24-0x000000000AA60000-0x000000000AA72000-memory.dmp

memory/4056-25-0x000000000AAC0000-0x000000000AAFC000-memory.dmp

memory/4056-26-0x0000000004FC0000-0x000000000500C000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4644 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe
PID 4644 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe
PID 4644 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe
PID 4104 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe
PID 4104 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe
PID 4104 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe
PID 4660 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe
PID 4660 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe
PID 4660 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe
PID 4660 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe
PID 4660 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe
PID 4660 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe

"C:\Users\Admin\AppData\Local\Temp\f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.129:443 www.bing.com tcp
US 8.8.8.8:53 136.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 129.107.17.2.in-addr.arpa udp
BE 2.17.107.129:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 3.166.122.92.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe

MD5 9cc9c916490c135defcc592f1f2a5374
SHA1 03f2aea5009ab3e5f8d2880b3904aa41de9fe537
SHA256 74a89129e242e5cf7c5332b993cad847e3f6edbf85df58c21f3efbb9b5269f23
SHA512 7e6132ce2d2b733287a767a963b57c0879ebc9b41e4a97c4a2f9bc9f5c8b4cc663ac3d25702516e2b8d0028091787f76e23d27a36f43726c9d0dd4946f68e684

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe

MD5 c5a850b9ed6a570f1369475362bbe02a
SHA1 b9bd9921109dee417ffae88e63f05f046d91aabe
SHA256 177f07125221507dd30a4895acaacc482b8deb8a39d3b93660e1d21a3a8788b5
SHA512 9c15b8d3bae0a746dd0bd6f8644f41bbadec9f3a8c7bd5d092d03d04daf3d8f11fb6bd841171d287d652fb94677fbf131031330ebf27d19a559550d059403436

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe

MD5 1950f38d40bcb31bcd36050781382251
SHA1 88757c97fccc4654d94f84effaa208190f456316
SHA256 567eb24dd7ab2978dfb9b2fd429db5689c4ec354f001a061fb37537384e5b9ec
SHA512 1af275f1119e06b030b96d34628a19f370b16dec4c996fa0451292b217b3535061a2a66c752437b9e77b9788ef66864a23fc997bc155897a98f01bbc35a66fe8

memory/412-21-0x0000000000401000-0x0000000000404000-memory.dmp

memory/412-22-0x00000000005B0000-0x00000000005EE000-memory.dmp

memory/412-29-0x0000000002470000-0x0000000002471000-memory.dmp

memory/412-28-0x00000000005B0000-0x00000000005EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe

MD5 f543fa9e3d44db6851ca3a1af6a094c2
SHA1 4aa6879c80ef145d11f95810c41b7c5733e81f7a
SHA256 408ef900484b44fb7d41ebe3c3a8c06ce8f13cfc791803374666b15847272736
SHA512 efda8c364c056a0b12ac94f3606f9f93bfc6325378e57f148ae3b400cb6a31774705d083fb9ffa739c2b8c7441aba58c03481202e9df63fc14cb1fcd9aac0aa6

memory/2104-35-0x0000000002010000-0x000000000209C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/2104-42-0x0000000002010000-0x000000000209C000-memory.dmp

memory/2104-44-0x0000000002410000-0x0000000002416000-memory.dmp

memory/2104-45-0x0000000004A10000-0x0000000005028000-memory.dmp

memory/2104-46-0x00000000050B0000-0x00000000051BA000-memory.dmp

memory/2104-47-0x00000000051E0000-0x00000000051F2000-memory.dmp

memory/2104-48-0x0000000005200000-0x000000000523C000-memory.dmp

memory/2104-49-0x0000000005270000-0x00000000052BC000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win7-20240508-en

Max time kernel

122s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe

"C:\Users\Admin\AppData\Local\Temp\1998a377c7bb1ac8d7d9ef4fdd72c4bc6479d87263d40908ca9ea76e5f8f2011.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 116

Network

N/A

Files

memory/2976-0-0x0000000000C3A000-0x0000000000C3B000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

141s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe
PID 2024 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe
PID 2024 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe
PID 2472 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe
PID 2472 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe
PID 2472 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe
PID 2508 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2508 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2508 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2472 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe
PID 2472 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe
PID 4872 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4872 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4872 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4872 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4872 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4872 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3800 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3800 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3800 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3800 wrote to memory of 4368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 4368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 4368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 3264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3800 wrote to memory of 3264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3800 wrote to memory of 3264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3800 wrote to memory of 3928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 3928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 3928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3800 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2024 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9240000.exe
PID 2024 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9240000.exe
PID 2024 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9240000.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe

"C:\Users\Admin\AppData\Local\Temp\1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9240000.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9240000.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
FI 77.91.68.61:80 tcp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
BE 88.221.83.208:443 www.bing.com tcp
US 20.231.121.79:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4556602.exe

MD5 f6e1584f0bf76cb03aff120111b7072e
SHA1 55cf935a6330688eb161152b7d8b0708c6c8e457
SHA256 2914325370ac48370d4759b2a122d549ccff81100ea8f96880ab74fabfbbe2ab
SHA512 4367816fbd2b5865a823a171d7937285b83bb60c32f512bd511ebdeea839002bdbb4beae3a3314637c500ed7d4eae66125a364a07ca59459d7da6f3a8e7ca541

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0185727.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1092765.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3544-27-0x0000000000D90000-0x0000000000D9A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9240000.exe

MD5 f2a374f6013a1d9db5e224d6a0ab6565
SHA1 2f8f95a8f5b898a0e4afa6633049a41a3941c696
SHA256 813ef53afa52c3f36ecab7586378ff5f6b6bfc196491d99815d5bc01352f1aea
SHA512 aee4e8b8414342374bcc19fb6b1250134e02fd6e500d7a6b50fa82310bdfb37a6e42829216c76fa9f6bee80b3355ef43df7a26a368db740e83796f123e058abf

memory/1728-32-0x0000000000F60000-0x0000000000F90000-memory.dmp

memory/1728-33-0x0000000003330000-0x0000000003336000-memory.dmp

memory/1728-34-0x000000000B2F0000-0x000000000B908000-memory.dmp

memory/1728-35-0x000000000ADE0000-0x000000000AEEA000-memory.dmp

memory/1728-36-0x000000000AD10000-0x000000000AD22000-memory.dmp

memory/1728-37-0x000000000AD70000-0x000000000ADAC000-memory.dmp

memory/1728-38-0x0000000001780000-0x00000000017CC000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win10v2004-20240426-en

Max time kernel

137s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2688 set thread context of 3496 N/A C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2688 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2688 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2688 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2688 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2688 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2688 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2688 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2688 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe

"C:\Users\Admin\AppData\Local\Temp\52d5102aa94d913408cacb8480a5007f4757bac252d6379b467616eb62442eea.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2688 -ip 2688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 340

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 omnomnom.top udp
DE 195.201.252.28:443 omnomnom.top tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.252.201.195.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 35.166.122.92.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.202:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BE 88.221.83.202:443 www.bing.com tcp
US 8.8.8.8:53 202.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/2688-0-0x0000000000111000-0x0000000000112000-memory.dmp

memory/3496-1-0x0000000000400000-0x0000000000422000-memory.dmp

memory/3496-2-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

memory/3496-3-0x00000000055D0000-0x0000000005636000-memory.dmp

memory/3496-4-0x0000000006160000-0x0000000006778000-memory.dmp

memory/3496-5-0x0000000005BC0000-0x0000000005BD2000-memory.dmp

memory/3496-6-0x0000000005CF0000-0x0000000005DFA000-memory.dmp

memory/3496-7-0x0000000074A60000-0x0000000075210000-memory.dmp

memory/3496-8-0x00000000069C0000-0x00000000069FC000-memory.dmp

memory/3496-9-0x0000000006A00000-0x0000000006A4C000-memory.dmp

memory/3496-10-0x0000000006D30000-0x0000000006EF2000-memory.dmp

memory/3496-11-0x0000000007430000-0x000000000795C000-memory.dmp

memory/3496-12-0x0000000006F00000-0x0000000006F92000-memory.dmp

memory/3496-13-0x0000000007F10000-0x00000000084B4000-memory.dmp

memory/3496-14-0x0000000007020000-0x0000000007096000-memory.dmp

memory/3496-15-0x0000000006D10000-0x0000000006D2E000-memory.dmp

memory/3496-16-0x0000000007130000-0x0000000007180000-memory.dmp

memory/3496-18-0x0000000074A60000-0x0000000075210000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-09 14:57

Reported

2024-05-09 15:00

Platform

win7-20240508-en

Max time kernel

131s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37.exe

"C:\Users\Admin\AppData\Local\Temp\5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37.exe"

Network

Country Destination Domain Proto
RU 45.9.74.149:48852 tcp
RU 45.9.74.149:48852 tcp
RU 45.9.74.149:48852 tcp
RU 45.9.74.149:48852 tcp
RU 45.9.74.149:48852 tcp
RU 45.9.74.149:48852 tcp

Files

memory/2284-0-0x0000000000220000-0x0000000000250000-memory.dmp

memory/2284-4-0x0000000000401000-0x0000000000402000-memory.dmp

memory/2284-5-0x0000000000400000-0x0000000000447000-memory.dmp

memory/2284-6-0x00000000004E0000-0x00000000004E6000-memory.dmp