Overview
overview
10Static
static
3061ed335bc...9b.exe
windows7-x64
3061ed335bc...9b.exe
windows10-2004-x64
10067e5c3ecf...b6.exe
windows10-2004-x64
101ec8ce9ace...96.exe
windows10-2004-x64
10349cf4c964...66.exe
windows10-2004-x64
104250b0250d...ee.exe
windows10-2004-x64
1056dbfb10e0...5d.exe
windows10-2004-x64
105951daaf24...9a.exe
windows10-2004-x64
1059c1607382...01.exe
windows10-2004-x64
1074cf5b47d1...8d.exe
windows10-2004-x64
10795a49ee81...4a.exe
windows10-2004-x64
108b549a8688...5b.exe
windows10-2004-x64
1091da85daf6...d8.exe
windows10-2004-x64
10a8dffd83e4...8a.exe
windows10-2004-x64
7ab124875ee...6a.exe
windows10-2004-x64
10ccc5c313f4...94.exe
windows10-2004-x64
10cce5498639...83.exe
windows10-2004-x64
10ce9f75c073...16.exe
windows10-2004-x64
10dda511575f...2f.exe
windows10-2004-x64
10eb81f341bc...da.exe
windows10-2004-x64
10f943251c5b...1b.exe
windows10-2004-x64
10Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 17:27
Static task
static1
Behavioral task
behavioral1
Sample
061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe
Resource
win10v2004-20240426-en
General
-
Target
74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe
-
Size
1.1MB
-
MD5
6e23ce77b8eadf69971ce2729e2dc264
-
SHA1
be53621f2277dac9ee2a33bcc6f31837efc05f30
-
SHA256
74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d
-
SHA512
74c77141db73defabadd0c570d2c8e6aa2f2f21ed514ef51189ce26e2894e81c4fb0564c261278b373a283da1353f12dc057bedb3f5b21f479dc6cc8379b9cc5
-
SSDEEP
24576:oygMfa7QOzNGs+DFO8m8C8+PwW7urzpkujeOO6:vgaa7jzN5+DuM+/k1BXO
Malware Config
Extracted
amadey
3.85
http://77.91.68.3
-
install_dir
3ec1f323b5
-
install_file
danke.exe
-
strings_key
827021be90f1e85ab27949ea7e9347e8
-
url_paths
/home/love/index.php
Extracted
redline
naher
77.91.68.48:19071
-
auth_value
62708e72becb72a24cf8843b46acc6a1
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral10/files/0x000700000002342c-37.dat healer behavioral10/memory/3988-38-0x0000000000CC0000-0x0000000000CCA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h7880167.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h7880167.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h7880167.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h7880167.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h7880167.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h7880167.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral10/files/0x0007000000023429-41.dat family_redline behavioral10/memory/4720-43-0x0000000000EA0000-0x0000000000ED0000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation g4971332.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 10 IoCs
pid Process 2964 x3719888.exe 5096 x3917601.exe 1648 f4278858.exe 3640 g4971332.exe 560 danke.exe 3988 h7880167.exe 4720 i1498581.exe 408 danke.exe 3156 danke.exe 3200 danke.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h7880167.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x3719888.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x3917601.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4572 1648 WerFault.exe 87 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4708 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3988 h7880167.exe 3988 h7880167.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3988 h7880167.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2964 2476 74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe 83 PID 2476 wrote to memory of 2964 2476 74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe 83 PID 2476 wrote to memory of 2964 2476 74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe 83 PID 2964 wrote to memory of 5096 2964 x3719888.exe 86 PID 2964 wrote to memory of 5096 2964 x3719888.exe 86 PID 2964 wrote to memory of 5096 2964 x3719888.exe 86 PID 5096 wrote to memory of 1648 5096 x3917601.exe 87 PID 5096 wrote to memory of 1648 5096 x3917601.exe 87 PID 5096 wrote to memory of 1648 5096 x3917601.exe 87 PID 5096 wrote to memory of 3640 5096 x3917601.exe 92 PID 5096 wrote to memory of 3640 5096 x3917601.exe 92 PID 5096 wrote to memory of 3640 5096 x3917601.exe 