Malware Analysis Report

2024-10-16 03:51

Sample ID 240509-v1ktxsdf5x
Target red.zip
SHA256 62bdf7c8bc61b7d1bd73ccc8685e220edf33b9a5ba1ab3c192a61c31da9b1a9f
Tags
amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan nasa kira darm masha 5345987420 discovery lamp naher krast
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

62bdf7c8bc61b7d1bd73ccc8685e220edf33b9a5ba1ab3c192a61c31da9b1a9f

Threat Level: Known bad

The file red.zip was found to be: Known bad.

Malicious Activity Summary

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan nasa kira darm masha 5345987420 discovery lamp naher krast

Modifies Windows Defender Real-time Protection settings

Healer

Detects Healer an antivirus disabler dropper

SmokeLoader

Amadey

RedLine payload

RedLine

Windows security modification

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Enumerates connected drives

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 17:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2800 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe
PID 2800 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe
PID 2800 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe
PID 1080 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe
PID 1080 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe
PID 1080 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe
PID 2596 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe
PID 2596 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe
PID 2596 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe
PID 2596 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe
PID 2596 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe
PID 3284 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3284 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3284 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1080 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe
PID 1080 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe
PID 1080 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe
PID 2308 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2308 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2308 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2308 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 828 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2800 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4141905.exe
PID 2800 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4141905.exe
PID 2800 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4141905.exe

Processes

C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe

"C:\Users\Admin\AppData\Local\Temp\349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4141905.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4141905.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.106:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 106.196.17.2.in-addr.arpa udp
BE 2.17.196.106:443 www.bing.com tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5387046.exe

MD5 f5502d1fd0d40c98c45d2ee9da187c62
SHA1 e3b3c127ee3eef836c1cdbbd78c856e119dc6835
SHA256 18ddce55ed9d55c6768e99919ee48b16a52f74f47d442d21dc356287f48ce580
SHA512 1a9095764b6e160d4d556fe4fa152c4d1e9ce879667afe965db7e456efb864953230ba93d6b94505e23a3cdb2b832f75a28bde2c302490a88e44081a81068401

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7754411.exe

MD5 32a9d9cb6eaa27a01e00d1e599e4d8eb
SHA1 4deaac4ec28b0b16e62ad3351a8ef94e2262aeb2
SHA256 9ce254fdb9957862f3772db8ecdd9de9ad812a445429b17e67966d3b0df75bdf
SHA512 82da9b57e04db90518285bcd5a048bedb55a00060221cbb9472ac6e70d6adc49edfbdcc495bc7a5eb8f085cd72d8ab91ca474b3966eb5457062791e3e94e5b24

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4079614.exe

MD5 df7d3ca01950e6fc969bb6a665bfa3da
SHA1 47edb3679e09562e022bcf0e53daa9a6a1632e87
SHA256 e84f4b87c97d69e76f2cb2265722ef05ee17c09e4a4d93f4653ec1db103b55de
SHA512 e1b5edadca2aec99c0f18339ae101b303d7e5ad0946e127b146ce8439ffd02418617b0814923a0993f444495829ca462a4968826511b9312a74e9ec55342f732

memory/2820-22-0x0000000000F20000-0x0000000000F2A000-memory.dmp

memory/2820-21-0x00007FFD9E1F3000-0x00007FFD9E1F5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2744914.exe

MD5 640540ca721f898b80351f6728cdcc76
SHA1 3b98fae8f749c66250aa45ccc340bdf1c371e034
SHA256 02bfcdf7cef126b21bf5180d103a2c9e9780a56be4098455e5f1dff9244c3bf1
SHA512 989c2deaf1da5cbd98747c218a1752f1e939cc4515e8755edf403f4fef8a235eb76e28f300e27969592e4f5811360843c13c8a9b00776cdbf82cd8d4f222c67c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7542534.exe

MD5 e597a3d07e6903050787f1072f10a6dc
SHA1 8ea85d67ed2403911daf281ff95baa0572260184
SHA256 7238a50b59ebc1fe90886a612a4656b6ea163404857953fea445fd6673465d44
SHA512 e043e951feaf6fee2fdf42664cb18d378930ad863e602f38b44d21a69b71cad3f4a3bf236570eb5a4dafeafd89c6c5b7e49316365c51c703875deca5c50c69ca

memory/4768-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4141905.exe

MD5 e340fad4dd399e544a644571b66aca10
SHA1 71d1cbc808265a352ce63bd74a9b25abb12cf5c0
SHA256 dc992ad80deb9bfa48b0ff758d0c52b32549a7652b41f0df9c414139d72f52ae
SHA512 bdd68036e5485aecaf15fa305665eaa9ad68c7f81eb94ec976db10358b7971d7537bd094d1cc10f7f01b25145b3c94c287075bb22df439e7f885360f6bccf74d

memory/4956-45-0x00000000006E0000-0x0000000000710000-memory.dmp

memory/4956-46-0x0000000005000000-0x0000000005006000-memory.dmp

memory/4956-47-0x000000000AA40000-0x000000000B058000-memory.dmp

memory/4956-48-0x000000000A550000-0x000000000A65A000-memory.dmp

memory/4956-49-0x000000000A490000-0x000000000A4A2000-memory.dmp

memory/4956-50-0x000000000A4F0000-0x000000000A52C000-memory.dmp

memory/4956-51-0x0000000004A00000-0x0000000004A4C000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5116 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe
PID 5116 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe
PID 5116 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe
PID 1960 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe
PID 1960 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe
PID 1960 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe
PID 1960 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe
PID 1960 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe
PID 3908 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 3908 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 3908 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 5116 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe
PID 5116 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe
PID 5116 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe
PID 1436 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 1436 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 1436 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 1436 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 1436 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 3164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 3164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 3164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 4360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 4360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 4360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4776 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe

"C:\Users\Admin\AppData\Local\Temp\4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.105:443 www.bing.com tcp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 105.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4763657.exe

MD5 d9607af6726ade173eff154940caf1b6
SHA1 d083816e1455d9b2964d007c9344f8739a26952a
SHA256 0d7b7b2df1c4380d28f39f6d1bf4574c393658df66eb6ae7e4da82556bf3d9a4
SHA512 94cf37a2428dab11a6678987787e84cf67314aa74a5dff6b1457be180c3b7c0cf59371a538c2be4e20af34177c533d911008baf10067e610a46affb5620e289c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1280327.exe

MD5 e3e75031d0e39505ed432a196cc418f5
SHA1 13fad2d1ed1a5d2d47397a3d7ee024061bc3a690
SHA256 0b7746585a83c221a064e3a81bd9885cdbb10de4bf3f3d0fd44421ecce838c48
SHA512 a46b44977b3e58e07ef67945ef72980d8fe5bceaf86f86e27173f6c96d4bda5cc8d8ddeac90eb417ee17427afba414abe570f26d18aee525fa8802eb64a2855a

memory/3228-15-0x00007FF9F0CD3000-0x00007FF9F0CD5000-memory.dmp

memory/3228-14-0x00000000007C0000-0x00000000007CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1561163.exe

MD5 eb3b429d21756dbe557fc8bcd82f4d64
SHA1 e621b5506d1d54d5fadef00aba0985d157e4b3fb
SHA256 779ef2f7698e7d637ff300bab9f7180aa4381bf7889d29dfc596a9298fa33887
SHA512 7209c8d47d7923841002af9b9517fa14b375fb4f4dce238d12091e1ef8baf47215f30762e24f4e0a479454a95d105e060ac70227baabfc72ca7cf2355f03b3e4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1649035.exe

MD5 6031d2b63a9ba8752c1f761f764435a8
SHA1 ccbe4b4cc1ca749608ad0b5a9ba77b66e414cede
SHA256 c4d3bee83333cdf60f6d329c2583643db4439db62583a5fa2d4eff17a1ae13e3
SHA512 9fe233a0c6f44ad8ff160c007c6d81484e9afffdcbc707285594f9965821a961fe28754b4da2f5e34884abadbf00f5b347825450541d199700de9ff94b2c7bd8

memory/868-33-0x0000000000010000-0x0000000000040000-memory.dmp

memory/868-34-0x0000000002210000-0x0000000002216000-memory.dmp

memory/868-35-0x0000000004FA0000-0x00000000055B8000-memory.dmp

memory/868-36-0x0000000004A90000-0x0000000004B9A000-memory.dmp

memory/868-37-0x00000000049A0000-0x00000000049B2000-memory.dmp

memory/868-38-0x0000000004A00000-0x0000000004A3C000-memory.dmp

memory/868-39-0x0000000004A40000-0x0000000004A8C000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2792 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe
PID 2792 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe
PID 2792 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe
PID 2408 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe
PID 2408 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe
PID 2408 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe
PID 2408 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe
PID 2408 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe
PID 116 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 116 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 116 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2792 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4445439.exe
PID 2792 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4445439.exe
PID 2792 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4445439.exe
PID 4120 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4120 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4120 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4120 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 3220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 3220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 3220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 3492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 3492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 3492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1368 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe

"C:\Users\Admin\AppData\Local\Temp\56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4445439.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4445439.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.106:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 106.196.17.2.in-addr.arpa udp
BE 2.17.196.106:443 www.bing.com tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3171866.exe

MD5 b435d6b953887f7a798aa82a97d2735e
SHA1 040f703a0203cf23702c6ff96b85a39654006505
SHA256 39b691839692b9cef4a116a81e30b4bee8cbc04bc169366c90a6338d14af3389
SHA512 a36150b1c22144d4e38d58c3574e45c59a6126185ec847b6c2282d4930b8a097e8e162e5af01c5f761e5510dafb855d7d6bcabe2801ec0852a75fb88c0a66379

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7056513.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3416-15-0x00007FFF521E3000-0x00007FFF521E5000-memory.dmp

memory/3416-14-0x0000000000330000-0x000000000033A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3459085.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n4445439.exe

MD5 ec5686f2f6eef77856a46505325aea33
SHA1 a58594f313adbd048b0ff2ac4e42603db57313ef
SHA256 f3cea04ccce7d837e9a850e3c82c83465828d18f1ddceb862a2cc411927a8874
SHA512 033857263c6ba7a1a5df2b441cb43c8e1d516eb5f298c76c00fdce7b7735e76921b5249d820f676355a7a0237f40af35497367d1319732b6629ab609ff154e08

memory/1200-33-0x0000000000580000-0x00000000005B0000-memory.dmp

memory/1200-34-0x0000000002870000-0x0000000002876000-memory.dmp

memory/1200-35-0x00000000056C0000-0x0000000005CD8000-memory.dmp

memory/1200-36-0x00000000051B0000-0x00000000052BA000-memory.dmp

memory/1200-37-0x0000000004F40000-0x0000000004F52000-memory.dmp

memory/1200-38-0x00000000050E0000-0x000000000511C000-memory.dmp

memory/1200-39-0x0000000005120000-0x000000000516C000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2028 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe
PID 2028 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe
PID 2028 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe
PID 2632 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe
PID 2632 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe
PID 2632 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe
PID 2632 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe
PID 2632 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe
PID 3332 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 3332 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 3332 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2028 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6843467.exe
PID 2028 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6843467.exe
PID 2028 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6843467.exe
PID 1088 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 1088 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 1088 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 1088 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 1088 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 1088 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 4448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 4448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1828 wrote to memory of 4448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe

"C:\Users\Admin\AppData\Local\Temp\cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6843467.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6843467.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 96.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0798013.exe

MD5 c03d312eeb1d42c54d575ce2544db58f
SHA1 533fb59e9eb485f466b6418016c11cf53fc98651
SHA256 eee860edc0a46d95f673410539e9ed97da5b03f553db85701b27f22964d7e694
SHA512 de2bb3681680e5b3d6468d0fa244e3e8ed3c621e3d631bec1eea656e369300e3956955cf2d24182f2e4cbbec97319f7b89b978b0dd5727d0d286598d4404a32e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0352502.exe

MD5 eb6dde3a48ab63c370fd9090fbff0205
SHA1 006c301e02e14656fe715d31878f0e35180b2bf1
SHA256 22ea650c2f7b591af30b35254d3182c2c05ee6b7e87c64166dec754cbcac2a0a
SHA512 e47e3e41b548ee3ed9476d12bc9e6d15bc8d7e02416eac3c3d131c01aa27728bb82c61df94e39c2983c36fd9b0363232634680c88e0acf630d39e48d73062e2f

memory/2296-14-0x00007FFF0EED3000-0x00007FFF0EED5000-memory.dmp

memory/2296-15-0x0000000000660000-0x000000000066A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8904991.exe

MD5 b61c79541c3cb7fa2d9a1477a6e00fa9
SHA1 6922fb1416d8baae120d0b4074d4fa106a76660d
SHA256 59016e2c510ffb82cf55fea555cbd5c94cbe07f3b0271d94dd99427895f8d7c4
SHA512 cbb775f34031bb132e5b958d48b77553198b734f5db92456a5a529447adfd26f62316bd5a80a908e85c90993753040242ad9dc374804f4e2520463e75a08a69b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6843467.exe

MD5 6390dd7a0d60c983dd05fa60aeb1f9cb
SHA1 268d47d67b1f545435410ce837d0b026cb1e2db7
SHA256 7777365f08e05d503df21ec590de6d7d29abfcaff212fc47ff2dbcee2ea9e50e
SHA512 eff8412cc54c02d2f72fed097773719d439c4979b3fca2d16507b476c3c3888b5c31bd38adec504ee60a751ed4eb00f80f928b96b83e65b515aee87ea4129356

memory/756-33-0x0000000000F90000-0x0000000000FC0000-memory.dmp

memory/756-34-0x0000000003240000-0x0000000003246000-memory.dmp

memory/756-35-0x0000000005EE0000-0x00000000064F8000-memory.dmp

memory/756-36-0x00000000059E0000-0x0000000005AEA000-memory.dmp

memory/756-37-0x0000000005920000-0x0000000005932000-memory.dmp

memory/756-38-0x0000000005980000-0x00000000059BC000-memory.dmp

memory/756-39-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4056 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe
PID 4056 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe
PID 4056 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe
PID 1020 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe
PID 1020 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe
PID 1020 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe
PID 1020 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe
PID 1020 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe
PID 1020 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe

"C:\Users\Admin\AppData\Local\Temp\ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1356 -ip 1356

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 152

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.152:443 www.bing.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 152.196.17.2.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
BE 2.17.196.152:443 www.bing.com tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6497315.exe

MD5 347fa3300c887f6ed7b1a13377bb28bd
SHA1 f7290c370763737aa41f0bc92d66b2423647815c
SHA256 8ecc876c0ce1dc9774cb4ee93fbcd638c9182cd5c33e4a7aee74bbc39bd75cc4
SHA512 e17a78db324fd6bd80872c92fd6c03f0308b20c256d9a42cec304f21f13df2f0c6069ba95998d525e39b6e99040d07baaabf60015ab4ff88344e5d222c0cc341

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0077088.exe

MD5 3afbc821636e1e7951821231f0cdc4bc
SHA1 d962f7454a83bdeb81b16476055773c65090c068
SHA256 b05287fda0d66708df3d5a927caeb62a87e8809fb992871a5615a3c62ce1eeff
SHA512 4b74ca6740b4a8cf7d6bf4a54e64cbf564f42443d4b23d824feb661a8945a7a1a08fb6428afb8a8af7646607b5edc1af9d4c7aea8aac341965dbbf220db86eba

memory/1356-14-0x0000000000401000-0x0000000000402000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7490768.exe

MD5 ed78531c3da44f95b5e5f7aa280bf586
SHA1 a9e403fcbf3a8020cb51d8f3a406c74775936c2d
SHA256 d996d9ed8e0931fe6f414b91b0d4f52fc6b80a8493829f63fdd44cbf9afea60e
SHA512 7649d4ceb7cf0771ed8905dbff16e74b117b0ced16f94026d457a6534a10f39c91da18bd986fd66ded33d9c2c4ef501e7c895760418b39361089f196bbdb6970

memory/3532-18-0x0000000000400000-0x000000000043A000-memory.dmp

memory/3532-19-0x0000000000530000-0x0000000000560000-memory.dmp

memory/3532-23-0x00000000023F0000-0x00000000023F6000-memory.dmp

memory/3532-24-0x000000000A4F0000-0x000000000AB08000-memory.dmp

memory/3532-25-0x0000000009EE0000-0x0000000009FEA000-memory.dmp

memory/3532-26-0x000000000A020000-0x000000000A032000-memory.dmp

memory/3532-27-0x000000000A040000-0x000000000A07C000-memory.dmp

memory/3532-28-0x0000000004430000-0x000000000447C000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8333830.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8333830.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8333830.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4388 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe
PID 4388 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe
PID 4388 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe
PID 1780 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe
PID 1780 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe
PID 1780 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe
PID 2344 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe
PID 2344 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe
PID 2344 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe
PID 4816 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe
PID 4816 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe
PID 4816 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe
PID 4816 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe
PID 4816 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe
PID 2344 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0323673.exe
PID 2344 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0323673.exe
PID 2344 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0323673.exe
PID 1780 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe
PID 1780 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe
PID 1780 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe
PID 3128 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3128 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3128 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4388 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8333830.exe
PID 4388 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8333830.exe
PID 4388 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8333830.exe
PID 5100 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 5100 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 5100 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 5100 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 5100 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 5100 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 1848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 1848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 1848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 4644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 4644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 4644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2928 wrote to memory of 3972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 3972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 3972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2928 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe

"C:\Users\Admin\AppData\Local\Temp\eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0323673.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0323673.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1568 -ip 1568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 572

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8333830.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8333830.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 2.17.196.106:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 106.196.17.2.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4912672.exe

MD5 6c0d47fa8a9400d2ab02c92cb939d4be
SHA1 3301818aad302ceb9ece4912db4a68ceaefbd2d2
SHA256 be062d6ab948061ae69c5b3daa74e1ba65c9d808c0d4f66ceaa4c32a49a0f524
SHA512 2f37a8ddb09aedc6fbaa9194d434f727840d9021b48cc1ab8f92d9aef7a3ddc979f721710033c6fc7d198e45325c7e6870a919e01c0a300c319ec791c9bb77fd

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2606131.exe

MD5 5a1a774a5e54a905f0f99418b14a9f67
SHA1 bb0ca35d6c19261cc71562381f7e7b0d0917f033
SHA256 5c28c68dd4dab5c823f5e985c9aad0521d701dde5bab6c6524f09ce7639e51c2
SHA512 a8c9ecc26514b6f531cb5271ca69a515abe477d833eff4d0f1fa851e0ffc9042eb58c3fd22ec066deb88bf560b352517c6ef4e50dfcdd49e96f7e8bb716e0560

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7242091.exe

MD5 4870e240aa10c59dbf3dd0b63f02401c
SHA1 73b9bbeb6e24aabe9943cd7e1ac8effcc8f16f8e
SHA256 7d5110bcc343d5026c635a3d54c76fa6675b263fb5246d05bf7bb96864a2b561
SHA512 0d8d2572b500f52ce93b35db9f5e918e306b0b2a450859da75aa42a7679d91cb5ac2ace7ac7838d7c1168fc323338104a300d1fd66d650fd03f24ac2e1731bca

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8749467.exe

MD5 ba8750c3ee2f96f8306237566e458f5b
SHA1 962ae41e251e20d254736e63bcf1ffd6827d5456
SHA256 288f9868f3b220584aa23161b5c1b671fff728ab36635ae8ce0a1721e7ef30c4
SHA512 abfd5f9269bd7a04739661cd067307f195c5c8ffc8db8378d914f5fd18d6a6e6a8c51a509ba8c81b677fcf5fbe85ee9c352379fb293f39ac54696e98e459f530

memory/3200-29-0x0000000000500000-0x000000000050A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b1637171.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2120-37-0x0000000000D00000-0x0000000000D0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0323673.exe

MD5 47f39c4ad52ef8534ac3964d5c2aba92
SHA1 4ab09d010b5ae8cd1f00f260c339f0ad7f86d8b8
SHA256 a0f1a7cb66e8a078ad2a0d1b94e3f2f3657d04454a2eb9d389788a7c9654506d
SHA512 11c725de1cf294a73d7ef1565978887c62a52dcbf7af519254a078ff2d2dadf7722c6db0bc9712298a404773813ebc1c9f960c8e6a958ad492765028893b8103

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6555583.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e8333830.exe

MD5 35a15fad3767597b01a20d75c3c6889a
SHA1 eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA256 90ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512 c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577

memory/416-58-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9733772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1340199.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9733772.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe

"C:\Users\Admin\AppData\Local\Temp\067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9733772.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9733772.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1340199.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1340199.exe

Network

Country Destination Domain Proto
DE 217.196.96.56:4138 tcp
DE 217.196.96.56:4138 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
DE 217.196.96.56:4138 tcp
DE 217.196.96.56:4138 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
DE 217.196.96.56:4138 tcp
DE 217.196.96.56:4138 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9733772.exe

MD5 7bc2d05ad6c8a97ba0e72e08fea76c33
SHA1 34ca4cd11a85d4c4e347e0a3e14bbbce06a52b8a
SHA256 d637403a7a8d4f4e55e3bd56e000ee3668faae9137eaa6efbcd8dfdcc4744709
SHA512 d904d036c3348d6171810adc02588990dc349f6cf8a79f95466b1e4d64bc0ca3dad17de0868260bf66db36b2cc5cdf4ba4437a1833671ab7bc2ed7079e55feb2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1340199.exe

MD5 1713407b17523d6fc4e5bb0c8224dc99
SHA1 a7d93f158db51fdae389110c4db7a09ac8e47857
SHA256 f56b8bee3041e40eb529a840f8eee89a536c282e29c5df448d6eee87bc87eda7
SHA512 dbd31ce690b92202ff507140a215abcb0f9f580afd288d2ac684233b67cc4f0d26d150c6e2986ccaba93f858cf62ee7ff455fc464ff5dc93725d7246e8d6c43b

memory/3500-14-0x00000000748CE000-0x00000000748CF000-memory.dmp

memory/3500-15-0x0000000000780000-0x00000000007B0000-memory.dmp

memory/3500-16-0x0000000004FA0000-0x0000000004FA6000-memory.dmp

memory/3500-17-0x000000000AAC0000-0x000000000B0D8000-memory.dmp

memory/3500-18-0x000000000A5F0000-0x000000000A6FA000-memory.dmp

memory/3500-19-0x000000000A520000-0x000000000A532000-memory.dmp

memory/3500-20-0x000000000A580000-0x000000000A5BC000-memory.dmp

memory/3500-21-0x00000000748C0000-0x0000000075070000-memory.dmp

memory/3500-22-0x0000000004A80000-0x0000000004ACC000-memory.dmp

memory/3500-23-0x00000000748CE000-0x00000000748CF000-memory.dmp

memory/3500-24-0x00000000748C0000-0x0000000075070000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe
PID 2396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe
PID 2396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe
PID 1852 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe
PID 1852 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe
PID 1852 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe
PID 4920 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4920 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4920 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1852 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe
PID 1852 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe
PID 2604 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2604 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2604 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2604 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 5020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 5020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 5020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 5044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 5044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 5044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 3940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 3940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2944 wrote to memory of 3940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2396 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1745375.exe
PID 2396 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1745375.exe
PID 2396 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1745375.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe

"C:\Users\Admin\AppData\Local\Temp\5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1745375.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1745375.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
FI 77.91.68.61:80 tcp
BE 2.17.196.152:443 www.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 152.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
BE 2.17.196.152:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2794570.exe

MD5 d4305dc5e8d35eeb197f0ba8bbdd188a
SHA1 8eaadf393b90d903339b3fd2164107895d6ab0a2
SHA256 08e506ca0da42b91d187cfc7005d29be906fd8c12244eb87db3ea6058a238528
SHA512 63abf5b003e7b9bfb10da23b1c8d66fda8e2dfce7f11627790453f6b6631678f8695d3fa5e25f201f520a81e0c6de0ab04444533a4d135ace50eef3e75a3f93a

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0353236.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3896615.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2828-27-0x0000000000F30000-0x0000000000F3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1745375.exe

MD5 27a12dfdd02c7e9f16c1e1f62b855ee7
SHA1 074a6dcedf68a39c3b4b82f514097b06b700c3fd
SHA256 9ea00973b86f0ab682a20e3c77b7af9f4e2309be3910a589aab3c83ba75039b1
SHA512 1935b4ed346569d084d7fd27321904197ade1924fb77f46fc11f97f2edbb3796fb3789f992112809e5c9d5bc5dc8903426a4a34f285f2d7eea0decc732e6c648

memory/2680-32-0x0000000000D80000-0x0000000000DB0000-memory.dmp

memory/2680-33-0x0000000002FB0000-0x0000000002FB6000-memory.dmp

memory/2680-34-0x000000000B1E0000-0x000000000B7F8000-memory.dmp

memory/2680-36-0x000000000AC70000-0x000000000AC82000-memory.dmp

memory/2680-37-0x000000000ACD0000-0x000000000AD0C000-memory.dmp

memory/2680-35-0x000000000AD30000-0x000000000AE3A000-memory.dmp

memory/2680-38-0x0000000005100000-0x000000000514C000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3356 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe
PID 3356 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe
PID 3356 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe
PID 4184 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe
PID 4184 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe
PID 4184 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe
PID 4988 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe
PID 4988 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe
PID 4988 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe
PID 4844 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe
PID 4844 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe
PID 4844 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe
PID 4844 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe
PID 4844 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe
PID 4988 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0607620.exe
PID 4988 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0607620.exe
PID 4988 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0607620.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe

"C:\Users\Admin\AppData\Local\Temp\dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0607620.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0607620.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
BE 2.17.196.152:443 www.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 152.196.17.2.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2384274.exe

MD5 dea8d48570a6cf242e686705d5366155
SHA1 d9673b14317a59c0b3c4d40f91479d96cc25ce45
SHA256 4903f699f8739354bdabec16602287d76f25393efa935a4d39ae7da674358666
SHA512 19485ba2d4cd138ae632ded1ed01aeb444fea5780398cb25fc754da8771ba77f49436d898b23d05cde2b1d58ca44539fc8daf14d4dc4727543c059dd74d65673

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7256150.exe

MD5 146b7099c5884a806e8f819a9aaa6b7d
SHA1 8e92bb549be422d30fde8bac34236aa57aed6773
SHA256 824d07da890962147a3476a815337e841d60ed064b269a53ee19b6a1c3676862
SHA512 6a3aeeb5d39506dd49f26566435c1af762529b37ab1550a493049fb0d16fbe3bf2a4ea182f222242e530aa725792711084691352aa1b376a06a1e938713b9303

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4512196.exe

MD5 a11d85bdc8f6f8adec34b76ba50f0e92
SHA1 59aff71b384589fdbb9a61da4a1b8fd77733b434
SHA256 fbcfdf2126226fcf0775f497d438afa877b06a87aea3aca0766a202ff592a767
SHA512 18447d53187eecca5a198246e2173d80d9de60e5836588389603ef24c58fa11b33cd3459fc2833b783e79b113fc4c704c555b5a85697054ef300b1c403d3da2f

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1880968.exe

MD5 fbb4ddee8fb3844b5f9686bd91fbc6de
SHA1 3fed5342bfea1d77de1fa6a2053e1c895c51550b
SHA256 707b6a7b7d679407ddf194e800bd9c6e211d239a196f384ac6228e30cd71079f
SHA512 c2ef9274e53dea16f34f362ff49e4d7ceff252a14864a5ef8294298c0ac5620ba8c5fde0a46578487516d761e91b7b9592542d6f25cc49744d4a3b8ea568d71a

memory/3316-28-0x0000000000420000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3166025.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3996-37-0x0000000000350000-0x000000000035A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0607620.exe

MD5 9699573ffff38da7f8b9ef26ce81e27c
SHA1 db43ae44cff6b444623b04228161746fa3edfd9d
SHA256 6b4d70ab1a1f37e7f700f9610ce3e986f2ce0734925ad450770cb4f9d30baa21
SHA512 a1596dc3e519908f47962fd88b61d39df4c396991494424f79ae3380e1134bed240085cc486d4da793473af89375375c236095ca0219edf24d5373814d347eea

memory/4304-43-0x0000000000510000-0x0000000000540000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4304-47-0x00000000009B0000-0x00000000009B6000-memory.dmp

memory/4304-48-0x0000000009FD0000-0x000000000A5E8000-memory.dmp

memory/4304-49-0x000000000A640000-0x000000000A74A000-memory.dmp

memory/4304-50-0x000000000A780000-0x000000000A792000-memory.dmp

memory/4304-51-0x000000000A7A0000-0x000000000A7DC000-memory.dmp

memory/4304-52-0x00000000044F0000-0x000000000453C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4564 set thread context of 4156 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4564 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4564 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe

"C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4564 -ip 4564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 360

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
BE 2.17.196.152:443 www.bing.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 152.196.17.2.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BE 2.17.196.152:443 www.bing.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp

Files

memory/4156-0-0x0000000000400000-0x0000000000422000-memory.dmp

memory/4564-1-0x0000000000051000-0x0000000000052000-memory.dmp

memory/4156-2-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

memory/4156-3-0x0000000004FA0000-0x0000000005006000-memory.dmp

memory/4156-4-0x0000000005A70000-0x0000000006088000-memory.dmp

memory/4156-5-0x00000000054E0000-0x00000000054F2000-memory.dmp

memory/4156-6-0x0000000005610000-0x000000000571A000-memory.dmp

memory/4156-7-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/4156-8-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

memory/4156-9-0x0000000074C30000-0x00000000753E0000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240508-en

Max time kernel

127s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2944 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe
PID 2944 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe
PID 2944 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe
PID 1148 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe
PID 1148 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe
PID 1148 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe
PID 3772 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe
PID 3772 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe
PID 3772 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe
PID 3296 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe
PID 3296 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe
PID 3296 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe
PID 3296 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe
PID 3296 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe
PID 3772 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4075312.exe
PID 3772 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4075312.exe
PID 3772 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4075312.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe

"C:\Users\Admin\AppData\Local\Temp\1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4075312.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4075312.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
BE 2.17.196.106:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 106.196.17.2.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6210097.exe

MD5 e4759911e541d7a543ea033b0928ddf4
SHA1 e39c427a6cf47b16cddabfd2c7fb00038e1dbe1f
SHA256 f8dfa98c4e38deff7955c243f9db7b01692e43c0997eca9e5e141cc565cf05be
SHA512 7760d634d8a8b0a2e2c9847c4c367589607de2d7ac43112830289dbf3585902dd0f824ebfcab04040f701afa6b86884824aed2f032e6c09714ac8575b7bf9e42

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9238337.exe

MD5 f4f787db36502a2e05f39da6a313e914
SHA1 4f842c75ce854d86420f9790c47c81bdcecd7c5d
SHA256 3df74027fece0dd6e6c9f46260e3c886ecbcfd4dce43ac64a90f1211d78fe588
SHA512 0728509f9668750a075e73175e48f90625f5e62ef3d1e95641d654d43f749dacb1012110c6e445aa64308a64b0d23c447041ab0ec994300a6b06a1091523d52b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3931201.exe

MD5 a11dbc01603450452854f17aa7ea1eef
SHA1 18436f7c4a7a4477c0baa93ddc108babce9491bf
SHA256 2d2e176ff101b33e0adec2558415b76c1425ba9502c4b652c64b4751dd11181c
SHA512 1ac3b35ac7b8742c8eded217595f30ae25eff216409bddd3cc18809ff6e5d873c7feae6e1e3501dc02bebe2205f9f9e8db9718c76315b679ca8ce73aca2135bf

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2651355.exe

MD5 175e3db636d9fd541cc11991815ea662
SHA1 c5e30c78f298c1aa26768bc036795e19ed7e60d7
SHA256 c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e
SHA512 06b1bc8a9746e8dfd1a4d72e98b8b76a1f543ae0c72c9e0233dce81451d7521f586da373e69459170a8d9442da4883f8247cfb9714227744c765c892583ac5c9

memory/4528-28-0x00000000006B0000-0x00000000006EE000-memory.dmp

memory/4528-34-0x00000000006B0000-0x00000000006EE000-memory.dmp

memory/4528-35-0x0000000002490000-0x0000000002491000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7896309.exe

MD5 06d9b8f9236b959006976da775fea5e7
SHA1 46d5c5e6a3e7de6138cd764509a6754ce24d9484
SHA256 77353ead4144432dfd0e8fc833c458c8b88fb5d6bf7c9818ac430be40983b7f5
SHA512 ec0c6135f2b39d70cb35bd713d5fd9a0876055b46584f3535067f0f162be149024770c990e61ee041eabe5d3daf53aac49e747bb96189c3fa17346774a5edc6d

memory/4276-41-0x0000000000E10000-0x0000000000E1A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4075312.exe

MD5 dd10174f7fa3d017558c8310bf07d851
SHA1 08d795a3d2334906da989e46a7e57d4ba9aa9f41
SHA256 cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604
SHA512 a714e8babdc8d8a0a9f8e6ef6430d4f1cde70d3d80a902a1e247eb93bdf76e91fa89c4132708e0c632469b725c625ae65e30a908f02018f10b23460a02ec9d05

memory/4780-46-0x0000000002020000-0x00000000020AC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4780-53-0x0000000002020000-0x00000000020AC000-memory.dmp

memory/4780-55-0x0000000002260000-0x0000000002266000-memory.dmp

memory/4780-56-0x0000000007300000-0x0000000007918000-memory.dmp

memory/4780-57-0x0000000006CE0000-0x0000000006DEA000-memory.dmp

memory/4780-58-0x0000000006E10000-0x0000000006E22000-memory.dmp

memory/4780-59-0x0000000006E30000-0x0000000006E6C000-memory.dmp

memory/4780-60-0x0000000006EA0000-0x0000000006EEC000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2120 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe
PID 2120 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe
PID 2120 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe
PID 3188 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe
PID 3188 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe
PID 3188 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe
PID 3700 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3700 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3700 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3188 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe
PID 3188 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe
PID 3944 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3944 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3944 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3944 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3944 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3944 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 4744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 4744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 4744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 1896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 1896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 1896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 4188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 4188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2304 wrote to memory of 4188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2120 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2087279.exe
PID 2120 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2087279.exe
PID 2120 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2087279.exe

Processes

C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe

"C:\Users\Admin\AppData\Local\Temp\59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2087279.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2087279.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 96.196.17.2.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8665889.exe

MD5 63d9a22d700ce9c714aa0d465728b943
SHA1 e6b90e0a767c65c630eb2dcf016c99608601cc45
SHA256 31cc48ae436597f1580485cfeefc44641b9a32ed1d1ab66a1aa4c99f089d8ce9
SHA512 cbefe1b911475c689d768a60b2f75f1ddb629f0d5dcb2747ec764e372f728e719e218459c341d96c9af650c68c401e8a83279c98d4c229fa7bebd3f047b116e5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5798448.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1259467.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/964-27-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j2087279.exe

MD5 76699b92c2c551112da1ccbcc32539d1
SHA1 e8975f08845150505619c1accaa40d0a074ac37c
SHA256 8b75aca063567d2dddd348262e9d5e19874077645d642d17839dc69939a98b18
SHA512 cef1b307f5c29aece6c6224623a52d094b74a682d0b9b8fc29ee4c45ebfd3fe058fb5acd21f9996e76b4e982cfa222479268fb37c32480ec1f8eba84ebd97fd0

memory/5076-32-0x0000000000A50000-0x0000000000A80000-memory.dmp

memory/5076-33-0x0000000002D80000-0x0000000002D86000-memory.dmp

memory/5076-34-0x000000000AF00000-0x000000000B518000-memory.dmp

memory/5076-35-0x000000000AA00000-0x000000000AB0A000-memory.dmp

memory/5076-36-0x000000000A940000-0x000000000A952000-memory.dmp

memory/5076-37-0x000000000A9A0000-0x000000000A9DC000-memory.dmp

memory/5076-38-0x0000000004DC0000-0x0000000004E0C000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2476 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe
PID 2476 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe
PID 2476 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe
PID 2964 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe
PID 2964 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe
PID 2964 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe
PID 5096 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe
PID 5096 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe
PID 5096 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe
PID 5096 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe
PID 5096 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe
PID 5096 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe
PID 3640 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3640 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3640 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2964 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe
PID 2964 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe
PID 560 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 560 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 560 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 560 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 560 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 560 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 4168 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 4168 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 4168 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 1000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 1000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 1000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1580 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2476 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe
PID 2476 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe
PID 2476 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe

Processes

C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe

"C:\Users\Admin\AppData\Local\Temp\74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 1648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 136

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.106:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 106.196.17.2.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3719888.exe

MD5 413b60f6a17f654b0b189ee9e2958cc1
SHA1 7bdc8dff90952c2235e8e30b09c1b19f74522cec
SHA256 44e183018766f53bad57022988f261e79d339d03488a90d9da19941481b20006
SHA512 16ea6bbe9d4e1985aae4267adabf6264502c1ff11bca9e10f1e1229e31b2f46c77c38a4895ee1850193850e130afd4cf32d7476889b9621a14123563056f537e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3917601.exe

MD5 37691c4b8a38e1bdde62373071049e22
SHA1 570897cd139febdcbb0036cee7c1702a2fde52f6
SHA256 2fd230cc780deaed560d74f61ab1b8d26829366bef1d3a95bce553a6ad353227
SHA512 35e2ee567cad19eafa471662631c1c784c4d13e520292dbddfb33384060a61dffe9e1de6a2ed83b0bf40f43396c0c0d05a55f516ca7035690e8066e064e6d79e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4278858.exe

MD5 a3238956a9ff6eab99493e126762bdc2
SHA1 45cd641ded64afee4f73a2c0ac86c102f3ed06f0
SHA256 87ec0501cc2cc74bf386ed9fa12dabd82e5e50872b4ca22c4145c88b603bb6b9
SHA512 816e3609808e6fdc00715b1807f3a02949ffb01bb1ed7affab54f5ff5b2cb7770db9e2a1a641c5de7126c30729f09f9fbd79f088e695ed7e0d365200d70e963f

memory/1648-21-0x0000000000401000-0x0000000000530000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4971332.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7880167.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3988-38-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1498581.exe

MD5 10d43f9f5c1b584e1e44238222b31622
SHA1 25fd2b7ad514885d8edcb248d0ceb13c94736e7c
SHA256 701e9f376908966bc245ee6400a23fa241dedcc92e050a1e97287485ef88dfcb
SHA512 25d164ff16ee6fb3052eb3e27e1fbf51987bfc04ee274dc1254adc599bfe6dcb155f3aff9a63e1d39a653dd3ec4e6dccc1deb7f31b7bbf77ce6ba488926e8e63

memory/4720-43-0x0000000000EA0000-0x0000000000ED0000-memory.dmp

memory/4720-44-0x0000000005800000-0x0000000005806000-memory.dmp

memory/4720-45-0x000000000B330000-0x000000000B948000-memory.dmp

memory/4720-46-0x000000000AE50000-0x000000000AF5A000-memory.dmp

memory/4720-47-0x000000000AD90000-0x000000000ADA2000-memory.dmp

memory/4720-48-0x000000000ADF0000-0x000000000AE2C000-memory.dmp

memory/4720-49-0x00000000031D0000-0x000000000321C000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2992 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe
PID 2992 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe
PID 2992 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe
PID 3480 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe
PID 3480 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe
PID 3480 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe
PID 2448 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe
PID 2448 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe
PID 2448 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe
PID 2448 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3023210.exe
PID 2448 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3023210.exe
PID 2448 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3023210.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a.exe

"C:\Users\Admin\AppData\Local\Temp\ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1352 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3023210.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3023210.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6463558.exe

MD5 1c40f0767b3afcbbe40162e2209e9ea7
SHA1 a559ecd1945339b03e80318b3e5fc5a1743e5be5
SHA256 fc089dab52c3e61ec12bd19365ab4eb37c304c21ce0e0daf4e3dffdf4c32a0cc
SHA512 b74d974f4a923ba359304f7d1f04f79ca35a103e89b652ad51546c147e7dd42b175cffecd565f93c1190d9d0c461a14b25da5b3e3eb9a2e40d8bf956a5b2403e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3231341.exe

MD5 4a42a0c0f1c6cdb18d674bbda1759aba
SHA1 586856be171af6ec0503242fe1894c160588a461
SHA256 a3d63f0a54bc7ba0fa176fd82668f354a96bad04d0ec694f01f0235716cbf212
SHA512 68bbe16a6d420b10872ef212733071f46176d46063446facfb69ff8cdab56cb3b2ac832a5ba2cdafaabd5e9ba0d3374b614e6fa6dae0f0d445300389bdcd467b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6640824.exe

MD5 066823c8ddcfa4b9ba01c446de71af3f
SHA1 e3d2e4d0e4dbdc9a48345587385f61a1795fa857
SHA256 38abefade8dc5549d901c8bb1cdedcf5e8b7840f6e024d2a49d71600055c6150
SHA512 a5215cf324ae0bb0fd95c003a7985e0ec7137ed63a96ed0bd44a05a11d2e0a8b609d54ecad9d5ab2eda3931d0231ae3cbcf0ab7046824d1a425e2ecccf75ea4b

memory/2820-21-0x0000000000401000-0x0000000000404000-memory.dmp

memory/2820-22-0x0000000000560000-0x000000000059E000-memory.dmp

memory/2820-28-0x0000000000560000-0x000000000059E000-memory.dmp

memory/2820-29-0x0000000006BD0000-0x0000000006BD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3023210.exe

MD5 c872ddc430a6d7d695e783130dd4c4f1
SHA1 af818368cf10cd3eb9a364599d8d269bf3c2f8d3
SHA256 bfc4f8c7c20cc73da1bd6c18ec7c47ada80629322e8c6b3769d08c8dc5c75a9a
SHA512 1d45fd346ab6c8194b1acc2d0004c5a21fcca7ee2dd565dcc1ec7435b11893b5777a14a35f784b610fed08db696293056b1c77acbad573ef65b2fac81a9c37d6

memory/3640-35-0x0000000001FA0000-0x000000000202C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/3640-42-0x0000000001FA0000-0x000000000202C000-memory.dmp

memory/3640-44-0x00000000044B0000-0x00000000044B6000-memory.dmp

memory/3640-45-0x00000000049E0000-0x0000000004FF8000-memory.dmp

memory/3640-46-0x0000000005090000-0x000000000519A000-memory.dmp

memory/3640-47-0x00000000051C0000-0x00000000051D2000-memory.dmp

memory/3640-48-0x00000000051E0000-0x000000000521C000-memory.dmp

memory/3640-49-0x0000000005250000-0x000000000529C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win7-20240220-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe

"C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 120

Network

N/A

Files

memory/3036-0-0x0000000000BB1000-0x0000000000BB2000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2556 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe
PID 2556 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe
PID 2556 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe
PID 1928 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe
PID 1928 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe
PID 1928 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe
PID 2684 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2684 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2684 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1928 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe
PID 1928 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe
PID 3668 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3668 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3668 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3668 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3668 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3668 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3568 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3568 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3568 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3568 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 3108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3568 wrote to memory of 3108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3568 wrote to memory of 3108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3568 wrote to memory of 4164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 4164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 4164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3568 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2556 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1568602.exe
PID 2556 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1568602.exe
PID 2556 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1568602.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe

"C:\Users\Admin\AppData\Local\Temp\8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1568602.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1568602.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2466934.exe

MD5 15fb4786a2f674c7576ff4150828ae51
SHA1 71dc0a584da2277291d73acd6862ea5e187d0c10
SHA256 3f6b4f35bbb4e5e4a0af042fa4b811ecc1d56e4f74c435460ee9772b0149743e
SHA512 0211b2529bffb8ca57c01e6505e8af1788db85f7d691b367e1ffa0e4b5b368eb5e7176668cb7e0970ea20f4f1ce51f6ebbecfe1d85b915e393942b0a4b0ae32c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1028562.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3094357.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2464-27-0x0000000000450000-0x000000000045A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j1568602.exe

MD5 45c91a14170a0e302dd52df2938617aa
SHA1 cc88a849ff3e75b46a2a0c4e7a69ede018ec254e
SHA256 1baba3253f3576a5314576f444a3353b4d6c5b34c3e296b8f9fc9d6c8264a1dd
SHA512 70c370676a4d3f7d95f640aa8894573eea2212d8a2b0da1b4a0a8ec3ac90fc23414fe8200feb156f30efceaba994c6ab2082216773a0d284f63d7dacb86f4b06

memory/1712-32-0x0000000000120000-0x0000000000150000-memory.dmp

memory/1712-33-0x0000000002330000-0x0000000002336000-memory.dmp

memory/1712-34-0x000000000A480000-0x000000000AA98000-memory.dmp

memory/1712-35-0x0000000009F90000-0x000000000A09A000-memory.dmp

memory/1712-36-0x0000000009ED0000-0x0000000009EE2000-memory.dmp

memory/1712-37-0x0000000009F30000-0x0000000009F6C000-memory.dmp

memory/1712-38-0x00000000022B0000-0x00000000022FC000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

138s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2068 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe
PID 2068 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe
PID 2068 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe
PID 4976 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe
PID 4976 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe
PID 4976 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe
PID 3160 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe
PID 3160 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe
PID 3160 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe
PID 3828 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe
PID 3828 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe
PID 3828 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe
PID 3828 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe
PID 3828 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe
PID 3160 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0562518.exe
PID 3160 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0562518.exe
PID 3160 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0562518.exe

Processes

C:\Users\Admin\AppData\Local\Temp\91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8.exe

"C:\Users\Admin\AppData\Local\Temp\91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0562518.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0562518.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.105:443 www.bing.com tcp
US 8.8.8.8:53 105.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
BE 2.17.196.105:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5916649.exe

MD5 5f836cd0a466d1f6fb54b97ed10ea2a4
SHA1 26eff1fd46eaa5fcdcc9db884985a1013e920110
SHA256 4a4f34e629883170d53e83df516199725844fdbf54b5c811177fe3ee151f937a
SHA512 cc324decbb12b13d8dd8bcfea8fcc0a22394dabb165c8bbc1cf39f96251447930485cb91fb53dfa73c727c19c9d0f039084e714aa6ce77dd9aa48f299fa9bbb1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7756712.exe

MD5 2aa217a812a6da6e11f73ac16822cd46
SHA1 adeea70f00457facc3a8d52d318a31d771e71ac8
SHA256 3549275cb4ab3c22514aed87b8c97080fa7399c768dd6f6b7d19d38ecd9e72c1
SHA512 5f1d4a2ff481bce9c8f1e5bb798986b41b9e520366b67898c9312e251f309db4cc57bffcdd892ba7cf75adb9d20dcc1fbf29aae0b012fad7313fe7d535141b1c

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7041328.exe

MD5 4fa0fa3d59e0372ce84878f75c9690ab
SHA1 f82a1f60c7fa03ad68bf5c05d7296040dbf15d18
SHA256 9ff5a3cf07c839f702c49c1df67f1844c5a9aca3857c995c47b1157424e7e853
SHA512 4b5635b76e58b032e910101e4b2f1c97b3d818529616ef14507bb5447bb0984c447da72607069f6c5557d05027025a9e7ea129f7a6fa4ce4c8bb89082abe79bc

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a1509017.exe

MD5 392febb1bcb51ffd4a9019f2aa7fba82
SHA1 e9ad51d6043f0ccc93829e084f3e9440d6317a38
SHA256 b1f4801cf9033987a2e212ce20fa18963f4778e116d7f3ca0612991aa7f7e3b1
SHA512 604f67d12926fd55413908b4c0524321001c29ee7bd700bef49e2dbb78ffcc072621fb57310b256a9cd83df9d4133c2313c35fd8fa6344b71bc781b51e9b454d

memory/1124-28-0x0000000000430000-0x000000000043A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7916186.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2024-37-0x0000000000010000-0x000000000001A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0562518.exe

MD5 6554d5224f40cf9745376ba5af3a810c
SHA1 80b906c2048bb49e93bb582aa7a7909945f19b32
SHA256 c25f4bc7e836afc38a45334535515ac5b3a508ac89076b14e0f67272b1003671
SHA512 fa19adc7eef7b7962e9ee81fdcf1815f529b7ff382ce1b2f11fd802365a6b1e96363d9ce4dcac655a92d651012facdf3cac519d07272a83d3fcb063de94a8591

memory/4028-43-0x0000000000450000-0x0000000000480000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4028-47-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

memory/4028-48-0x0000000004BF0000-0x0000000005208000-memory.dmp

memory/4028-49-0x0000000005220000-0x000000000532A000-memory.dmp

memory/4028-50-0x0000000005360000-0x0000000005372000-memory.dmp

memory/4028-51-0x0000000005380000-0x00000000053BC000-memory.dmp

memory/4028-52-0x0000000005420000-0x000000000546C000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240508-en

Max time kernel

125s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4464 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe C:\Windows\SysWOW64\cmd.exe
PID 4464 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe C:\Windows\SysWOW64\cmd.exe
PID 4464 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe C:\Windows\SysWOW64\cmd.exe
PID 1192 wrote to memory of 4712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1192 wrote to memory of 4712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1192 wrote to memory of 4712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4712 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4712 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4712 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1192 wrote to memory of 4792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1192 wrote to memory of 4792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1192 wrote to memory of 4792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1192 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
PID 1192 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
PID 1192 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
PID 2760 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe C:\Windows\SysWOW64\msiexec.exe
PID 2760 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe C:\Windows\SysWOW64\msiexec.exe
PID 2760 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe C:\Windows\SysWOW64\msiexec.exe
PID 4608 wrote to memory of 2532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4608 wrote to memory of 2532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4608 wrote to memory of 2532 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe

"C:\Users\Admin\AppData\Local\Temp\a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.cmd

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release 2>nul

C:\Windows\SysWOW64\reg.exe

REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic product where name="FiatLink" call uninstall

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe

Setup.exe

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FiatLinkSetup.msi"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 46B418000E8A18F433BA95B1F9B20BFB C

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
BE 2.17.196.106:443 www.bing.com tcp
BE 2.17.196.106:443 www.bing.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 106.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.cmd

MD5 83a8232021f3f7690a57948dd1fd3f53
SHA1 785cab55143c51cf13714c7c3827e0324a767b62
SHA256 5bc380a39e687d214b52d425634db1490a44c4e56ae4be1658275a5282db00f0
SHA512 b9347fb089d2f81f61b40c830a578f47614e48da573ba318b020cc89dcfb65fd50a5dcfdba6e8bf6b5eb914ab441fd461db6ebadfa043b008e92018dee3383a1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CheckNF.bat

MD5 1f4c5332b3e3f7668c6c0fbd730ef6f7
SHA1 f68d224c39e3d472a4cadfbad6f9f3a57ae6f643
SHA256 2f31c813c6d6c132fdfc1c09cf995944170db0a382f799d9dc32c249407e966c
SHA512 df673b727e5853716de4803d2ce98054a46dfdbcfbb7a7523e8fc34aa4c7fbd3354ea5990e6abf511606bf917c3e50e3bb5489a0f10572dd9aa1e9dea23818ea

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe

MD5 a71a3c02f397b830524176f5e7545723
SHA1 d15dfb49314fd2de949b223837b14e9156355122
SHA256 5a8925e95d243ffaeda81be2210fea56fa4e9626484cfadf59da95b485a17ddf
SHA512 a3ba63d54c6afc715bb1e28c90d678ca4f3db6ff8e6a572d984f9c9efaa0fd83a512226aba06a0bf1bdab9780cf922c212b7a9be2e134cec0d395916978b0bb2

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FiatLinkSetup.msi

MD5 7c456cc375ef300f4232063f5d82fc0f
SHA1 3cdb11f579a225b7820250ea3f29ac39b2cecd87
SHA256 d968e60998886a88deed7e9286d4efb90107bc4a068d341cc8b8a2b958720f56
SHA512 13d95cae7ccfcd0d15f383b93f761b059628478f4d851148fc8a78fdadc04bf7f9b9f7cd7240b27acfbc3db5106eb20934093287ba8f22ed13ed07222904c019

C:\Users\Admin\AppData\Local\Temp\MSIE72.tmp

MD5 b05f77f77b0f12c6774adf5b1d039b44
SHA1 cbf3aa9477641cc0fc39fbecf0c3b6ff7dbb8487
SHA256 344efb1f63e5ca99558a5b45e8462188447fef13252213761b61a2825919e410
SHA512 f93470597cb77156188de0f5675ae1e4d9b09f3b2ff744ad43b96fb2418e2452624a128c656fd5b26b435ac5dc8efaaaab52ad5dc9dc03017f67d1438da04305

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

145s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2882788.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe

"C:\Users\Admin\AppData\Local\Temp\ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2882788.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2882788.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4844943.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4844943.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.184:443 www.bing.com tcp
BE 2.17.196.184:443 www.bing.com tcp
US 8.8.8.8:53 184.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2882788.exe

MD5 6de9a950d4a4b7c0332b45a5bd235d01
SHA1 841af90b26f4db62c4b8f90e28338191a6a7f828
SHA256 3259015332b3c7d28f60d87021ad2c8774ee8fecdf700f3955e15f54889187a7
SHA512 5020589a686c79d44bd60222e57d114a395b06e9d2a57d29097c2666ec76a8312558593415f55017d066964c49abe9a45ebd738d761666d1b0d93f1bb1e6ba3b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe

MD5 96a788f0a5be814e86485a5a69530a9f
SHA1 2d3e089f1d1e6bcd963d905e4562b3f463795d85
SHA256 49cb26c4643b21f4e6b5ac16f17256db971437aa4ad718cf747ffe01449a8e34
SHA512 d2f13b86e881b2663e32b77cdc3323c971a42737295766ad575bad1fbc21bf8e7c358e87145acbd092dace56b56c7c76203580b4cdf91afb0346b22cb00ecc0f

memory/3056-15-0x0000000000340000-0x000000000034A000-memory.dmp

memory/3056-14-0x00007FF8C5483000-0x00007FF8C5485000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4844943.exe

MD5 672fb4244fd74cff542f35696bd45875
SHA1 d1849efc41f2d286b13d036ef60417c318caf583
SHA256 b6f9f1e64fdbb0df744bf834291c6fc891188daf93e5630537498cf9c44141a6
SHA512 33b1dc400c253744c08c4506ed95e1d8518e67508e4bd6a5a73cceac4b3c628ec001c20e415b0b1d85764cafb3306b9332f3ac2a046a690d7941ecfdadc1bef5

memory/3876-20-0x00000000004C0000-0x00000000004F0000-memory.dmp

memory/3876-21-0x00000000028F0000-0x00000000028F6000-memory.dmp

memory/3876-22-0x000000000A910000-0x000000000AF28000-memory.dmp

memory/3876-23-0x000000000A470000-0x000000000A57A000-memory.dmp

memory/3876-24-0x000000000A3B0000-0x000000000A3C2000-memory.dmp

memory/3876-25-0x000000000A410000-0x000000000A44C000-memory.dmp

memory/3876-26-0x0000000004930000-0x000000000497C000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2448 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe
PID 2448 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe
PID 2448 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe
PID 4932 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe
PID 4932 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe
PID 4932 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe
PID 1044 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1044 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1044 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4932 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe
PID 4932 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe
PID 3548 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3548 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3548 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3548 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3548 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 2172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 2172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 2172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 3408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 3408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 3408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5056 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2448 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3117914.exe
PID 2448 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3117914.exe
PID 2448 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3117914.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe

"C:\Users\Admin\AppData\Local\Temp\f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3117914.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3117914.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
FI 77.91.68.61:80 tcp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 96.196.17.2.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7661534.exe

MD5 b590de91b098593e9d552d46029e22a0
SHA1 68efe1b06f4ff1415479c9401f6975fe8c5890a3
SHA256 8ccb68574729f8a471c6ba81c8611248a1f3def44181a894a04f7fd2003df361
SHA512 327f417030d7d54732c6687d693192dd95e9f53f0b1fa492fe73aef9668acde1cb5ebceea40a78903642f51a87888b4173adaf7ef21c12e627294d939c0c32cd

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4651268.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6394657.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1012-27-0x0000000000010000-0x000000000001A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j3117914.exe

MD5 1447b4fb4151d764c146112f35fbd3e7
SHA1 9094efd622b29020446376a29f77e58388cde97b
SHA256 a524f189c161620e8ff49b7a6b2b71540a776ce6259e18e8286aa0c8a81beb20
SHA512 d1c81398785b34beb7cb1edab4a602dcbb993d49e43cdd029c21a16283f4f90c4fdb15c70b6adc8cff3d5aed2930298c21888276739c2b6fd9eaaac9c429da76

memory/2788-32-0x0000000000010000-0x0000000000040000-memory.dmp

memory/2788-33-0x00000000022F0000-0x00000000022F6000-memory.dmp

memory/2788-34-0x000000000A380000-0x000000000A998000-memory.dmp

memory/2788-35-0x0000000009E80000-0x0000000009F8A000-memory.dmp

memory/2788-36-0x0000000009DC0000-0x0000000009DD2000-memory.dmp

memory/2788-37-0x0000000009E20000-0x0000000009E5C000-memory.dmp

memory/2788-38-0x00000000043B0000-0x00000000043FC000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-09 17:27

Reported

2024-05-09 17:30

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1332 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe
PID 1332 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe
PID 1332 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe
PID 4528 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe
PID 4528 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe
PID 4528 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe
PID 4528 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe
PID 4528 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe
PID 2204 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2204 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2204 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1332 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5482656.exe
PID 1332 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5482656.exe
PID 1332 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5482656.exe
PID 2192 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2192 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2192 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2192 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 3288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 3288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 3288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 4980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 4980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 4980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 3172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 3172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 3172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 3524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 3524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2372 wrote to memory of 3524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe

"C:\Users\Admin\AppData\Local\Temp\795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5482656.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5482656.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
BE 2.17.196.106:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 106.196.17.2.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
NL 52.142.223.178:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0932119.exe

MD5 edc556bd751be4c21331a62f7cdb4a85
SHA1 a7f116072ee2b0a502ee9b5b3ad2069bfa760291
SHA256 bb05c8d756e41cb57119eb061d6fe683f561205cb9729a24b65c604dd286a50d
SHA512 c91080a951f2d3b89f4aac3073395ed139a692fb3b962ffda3e221bb36e55986ea7c47037d0e78ba11ae58082907dd9a452305454c953ce867f30113bcc45da1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8761760.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/756-15-0x0000000000FB0000-0x0000000000FBA000-memory.dmp

memory/756-14-0x00007FFDB6773000-0x00007FFDB6775000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8864243.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5482656.exe

MD5 d86ee190bbb058c3edb5a4b3194359a0
SHA1 1adaefeead16a49a4f48f682c9083c48577baec9
SHA256 62dfb4ead4cbed0b017ec79d97d69779dcdcde34ed730db7a5a3ff7f5429b56f
SHA512 195e7da8cc4268c73189193a480eab12f650b7efd4b8f22c1bbeafc224534a7a880811693994c84d4a7f0ae689e3f6e30c81e67181d8bdb8bb0c78b66079de3f

memory/2104-33-0x0000000000830000-0x0000000000860000-memory.dmp

memory/2104-34-0x0000000005010000-0x0000000005016000-memory.dmp

memory/2104-35-0x0000000005790000-0x0000000005DA8000-memory.dmp

memory/2104-36-0x0000000005280000-0x000000000538A000-memory.dmp

memory/2104-37-0x00000000051C0000-0x00000000051D2000-memory.dmp

memory/2104-38-0x0000000005220000-0x000000000525C000-memory.dmp

memory/2104-39-0x0000000005390000-0x00000000053DC000-memory.dmp