92 PID 3640 wrote to memory of 560 3640 g4971332.exe 93 PID 3640 wrote to memory of 560 3640 g4971332.exe 93 PID 3640 wrote to memory of 560 3640 g4971332.exe 93 PID 2964 wrote to memory of 3988 2964 x3719888.exe 94 PID 2964 wrote to memory of 3988 2964 x3719888.exe 94 PID 560 wrote to memory of 4708 560 danke.exe 95 PID 560 wrote to memory of 4708 560 danke.exe 95 PID 560 wrote to memory of 4708 560 danke.exe 95 PID 560 wrote to memory of 1580 560 danke.exe 97 PID 560 wrote to memory of 1580 560 danke.exe 97 PID 560 wrote to memory of 1580 560 danke.exe 97 PID 1580 wrote to memory of 2096 1580 cmd.exe 99 PID 1580 wrote to memory of 2096 1580 cmd.exe 99 PID 1580 wrote to memory of 2096 1580 cmd.exe 99 PID 1580 wrote to memory of 4200 1580 cmd.exe 100 PID 1580 wrote to memory of 4200 1580 cmd.exe 100 PID 1580 wrote to memory of 4200 1580 cmd.exe 100 PID 1580 wrote to memory of 3708 1580 cmd.exe 101 PID 1580 wrote to memory of 3708 1580 cmd.exe 101 PID 1580 wrote to memory of 3708 1580 cmd.exe 101 PID 1580 wrote to memory of 4168 1580 cmd.exe 102 PID 1580 wrote to memory of 4168 1580 cmd.exe 102 PID 1580 wrote to memory of 4168 1580 cmd.exe 102 PID 1580 wrote to memory of 1000 1580 cmd.exe 103 PID 1580 wrote to memory of 1000 1580 cmd.exe 103 PID 1580 wrote to memory of 1000 1580 cmd.exe 103 PID 1580 wrote to memory of 1632 1580 cmd.exe 104 PID 1580 wrote to memory of 1632 1580 cmd.exe 104 PID 1580 wrote to memory of 1632 1580 cmd.exe 104 PID 2476 wrote to memory of 4720 2476 74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe 105 PID 2476 wrote to memory of 4720 2476 74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe 105 PID 2476 wrote to memory of 4720 2476 74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe"C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe4⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 1365⤵
- Program crash
PID:4572
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F6⤵
- Creates scheduled task(s)
PID:4708
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2096
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"7⤵PID:4200
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E7⤵PID:3708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4168
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"7⤵PID:1000
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E7⤵PID:1632
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3988
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe2⤵
- Executes dropped EXE
PID:4720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 16481⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:408
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:3156
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:3200
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
174KB
MD510d43f9f5c1b584e1e44238222b31622
SHA125fd2b7ad514885d8edcb248d0ceb13c94736e7c
SHA256701e9f376908966bc245ee6400a23fa241dedcc92e050a1e97287485ef88dfcb
SHA51225d164ff16ee6fb3052eb3e27e1fbf51987bfc04ee274dc1254adc599bfe6dcb155f3aff9a63e1d39a653dd3ec4e6dccc1deb7f31b7bbf77ce6ba488926e8e63
-
Filesize
956KB
MD5413b60f6a17f654b0b189ee9e2958cc1
SHA17bdc8dff90952c2235e8e30b09c1b19f74522cec
SHA25644e183018766f53bad57022988f261e79d339d03488a90d9da19941481b20006
SHA51216ea6bbe9d4e1985aae4267adabf6264502c1ff11bca9e10f1e1229e31b2f46c77c38a4895ee1850193850e130afd4cf32d7476889b9621a14123563056f537e
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
880KB
MD537691c4b8a38e1bdde62373071049e22
SHA1570897cd139febdcbb0036cee7c1702a2fde52f6
SHA2562fd230cc780deaed560d74f61ab1b8d26829366bef1d3a95bce553a6ad353227
SHA51235e2ee567cad19eafa471662631c1c784c4d13e520292dbddfb33384060a61dffe9e1de6a2ed83b0bf40f43396c0c0d05a55f516ca7035690e8066e064e6d79e
-
Filesize
1.7MB
MD5a3238956a9ff6eab99493e126762bdc2
SHA145cd641ded64afee4f73a2c0ac86c102f3ed06f0
SHA25687ec0501cc2cc74bf386ed9fa12dabd82e5e50872b4ca22c4145c88b603bb6b9
SHA512816e3609808e6fdc00715b1807f3a02949ffb01bb1ed7affab54f5ff5b2cb7770db9e2a1a641c5de7126c30729f09f9fbd79f088e695ed7e0d365200d70e963f
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce