Malware Analysis Report

2024-10-16 03:53

Sample ID 240509-v5751shb35
Target red.zip
SHA256 57a34a1caae7f0426b32bc71b73785f820451c97d3c5db368da479183b037629
Tags
redline zgrat infostealer rat healer lamp dropper evasion persistence trojan rhadamanthys stealer amadey lande smokeloader backdoor lux3 stealc vidar 3c43beec65deb206d81f3c6b8d956f18 5345987420 discovery krast lumma kira masha nasa
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

57a34a1caae7f0426b32bc71b73785f820451c97d3c5db368da479183b037629

Threat Level: Known bad

The file red.zip was found to be: Known bad.

Malicious Activity Summary

redline zgrat infostealer rat healer lamp dropper evasion persistence trojan rhadamanthys stealer amadey lande smokeloader backdoor lux3 stealc vidar 3c43beec65deb206d81f3c6b8d956f18 5345987420 discovery krast lumma kira masha nasa

Stealc

Rhadamanthys

Healer

Detects Healer an antivirus disabler dropper

Suspicious use of NtCreateUserProcessOtherParentProcess

Detect Vidar Stealer

Lumma Stealer

RedLine

Detect ZGRat V1

Vidar

Modifies Windows Defender Real-time Protection settings

Amadey

SmokeLoader

RedLine payload

ZGRat

Executes dropped EXE

Windows security modification

Checks computer location settings

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Program crash

Enumerates physical storage devices

Creates scheduled task(s)

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 17:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

ZGRat

rat zgrat

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4540 set thread context of 1644 N/A C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4540 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4540 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4540 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4540 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4540 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4540 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4540 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4540 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe

"C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4540 -ip 4540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 340

Network

Country Destination Domain Proto
RU 147.45.47.64:11837 tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 177.196.17.2.in-addr.arpa udp
BE 2.17.196.177:443 www.bing.com tcp
RU 147.45.47.64:11837 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
RU 147.45.47.64:11837 tcp
RU 147.45.47.64:11837 tcp
RU 147.45.47.64:11837 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
RU 147.45.47.64:11837 tcp
RU 147.45.47.64:11837 tcp
RU 147.45.47.64:11837 tcp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp

Files

memory/4540-0-0x0000000000599000-0x000000000059A000-memory.dmp

memory/1644-1-0x0000000000400000-0x000000000044A000-memory.dmp

memory/1644-2-0x000000007495E000-0x000000007495F000-memory.dmp

memory/1644-3-0x0000000005C40000-0x00000000061E4000-memory.dmp

memory/1644-4-0x0000000005790000-0x0000000005822000-memory.dmp

memory/1644-5-0x0000000074950000-0x0000000075100000-memory.dmp

memory/1644-6-0x0000000005940000-0x000000000594A000-memory.dmp

memory/1644-7-0x0000000006DD0000-0x00000000073E8000-memory.dmp

memory/1644-8-0x0000000006920000-0x0000000006A2A000-memory.dmp

memory/1644-9-0x0000000006850000-0x0000000006862000-memory.dmp

memory/1644-10-0x00000000068B0000-0x00000000068EC000-memory.dmp

memory/1644-11-0x0000000006A30000-0x0000000006A7C000-memory.dmp

memory/1644-12-0x000000007495E000-0x000000007495F000-memory.dmp

memory/1644-13-0x0000000074950000-0x0000000075100000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7c0286554ac9381c9063b805018449ecbbcd29f8ce4cd23f2f0899846f42c802.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\7c0286554ac9381c9063b805018449ecbbcd29f8ce4cd23f2f0899846f42c802.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3696 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\7c0286554ac9381c9063b805018449ecbbcd29f8ce4cd23f2f0899846f42c802.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe
PID 3696 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\7c0286554ac9381c9063b805018449ecbbcd29f8ce4cd23f2f0899846f42c802.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe
PID 3696 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\7c0286554ac9381c9063b805018449ecbbcd29f8ce4cd23f2f0899846f42c802.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe
PID 4944 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe
PID 4944 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe
PID 4944 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe
PID 3000 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe
PID 3000 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe
PID 3000 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe
PID 3000 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2303195.exe
PID 3000 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2303195.exe
PID 3000 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2303195.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7c0286554ac9381c9063b805018449ecbbcd29f8ce4cd23f2f0899846f42c802.exe

"C:\Users\Admin\AppData\Local\Temp\7c0286554ac9381c9063b805018449ecbbcd29f8ce4cd23f2f0899846f42c802.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2303195.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2303195.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 96.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2992295.exe

MD5 d9948a95a49a326ce90fc50b4619c773
SHA1 10e79b3b884a848df21f47422c63bc5d4068e53d
SHA256 50e23efc34f6c675d6a9876b8837a1b933f98b4d50ee657229232c8c65888ff9
SHA512 a7399599dee2b120f70de4f74b32b77e8de3a63cf8e1fe5be94b4ed6eb114e7918b95af62be22e52c3bc1bfd162c92f1728efbdc7fcddf1606e9b6645ade3bea

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8791896.exe

MD5 bc628db49d632afc692038a9ff15146c
SHA1 5949973623f5a0c04bd3c1a82ef78e89cdd00a41
SHA256 7d1a31992bf1a0cfe78079760cd6f1dfd360f8adba687e4f3c806adf0316d5ab
SHA512 618dda543d21ca0657f0eece9a2f146a0dc77827888a41b7ba735eb79141ee6ab26fcbd626548a1947ba34b24d7a18f2375f7b802746438efd4d950115c689e1

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4517758.exe

MD5 159f98159ebbdd4958b8bedc28ba7125
SHA1 6a7379004d8a365f1a4c303423b692f4002a64fa
SHA256 61825deeaf8b1180b2784a5cdc8720a35787b5195e30659e1d28cf09d5689bd3
SHA512 567c977ced305344b2510bad39f48663a54d1f4a728d55f9cbb92abd231dcf233d11b76a78b46572b115101d97ae3ff16546461e6ff8d237f03cfd804c84dde7

memory/1124-21-0x0000000000590000-0x00000000005CE000-memory.dmp

memory/1124-27-0x0000000000401000-0x0000000000404000-memory.dmp

memory/1124-28-0x0000000000590000-0x00000000005CE000-memory.dmp

memory/1124-29-0x0000000006BD0000-0x0000000006BD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2303195.exe

MD5 96050b8afe5b22f9fcf94175c7b8434a
SHA1 11aa3a1ffcde8ab1b9baea835524168dfe601e57
SHA256 2eabec9234e3ac9457b0bbe80dc23956f09669d11431f64f1c4d5d533314a6a2
SHA512 7afaade0a5c81b1389249e46d0cfdf46386f7b51105c4a6ae56295fdd0cee385629f38c4f38b48e8289ac756f4bbc60b94bc536747b3e1059be4bdfb98593d63

memory/4820-35-0x00000000006E0000-0x000000000076C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4820-42-0x00000000006E0000-0x000000000076C000-memory.dmp

memory/4820-44-0x0000000004540000-0x0000000004546000-memory.dmp

memory/4820-45-0x0000000005D20000-0x0000000006338000-memory.dmp

memory/4820-46-0x0000000006340000-0x000000000644A000-memory.dmp

memory/4820-47-0x0000000006450000-0x0000000006462000-memory.dmp

memory/4820-48-0x0000000006470000-0x00000000064AC000-memory.dmp

memory/4820-49-0x00000000064D0000-0x000000000651C000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win7-20240419-en

Max time kernel

117s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe

"C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 120

Network

N/A

Files

memory/2488-0-0x0000000000901000-0x0000000000902000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2840 created 2556 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\system32\sihost.exe

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2796 set thread context of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2796 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2840 wrote to memory of 3988 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\SysWOW64\dialer.exe
PID 2840 wrote to memory of 3988 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\SysWOW64\dialer.exe
PID 2840 wrote to memory of 3988 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\SysWOW64\dialer.exe
PID 2840 wrote to memory of 3988 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\SysWOW64\dialer.exe
PID 2840 wrote to memory of 3988 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\SysWOW64\dialer.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe

"C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2796 -ip 2796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 320

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2840 -ip 2840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2840 -ip 2840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 588

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 2.17.196.75:443 www.bing.com tcp
US 8.8.8.8:53 75.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

memory/2796-0-0x0000000000623000-0x0000000000625000-memory.dmp

memory/2840-1-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2840-3-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2840-4-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2840-5-0x0000000003D90000-0x0000000004190000-memory.dmp

memory/2840-7-0x0000000003D90000-0x0000000004190000-memory.dmp

memory/2840-6-0x0000000003D90000-0x0000000004190000-memory.dmp

memory/2840-8-0x00007FFF85090000-0x00007FFF85285000-memory.dmp

memory/2840-11-0x0000000003D90000-0x0000000004190000-memory.dmp

memory/2840-10-0x0000000075F00000-0x0000000076115000-memory.dmp

memory/3988-12-0x00000000008A0000-0x00000000008A9000-memory.dmp

memory/3988-14-0x00000000023F0000-0x00000000027F0000-memory.dmp

memory/3988-15-0x00007FFF85090000-0x00007FFF85285000-memory.dmp

memory/3988-18-0x00000000023F0000-0x00000000027F0000-memory.dmp

memory/3988-17-0x0000000075F00000-0x0000000076115000-memory.dmp

memory/3988-19-0x00000000023F0000-0x00000000027F0000-memory.dmp

memory/2840-20-0x0000000003D90000-0x0000000004190000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5060 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe
PID 5060 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe
PID 5060 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe
PID 2096 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe
PID 2096 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe
PID 2096 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe
PID 2096 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe
PID 2096 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe
PID 2652 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2652 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2652 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 5060 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2721688.exe
PID 5060 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2721688.exe
PID 5060 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2721688.exe
PID 3140 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3140 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3140 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3140 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3140 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3140 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 4672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 4672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 4672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4516 wrote to memory of 2176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe

"C:\Users\Admin\AppData\Local\Temp\c1b16d8ddb22e16efecfa0c8e36f2388f5a13885f7633da10e0c7dbc1823f505.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2721688.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2721688.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
BE 2.17.196.152:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 152.196.17.2.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7895808.exe

MD5 6081dbcbacfb5f7242827bbe471f64d4
SHA1 b2c8393b92ddea4cd3b00c2f386ab3205439ab02
SHA256 436d7e9b7d3c4934456aec997d86fb98636ccd724327dcf9057e521864bd3096
SHA512 86e1f2a946994e9135dbcc85527dde7f932cbc5d7e77a7f012661bcf2172b28793ac860389bff7f9f1e1bb97db583d0dc621ee37bcaaa8f7c4184a9c8cd93d87

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4102535.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3712-14-0x00000000005D0000-0x00000000005DA000-memory.dmp

memory/3712-15-0x00007FFEFA873000-0x00007FFEFA875000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9818272.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2721688.exe

MD5 fab22fa270134863a93952387ef5ddae
SHA1 248ee65c41d477e290c31bf07ab2fa172774877c
SHA256 6f75135d6604bbc34d66fc1e70f0be32c9816393873e460b6c90ec75bb22fa02
SHA512 20fc84164a05ca08b8f0247ed614a6e033c620ea77ba89779e39eb06f06476780ff8be04b3eb04d214f3eb9ee3b8ae6a2ff413c46749d6feeb0dc1db1351f5e2

memory/3420-33-0x0000000000CA0000-0x0000000000CD0000-memory.dmp

memory/3420-34-0x00000000013D0000-0x00000000013D6000-memory.dmp

memory/3420-35-0x0000000005E00000-0x0000000006418000-memory.dmp

memory/3420-36-0x00000000058F0000-0x00000000059FA000-memory.dmp

memory/3420-37-0x0000000005660000-0x0000000005672000-memory.dmp

memory/3420-38-0x00000000057E0000-0x000000000581C000-memory.dmp

memory/3420-39-0x0000000005820000-0x000000000586C000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win7-20240221-en

Max time kernel

121s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe

"C:\Users\Admin\AppData\Local\Temp\60fc18182efb95a4ce4e1849473f7201f8de0caf9716fc85ddf837496b3ff3b7.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 120

Network

N/A

Files

memory/2220-0-0x00000000009B9000-0x00000000009BA000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 452 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe
PID 452 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe
PID 452 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe
PID 668 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe
PID 668 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe
PID 668 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe
PID 3500 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe
PID 3500 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe
PID 3500 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe
PID 3500 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe
PID 3500 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe
PID 4512 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4512 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4512 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 668 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe
PID 668 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe
PID 668 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe
PID 4280 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4280 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4280 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4280 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4280 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4280 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 3544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 3544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 3544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 4104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 4104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 832 wrote to memory of 4104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 452 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe
PID 452 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe
PID 452 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe

"C:\Users\Admin\AppData\Local\Temp\ac1a51983828d30d00c76912304628e7ad96b59348ac9377cf93c8f7c058dc39.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
GB 172.217.169.74:443 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.29:80 tcp
FI 77.91.68.29:80 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1108511.exe

MD5 805ee5f2e86db8dcb71c61419b97a7bc
SHA1 bcbb33987fbe58db70d9d4dd221964fceac8f7cb
SHA256 2050fbba411021855c095f57c2f1cbec51cb387c1a9bf17bc259a01d36e114e1
SHA512 255edb5fc9d1e60d49754873e9ca9178e83afcfe6195131006dee12ede6bc964496542af50cc0b0530d503b620494be3511aa350c7dd3ef6b94367c91ea55af7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5947689.exe

MD5 38d6de5de6f3d5129329821b43896fbd
SHA1 35865d4f70aae5517fc369240e7269dc2656d2c7
SHA256 a037df5465ec36876bf4352c82df9c9a0d707a76ab8e4cf78ca5d69d51fbc14d
SHA512 fb868def19fa175a1c9ba1df36b43d0a91927d9d76c9a0ddce7157a450d3eb622b5893be5f2ef62bd9a193adc3a60b28a2ee59b51f8e13d51e49d03543c0e629

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3381042.exe

MD5 e4986bd5697790b80b4718cdfd11beb9
SHA1 2b2a49129467f41c7f8cfd4a43919da6c464f5a3
SHA256 7bad585253f7cf153fccffe324cbe0bb30c1b9394b9d4092067f7c28de4cd1c4
SHA512 6ddbc098e8196df85e8f06d6e46a1b69db18d61a273a9564377b538b025066d29ddad3973e1f0bd4993d6d234e18357814dab9024ce51ec5c80024491a5d9edc

memory/3380-21-0x00007FF82D943000-0x00007FF82D945000-memory.dmp

memory/3380-22-0x0000000000950000-0x000000000095A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7149162.exe

MD5 ff6a7e0ddd84a5af2afa7670fdc3ba5f
SHA1 8d320bcb6a8b10b9d1621f41c662c449a94377fe
SHA256 65f0d7f92c5a7ed0b29cc13718e3c57529b5d7819576f135229ab355eaf01a27
SHA512 43dd7ce467625b9329c46b4667b699ab2492d29971f2337e2a858ff01daefeb31ac012f31f00d982b9adb49123facce22209cfc5d0161b5c1bddef996b3726ac

memory/4236-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9897645.exe

MD5 ce200a9ed0fe11e70629c5b6e4928b1b
SHA1 a80222a3e8cbbe8e5ac7a112771e7931b58c5449
SHA256 a6b423fde242a000df9b139abf636287f453baefccc548d8974ffde03e41a0af
SHA512 9b0f9c19dadff0f1a147cd2ce2ced002111ee7c054a2165a1c89f13464f3ab4469ae086e74c4757df5eae4226201d9209408b743f5605f0c4a82134624089130

memory/4236-44-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3372-41-0x00000000012B0000-0x00000000012C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6847860.exe

MD5 76fd4c1f0800f25cb42a8a93ecec5ea5
SHA1 fa04fc79678d76ba6c3ffcc7a2e6c85f001200c3
SHA256 c21aa80c72993dd20b1c80dc2d7b5562203df278b73f9954850d6138287b7dae
SHA512 c6aeeacf4ba2ae35db56636fb9ddfece96a3335ced296ffdb371655363a2479bad34591db4a5c6040d342922330c8b42fef2fdfe5877eccf889f48f5bc377437

memory/4684-48-0x00000000004D0000-0x0000000000500000-memory.dmp

memory/4684-49-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

memory/4684-51-0x000000000A840000-0x000000000AE58000-memory.dmp

memory/4684-52-0x000000000A340000-0x000000000A44A000-memory.dmp

memory/4684-53-0x000000000A280000-0x000000000A292000-memory.dmp

memory/4684-54-0x000000000A2E0000-0x000000000A31C000-memory.dmp

memory/4684-55-0x0000000004DA0000-0x0000000004DEC000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win7-20240419-en

Max time kernel

146s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3b67ac2053cfcb67f4034907cf81e72d93541e06f86ab3ac73130c4036c07651.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3b67ac2053cfcb67f4034907cf81e72d93541e06f86ab3ac73130c4036c07651.exe

"C:\Users\Admin\AppData\Local\Temp\3b67ac2053cfcb67f4034907cf81e72d93541e06f86ab3ac73130c4036c07651.exe"

Network

Country Destination Domain Proto
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp

Files

memory/1200-0-0x0000000000240000-0x0000000000270000-memory.dmp

memory/1200-4-0x0000000000401000-0x0000000000403000-memory.dmp

memory/1200-5-0x0000000000400000-0x0000000000443000-memory.dmp

memory/1200-6-0x0000000002040000-0x0000000002046000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240508-en

Max time kernel

93s

Max time network

99s

Command Line

"C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 212 set thread context of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 212 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 212 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 212 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 212 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 212 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 212 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 212 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 212 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 212 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe

"C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1676 -ip 1676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 2284

Network

Country Destination Domain Proto
US 8.8.8.8:53 steamcommunity.com udp
BE 104.68.92.92:443 steamcommunity.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 92.92.68.104.in-addr.arpa udp
FI 65.109.242.112:443 65.109.242.112 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 65.109.242.112:443 65.109.242.112 tcp
US 8.8.8.8:53 112.242.109.65.in-addr.arpa udp
FI 65.109.242.112:443 65.109.242.112 tcp
FI 65.109.242.112:443 65.109.242.112 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/212-1-0x0000000002F20000-0x0000000002F21000-memory.dmp

memory/1676-0-0x0000000000400000-0x0000000000647000-memory.dmp

memory/1676-3-0x0000000000400000-0x0000000000647000-memory.dmp

memory/1676-5-0x0000000000400000-0x0000000000647000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2424 set thread context of 720 N/A C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2424 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2424 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2424 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2424 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2424 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2424 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2424 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2424 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe

"C:\Users\Admin\AppData\Local\Temp\9048c42abaabca33d5b7af1bcc44359b59b27e5665057af23d6189a59cedd063.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2424 -ip 2424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 356

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 177.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 104.20.3.235:443 pastebin.com tcp

Files

memory/2424-0-0x0000000000F71000-0x0000000000F72000-memory.dmp

memory/720-1-0x0000000000400000-0x0000000000422000-memory.dmp

memory/720-2-0x000000007447E000-0x000000007447F000-memory.dmp

memory/720-3-0x00000000056F0000-0x0000000005756000-memory.dmp

memory/720-4-0x0000000006240000-0x0000000006858000-memory.dmp

memory/720-5-0x0000000005CA0000-0x0000000005CB2000-memory.dmp

memory/720-6-0x0000000005DD0000-0x0000000005EDA000-memory.dmp

memory/720-7-0x0000000074470000-0x0000000074C20000-memory.dmp

memory/720-8-0x000000007447E000-0x000000007447F000-memory.dmp

memory/720-9-0x0000000074470000-0x0000000074C20000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4433994.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4433994.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4433994.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1872 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe
PID 1872 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe
PID 1872 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe
PID 4860 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe
PID 4860 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe
PID 4860 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe
PID 3116 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe
PID 3116 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe
PID 3116 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe
PID 3116 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe
PID 3116 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe
PID 724 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 724 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 724 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4860 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4433994.exe
PID 4860 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4433994.exe
PID 4860 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4433994.exe
PID 1872 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1653468.exe
PID 1872 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1653468.exe
PID 1872 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1653468.exe
PID 4904 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4904 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4904 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 4904 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4904 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4904 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 3304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 3304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 3304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4344 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe

"C:\Users\Admin\AppData\Local\Temp\0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4433994.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4433994.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1653468.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1653468.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.91:443 www.bing.com tcp
BE 2.17.196.91:443 www.bing.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 91.196.17.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 52.111.227.11:443 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3140559.exe

MD5 829b6c6ced5e89cbc5267ca4732d7f8f
SHA1 f0ada1c7598666359da9f1caca987b02b5888dfe
SHA256 04c7df80c9a520ba741cdb4245f8bb728ed31a5970a90924bb9984bad13c1d09
SHA512 63a7bbaa9731a9318b0a8c703e445424c77f12031fb4ab3f718f46a426b285ae7db7ccc4591c2055ede96cc015b713106ce7a9be6f7fc5e4677c53f3f2370659

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2968486.exe

MD5 f88bac73ec5e5f8b9d707194ba3a3b6c
SHA1 0181927195d8a9e5ff905a5e97e75ada5ae35259
SHA256 8cb650aa6c29e02c099c14f37fca10688bd921723c8300576fcbf1093a97faba
SHA512 a5c265329b3fa923fbdeff2eedc21baa815b89113331441b5dce8176a8324e5cc89fa3c58d704b8c11d568d86abbd76e64fd17354c4dd34705fd9f14691022a8

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0869362.exe

MD5 ba447d378a1267606b1f361624acb6e8
SHA1 41ce7255de8d20141e4813e6ca50228c8622644b
SHA256 6ef1b37a60a7c7c234da28d5ae1ec21c4dbceab4088a121f0cd55eb163f75668
SHA512 7a8c8a548822f74c5b40c99284085939ff89a392ed73e100516aa5ac77511535d5d4563dbe9912e3e70472bf71b0d74581cc806db20fc9c79c1d519067e4c16f

memory/2420-22-0x0000000000070000-0x000000000007A000-memory.dmp

memory/2420-21-0x00007FFD83973000-0x00007FFD83975000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8308802.exe

MD5 ac90754b60676e187253605f012db42a
SHA1 162c031c73480695d828ba8e1803a1caef8f3f79
SHA256 6284c6c4766710744f721f48e4dadf494f685f01956b0ae07793f39bf60a95d9
SHA512 6958753d3315d43648f7e7c2787abab3687162d8fb1bd3a8b90e96355d97752266cb961179bc3df6c075a58192437b2575326892c639b7ed772512fa2696f712

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4433994.exe

MD5 5e08b4f966bda21f6e34f49f59ce29f0
SHA1 83dfb6cba2c8b318e5a61095fc7769a41e354296
SHA256 c28cce242a56daa7158ba4a0520df04a36b47fed2c0dd300d717293a78aaa3e4
SHA512 3db0d5f9bbe69b00274862b1452839db8f1bf7edc7bcfaa1a12b7dfab217d904a23d0e94a080b18dc23c68174e3912175b65259fb80d3f9ddf00b92a1b0b70e2

memory/1344-40-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1344-41-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d1653468.exe

MD5 6465844a90fa05f3d45f8c8108a84670
SHA1 f80df1d6d7eb1bebca2fb91efb646a83ee5a9caf
SHA256 f74efae7d1faeb610d44dd89f2e61a99e01cf1e2b9c1a7faa817c23055151eeb
SHA512 1a6ddfe6b5a0fc3233245730a9f23551c505b2ed4837114efcb1b47b6c4e6da9e0bb63928ca67625c3596513c8597e301252840ed7001dd08b200c41a97987a5

memory/2844-45-0x00000000001E0000-0x0000000000210000-memory.dmp

memory/2844-46-0x0000000002500000-0x0000000002506000-memory.dmp

memory/2844-47-0x0000000005310000-0x0000000005928000-memory.dmp

memory/2844-48-0x0000000004E00000-0x0000000004F0A000-memory.dmp

memory/2844-49-0x0000000004CA0000-0x0000000004CB2000-memory.dmp

memory/2844-50-0x0000000004D30000-0x0000000004D6C000-memory.dmp

memory/2844-51-0x0000000004D70000-0x0000000004DBC000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3252 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe
PID 3252 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe
PID 3252 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe
PID 4280 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe
PID 4280 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe
PID 4280 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe
PID 4280 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe
PID 4280 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe
PID 4324 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4324 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 4324 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 3252 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1047536.exe
PID 3252 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1047536.exe
PID 3252 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1047536.exe
PID 2100 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 2100 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 2100 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 2100 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 2356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 2356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 2356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 4336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2912 wrote to memory of 748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe

"C:\Users\Admin\AppData\Local\Temp\4590646dc86de08c227e10ecb3a0504d9c0abf060e54eec6a608fcac2fc5600a.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1047536.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1047536.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
SE 5.42.92.67:80 tcp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.179.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3203561.exe

MD5 bfd5c0beccec0cfa54effd0fddf4a608
SHA1 0cec6e221914d061c438cbe478ad6330c8fe6e51
SHA256 ff7812d72b5b97fdbea64d514cff00b540b1f1ebb63c96a19b7d8cd762de5a48
SHA512 084a1f8007388abf58fb55bb47c475c0745eca3856ac0a8098824638a790d057b367b47b70c298a3cdb39be55aed26eaf1ced3fd7072fc315151fe1832ec92cd

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4211986.exe

MD5 bc10444950d21b26c96dd7cd22bc474a
SHA1 60ae83f543574228e936173835dd0f7a4e5f477d
SHA256 20b37582f208652a564a96fe3e427df330ec6a93782b19ec8dd26e02ea634757
SHA512 7614db346d463430d6b7f79bf55a0e39cbbe7fa1c5548b6b4ce4cc670b67cfb1ddbf808dae7cd566d623c9329b734f6d16a18a13811bf77dc678d38f04713cc6

memory/464-14-0x00007FFAE31E3000-0x00007FFAE31E5000-memory.dmp

memory/464-15-0x00000000009B0000-0x00000000009BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6264222.exe

MD5 9b04e1bb3efb16c0a6d842f42fd02e39
SHA1 de487d6ea143daab21d358177f23368c518ac951
SHA256 0aa872d13beb7b4e110764c6eb807c9feef9e7083174ab478a58b89cb8d98e0e
SHA512 94fa728641ef4cd08beba2e2a55c720881e4f1b5ecec833881e105e8d87ee5e9b765d0d1dfcebe6d79fb11840cc3458ad805eaf4c8708daec4ec33b24bdb5b15

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t1047536.exe

MD5 27828fe8746e37af3928df594f42aa45
SHA1 f3a57ddd9b3c1a38835e25828a15bf0b1267db07
SHA256 52e89bbef0f4c1e84fea21ad9358e613e34416adaa3c8b6539992dae56b4d943
SHA512 a87d9ca1ec9584a4b8be164ca3cc5ef46a5e216152d6c5dd6543b9fb4448f1ac4030953ea795bfac5e26f8ff9269fe5af68929570404a9fb879d96a310ed2747

memory/4944-33-0x0000000000900000-0x0000000000930000-memory.dmp

memory/4944-34-0x00000000051E0000-0x00000000051E6000-memory.dmp

memory/4944-36-0x000000000AC00000-0x000000000B218000-memory.dmp

memory/4944-37-0x000000000A770000-0x000000000A87A000-memory.dmp

memory/4944-38-0x000000000A6B0000-0x000000000A6C2000-memory.dmp

memory/4944-39-0x000000000A710000-0x000000000A74C000-memory.dmp

memory/4944-40-0x00000000050E0000-0x000000000512C000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe"

Signatures

Lumma Stealer

stealer lumma

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4440 set thread context of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4440 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4440 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4440 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4440 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4440 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4440 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4440 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4440 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4440 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe

"C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4440 -ip 4440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 320

Network

Country Destination Domain Proto
US 8.8.8.8:53 sideindexfollowragelrew.pw udp
US 8.8.8.8:53 productivelookewr.shop udp
US 172.67.150.207:443 productivelookewr.shop tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 207.150.67.172.in-addr.arpa udp
US 8.8.8.8:53 tolerateilusidjukl.shop udp
US 172.67.147.41:443 tolerateilusidjukl.shop tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 shatterbreathepsw.shop udp
US 8.8.8.8:53 41.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 104.21.95.19:443 shatterbreathepsw.shop tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 shortsvelventysjo.shop udp
US 104.21.16.225:443 shortsvelventysjo.shop tcp
US 8.8.8.8:53 incredibleextedwj.shop udp
US 104.21.86.106:443 incredibleextedwj.shop tcp
US 8.8.8.8:53 19.95.21.104.in-addr.arpa udp
US 8.8.8.8:53 225.16.21.104.in-addr.arpa udp
US 8.8.8.8:53 alcojoldwograpciw.shop udp
US 104.21.48.243:443 alcojoldwograpciw.shop tcp
US 8.8.8.8:53 liabilitynighstjsko.shop udp
US 104.21.44.3:443 liabilitynighstjsko.shop tcp
US 8.8.8.8:53 demonstationfukewko.shop udp
US 104.21.33.174:443 demonstationfukewko.shop tcp
US 8.8.8.8:53 243.48.21.104.in-addr.arpa udp
US 8.8.8.8:53 106.86.21.104.in-addr.arpa udp
US 8.8.8.8:53 3.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 174.33.21.104.in-addr.arpa udp
BE 2.17.196.137:443 www.bing.com tcp
US 8.8.8.8:53 137.196.17.2.in-addr.arpa udp
BE 2.17.196.137:443 www.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp

Files

memory/4440-0-0x00000000005E8000-0x00000000005E9000-memory.dmp

memory/1512-1-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1512-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1512-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1512-5-0x0000000000400000-0x0000000000451000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win7-20240221-en

Max time kernel

118s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe

"C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 116

Network

N/A

Files

memory/2188-0-0x0000000000B33000-0x0000000000B35000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5052109.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5052109.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5052109.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2648 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe
PID 2648 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe
PID 2648 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe
PID 3192 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe
PID 3192 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe
PID 3192 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe
PID 3840 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe
PID 3840 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe
PID 3840 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe
PID 8 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe
PID 8 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe
PID 8 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe
PID 8 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe
PID 8 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe
PID 3840 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3798943.exe
PID 3840 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3798943.exe
PID 3840 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3798943.exe
PID 3192 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe
PID 3192 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe
PID 3192 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe
PID 4196 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4196 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4196 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2648 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5052109.exe
PID 2648 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5052109.exe
PID 2648 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5052109.exe
PID 4344 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4344 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4344 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4344 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 4456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 4456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 4456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 1552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 1636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 1636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe

"C:\Users\Admin\AppData\Local\Temp\4869031eb83eeff0929b84ddb6a50211c58c3773e9a4c610f1ffe9db5f968b36.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3798943.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3798943.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1120 -ip 1120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 216

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5052109.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5052109.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 177.196.17.2.in-addr.arpa udp
BE 2.17.196.177:443 www.bing.com tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.3:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7865869.exe

MD5 56657e74267c7b489c282a9bb1de406c
SHA1 701d91a7988fa2a604a441a6bd99bea35fe813ee
SHA256 f5ce5350ff9fe9a8ad4e1217754ecbe0675c62e228a57b1862a501d627251744
SHA512 836313a39c5b2e91827f75d0e1ac65ad60d51bac2e420b43f1134c785b3305e5db5e0c721fe2a5019055883ea3c1367f855398efa010f7ff5e3c9a3182964421

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9359770.exe

MD5 98b8f19b41054658c409c75389408046
SHA1 ce80546c060d4c0d5012e288369ec1955c8c2fe2
SHA256 da59ffabd84c05151ab93fea2ac423af54ba2774b807a05179c334003c3d6bc2
SHA512 966416ada63286b76c50ff2331aa9bd7f101bae5eb3952c48623d240df69c94b04ba7bdbedab22f4e87883da64d4b05e8d37e351cfc0331090b9c1ae12fd2bd8

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1872172.exe

MD5 f1dd40159c1befc6e469e77e612fde93
SHA1 3f5e6fea7f1fd35e03387f4fa6c2c91a8f2902d5
SHA256 5c9e608a2f7359076029e44e763cf180d16c9b463c5cf191dcfbcd65b2d241e1
SHA512 b3643a4a5c9b96c255ebc94498bc15d06f923e53f5abdc0d11bc803367eb969e2614856aeb48aafe376d96f2cf339f2f3288e2f40b36105b30616009551b7a5a

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6290582.exe

MD5 99cca018c3ffca33581948941054b6d7
SHA1 4150e091af18f58de37f3144dbadffaaee6af298
SHA256 571153bfa2bae9bf53f28604b68d1c2056aa77af1ef7758b3ed9125e6d74f208
SHA512 fb3853e760d593eb4e1c5f2d17ed55c722b0c6218a924a495ae03b8e7bb7c87a983a89f84a53a573967a334e0efc7f73af6b90b44f84ac7a32b18e2fc54e3f46

memory/1576-28-0x0000000000430000-0x000000000043A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5116580.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/700-37-0x00000000007F0000-0x00000000007FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3798943.exe

MD5 f13ccb7d4b916e1a0922a12e8f9e83ac
SHA1 acbb7d084d74373bfc3bb234eccf610fe5412485
SHA256 1582b35d2f7ba3dc6dc49247fc345420802ce668230e3a493bc8107b69bb0a75
SHA512 eab3753f3490b60cef6e4b0779f12cd49cc56a054308ca61c6b3392d3f7f152e54de69568fa0af5c7c563ef337cc80779d77155f4c29b3a4cdd12ea4e390cc5b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d6372899.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

memory/3068-58-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e5052109.exe

MD5 35a15fad3767597b01a20d75c3c6889a
SHA1 eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA256 90ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512 c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\933ef5632cb9efcfdd066357d6d3cef5ee2fda4fda1ad8e2a5c8fa37a5e983f8.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9852384.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3351487.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\933ef5632cb9efcfdd066357d6d3cef5ee2fda4fda1ad8e2a5c8fa37a5e983f8.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9852384.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\933ef5632cb9efcfdd066357d6d3cef5ee2fda4fda1ad8e2a5c8fa37a5e983f8.exe

"C:\Users\Admin\AppData\Local\Temp\933ef5632cb9efcfdd066357d6d3cef5ee2fda4fda1ad8e2a5c8fa37a5e983f8.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9852384.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9852384.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3351487.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3351487.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
BE 2.17.196.152:443 www.bing.com tcp
US 8.8.8.8:53 152.196.17.2.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 11.73.50.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9852384.exe

MD5 f40b5f1d49d9fb652b8b14e5ef7b9046
SHA1 c2de2d362cd91bcb507b8e7cff030c340dd112c9
SHA256 2b19f881ef625b54047ebbb53f8c7af71a83d0119647593de072ff11f4e70b24
SHA512 6c9503fae4ddad9f71bdb4573565e0901bc47449c4952ec77e253e7d482c0c874f5a9dc411ce313e317bfbca503dcf1365d0a53de7d8455f3ffad1f65a3a4a69

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f3351487.exe

MD5 36c85059a120f6d16838e500b22f8b08
SHA1 98075333bd858be070dcee705354acb105636ce3
SHA256 9fde06fe13de8b66f72832aec01aa0bbca88816a883b6594cfb31535220ab856
SHA512 cce30fa0d0ac83496092ba7d89410d501c8a6a73c6fe8c2e08c093943b17ccee3e0e47d65f46c5f66d467dea5eba55610b0cab62f8c7bc0ed2ecd1db82470c80

memory/1196-14-0x0000000000440000-0x0000000000470000-memory.dmp

memory/1196-18-0x0000000000401000-0x0000000000402000-memory.dmp

memory/1196-19-0x0000000000400000-0x000000000043A000-memory.dmp

memory/1196-20-0x0000000002160000-0x0000000002166000-memory.dmp

memory/1196-21-0x0000000009FB0000-0x000000000A5C8000-memory.dmp

memory/1196-22-0x000000000A640000-0x000000000A74A000-memory.dmp

memory/1196-23-0x000000000A780000-0x000000000A792000-memory.dmp

memory/1196-24-0x000000000A7A0000-0x000000000A7DC000-memory.dmp

memory/1196-25-0x00000000024A0000-0x00000000024EC000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240426-en

Max time kernel

141s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\67a45559c67180bac6f740ec616b9c74df65b1cb4a48219d705f41d667e2b233.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\67a45559c67180bac6f740ec616b9c74df65b1cb4a48219d705f41d667e2b233.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1656 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\67a45559c67180bac6f740ec616b9c74df65b1cb4a48219d705f41d667e2b233.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe
PID 1656 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\67a45559c67180bac6f740ec616b9c74df65b1cb4a48219d705f41d667e2b233.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe
PID 1656 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\67a45559c67180bac6f740ec616b9c74df65b1cb4a48219d705f41d667e2b233.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe
PID 2216 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe
PID 2216 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe
PID 2216 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe
PID 2612 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe
PID 2612 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe
PID 2612 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe
PID 216 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe
PID 216 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe
PID 216 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe
PID 216 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe
PID 216 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe
PID 2612 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2987143.exe
PID 2612 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2987143.exe
PID 2612 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2987143.exe

Processes

C:\Users\Admin\AppData\Local\Temp\67a45559c67180bac6f740ec616b9c74df65b1cb4a48219d705f41d667e2b233.exe

"C:\Users\Admin\AppData\Local\Temp\67a45559c67180bac6f740ec616b9c74df65b1cb4a48219d705f41d667e2b233.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2987143.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2987143.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
BE 2.17.196.152:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
BE 2.17.196.152:443 www.bing.com tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 udp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4982378.exe

MD5 741838e93a1b6fd219f38b6db32f022c
SHA1 d1b635eea04c17d01052f9b01c18d58610cc9dfe
SHA256 eca28fc3d1f19484e3f78cb8786486c6a014d2dfecf4864693637d94e21b8588
SHA512 7b2fd35a80211565d1c674b96dee8dc4e2f3a69f8a87dcfd4371318216d27e8d7a070d525ec3eafcb94e0f3f5ae1aec0cd6a8d501734f38ccd332a53c2f153ed

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9829686.exe

MD5 0f273cdd284121084e3180bc84aa43f0
SHA1 02e8c0c1e7665a1683ab16af641f9b4ccadb6fdd
SHA256 3186cd3feefcf00561e29cd0df7673e346ae9e9e60730b994db2fc0804d66f41
SHA512 b51ca041f93d9536b338a85dbca974adfd1be1caa05de09b09a754323db7cdfd8069d090d3cfc2eb90fbba83978691cade4704f4b1c7d341c22ab86cb84aad0c

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8580833.exe

MD5 3a984f073858b69a984baedc429c425d
SHA1 3ed46d75a97a76750cdf47a36f7c837ce60528a6
SHA256 48beec8b4d98bce278449701b46713f33dc5760f26a3ce02e93af556548613aa
SHA512 b0e9c1d613c0a5b6f3ea85c2746274c22179c31a9c7fabc3262a8cc0ba6d00267d9a58286ad11bb0c7c85270e3195396c3d318712ea185119a8f2782497cddf3

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3989589.exe

MD5 53d9a8baf935efb9bad19b8bf64b23c1
SHA1 616362d64bf8f76373885fe7a68427bc0949ba7d
SHA256 97bb3006d9b0d2f067bdc18eb2b0e0464f5b166c08c854e10d58732431b8763e
SHA512 e5ff592b5e691ec03505bf17ff71c9f210ae11491fdc18b34e04a251e44574c3b03a29edc6e5f8a41af6b891f7560bac2107a88ee1be4a5665f947a2b0647f0d

memory/1992-28-0x0000000000430000-0x000000000043A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4952814.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3504-37-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2987143.exe

MD5 da0fa4c3da6c807d1f548b7f3076e7c2
SHA1 f084fb5abf6b5c4933a065ed3580621cf93d6619
SHA256 74754acdef3bb4ba00c2f12115af82c2a6bfaf9bfbe0a9978311c33e847e9420
SHA512 6f7f4744ca133e1f411eb3c227fbebee8173993af87cab509d2b7f1dbb09ba9e08bd37cfb5db0d03b3f5a990c7acf932c8eba8f185fa4666aefd07b86ab8e764

memory/704-43-0x0000000000450000-0x0000000000480000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/704-47-0x0000000002050000-0x0000000002056000-memory.dmp

memory/704-48-0x0000000005170000-0x0000000005788000-memory.dmp

memory/704-49-0x0000000004B50000-0x0000000004C5A000-memory.dmp

memory/704-50-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

memory/704-51-0x0000000004B00000-0x0000000004B3C000-memory.dmp

memory/704-52-0x0000000004CC0000-0x0000000004D0C000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win7-20240508-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe

"C:\Users\Admin\AppData\Local\Temp\74375fb2d74b7174b1444727d6bd1534918dce2deffdf037cfc3050c20679d83.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 36

Network

N/A

Files

memory/2140-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1436 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe
PID 1436 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe
PID 1436 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe
PID 4840 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe
PID 4840 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe
PID 4840 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe
PID 4840 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe
PID 4840 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe
PID 2212 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2212 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2212 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1436 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3346045.exe
PID 1436 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3346045.exe
PID 1436 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3346045.exe
PID 2240 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2240 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2240 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2240 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 4952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 4952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 4952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 2288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 2288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 2288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1016 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1016 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe

"C:\Users\Admin\AppData\Local\Temp\fa3e1431975485964a90b92bb444c1ca0520a5e2b03b1d0b14d263f8802620a1.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3346045.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3346045.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BE 2.17.196.113:443 www.bing.com tcp
BE 2.17.196.113:443 www.bing.com tcp
US 8.8.8.8:53 113.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5331971.exe

MD5 df67c226df25b7e64a66895f06011aa9
SHA1 5db3773edebb0264ed0ece2b6be81709f1487031
SHA256 1da014410cf4603155861ff6d04d051bbe515b75e4d7b535ab2d3c620c6e8e67
SHA512 6461b82bb3e7ebc69da11fbe0e2ad5997921bb403317ed7abf25b9da9eeb87b4e02ab2499cc66e7dfcb092c81b4d920ff517d393969acf82b8999701667c08f0

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3496662.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1232-15-0x00007FFCD91D3000-0x00007FFCD91D5000-memory.dmp

memory/1232-14-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0707391.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3346045.exe

MD5 0ce5f356d964a3a42e5c161db2515d2f
SHA1 bbb0b4890ef9dea4fde0d8b887f2281018632b38
SHA256 5131e66c767936267e6a309b4c75085a0b2d314918e83886ce39901befd2b140
SHA512 69b14570d2da0c74780b777593a4c80b3c9701f6b79fdc3b332746c9dd0e24d974c98c8a8fbfccf7513d9a1cb69361ad55b6bb8873eecf5bc42a6a9998ae78ad

memory/3060-33-0x0000000000380000-0x00000000003B0000-memory.dmp

memory/3060-34-0x0000000004CA0000-0x0000000004CA6000-memory.dmp

memory/3060-35-0x0000000005420000-0x0000000005A38000-memory.dmp

memory/3060-36-0x0000000004F10000-0x000000000501A000-memory.dmp

memory/3060-37-0x0000000004E50000-0x0000000004E62000-memory.dmp

memory/3060-38-0x0000000004EB0000-0x0000000004EEC000-memory.dmp

memory/3060-39-0x0000000005020000-0x000000000506C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240508-en

Max time kernel

127s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0938a999b8caf4ac0b0ae0df1eb9b0b22dec4dfbfa3b4cb4ac6b6fdd35c3f7a3.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\0938a999b8caf4ac0b0ae0df1eb9b0b22dec4dfbfa3b4cb4ac6b6fdd35c3f7a3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1856 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\0938a999b8caf4ac0b0ae0df1eb9b0b22dec4dfbfa3b4cb4ac6b6fdd35c3f7a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe
PID 1856 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\0938a999b8caf4ac0b0ae0df1eb9b0b22dec4dfbfa3b4cb4ac6b6fdd35c3f7a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe
PID 1856 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\0938a999b8caf4ac0b0ae0df1eb9b0b22dec4dfbfa3b4cb4ac6b6fdd35c3f7a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe
PID 4020 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe
PID 4020 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe
PID 4020 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe
PID 2664 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe
PID 2664 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe
PID 2664 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe
PID 4060 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe
PID 4060 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe
PID 4060 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe
PID 2384 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe
PID 2384 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe
PID 2384 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe
PID 2384 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe
PID 2384 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe
PID 4060 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7133350.exe
PID 4060 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7133350.exe
PID 4060 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7133350.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0938a999b8caf4ac0b0ae0df1eb9b0b22dec4dfbfa3b4cb4ac6b6fdd35c3f7a3.exe

"C:\Users\Admin\AppData\Local\Temp\0938a999b8caf4ac0b0ae0df1eb9b0b22dec4dfbfa3b4cb4ac6b6fdd35c3f7a3.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7133350.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7133350.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 177.196.17.2.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4502117.exe

MD5 59428e4ccebfc6dd340d8b529cbc1a20
SHA1 c2d8debfb3b5fa94f6a6b45ddd4a7925ac8eb7f3
SHA256 b1923d8eea4d2c469a2eda9a11a6883eacbac1d20103bf9ee16bff2b972cda7f
SHA512 49bbbcc3516e1f8e566dfe44a6244c9d33ada44e90b6cd59d4851b49d64bea8a6b08d1434a17f52da6d809a1e12db1a410ad331418575658e72ffd5c123795c9

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9468037.exe

MD5 d37dd3d1df9437fca9263ff6322ab957
SHA1 36650b84a0e010cd40efac971a4bc5a4f66bfa64
SHA256 5c4fd7dc311f70861047b8e0c591a7e7e88c3fb8a76995a797439c0d6a17a5bf
SHA512 2df136cd5dcd8e2675a4f87cee2349f11cf3c408d10c3530a6be88512ad76558ef0177bb5e49c88f0b2a7d45b36890d40e9ef8cb3bcdfdfa67b4c400d1571e9b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3169319.exe

MD5 bb8875b186ee8780517d342e19dabf0a
SHA1 0e0ab4ea6f00c068ba5f60efabf5c3e7c92857f0
SHA256 f0dff460af5dde1a38dceb311dbb611c32c0ddd3f34b1643b6fda83794f72c35
SHA512 0e31d4976508ad86c19e38bce72d3c08d6c8da6bd70ad19f05d630dd2b7ce71851b00ae6d3cb3c669f89c3814aa072ab6bdafdfd22de8b10ce68d2566de2b606

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9212352.exe

MD5 3bd16ca4347d2c927891bfbfdbc1ad7b
SHA1 8da7546242a085a8c1746229dec75003a05087c2
SHA256 4d0d4db944383e2d84ba28598df125f8914b9cd37b9eca594f9beb67efa87adf
SHA512 8dc800783a0db8c9fd6b523296593addc0f9a4f35c34c29a1a2afd7e208e46229a60f3a9be1eceaf94ca65d84168d8b3926789f4aaa54833c919cd0793ff5a9d

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6073119.exe

MD5 f28a122b694a5fc9fce3abada17743f6
SHA1 9bc491d7e3139ba2220830ac4be17e1926623d02
SHA256 5f5de7d8883b88831eb527b856e55200d0bd26b29a3b8e4db292bb9867ddd855
SHA512 8e411eb7d6e444d424957866a9c884b697039c2bb132292f86b2a42d859bddcb19a039b84cbb9ac1defed9d931782f044cb0f6b1cca212bd9e54b85c13e95ce2

memory/1628-35-0x00000000004B0000-0x00000000004EE000-memory.dmp

memory/1628-42-0x00000000025A0000-0x00000000025A1000-memory.dmp

memory/1628-41-0x00000000004B0000-0x00000000004EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6966414.exe

MD5 f98262dafbc87c8f25177129b13c62f0
SHA1 15185689422140bacdec8095d5eb0407347993b7
SHA256 34243e0a87cee8c94d413dd9d3d478fe849e29d3ab802b99f4ada3e0dbf0eaa4
SHA512 e0fdf9ab1e81bbb3de224a07607dcb94859a6e2bd2855a66fd3be4d1a59aac60ed36c296cbcff9c3e8d65be82f9defd1c2a556d038ec469699bea645a67831c2

memory/3700-48-0x0000000000DC0000-0x0000000000DCA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7133350.exe

MD5 f172d470fc8f5a1f32456a418bcb6517
SHA1 7cedee0bcbcdb6ec4d0aa1c96cb781b58085c020
SHA256 29637e8c1a1ec7bffd145a7e2d3c0dd547d367d43c1a611fac2d21ebac4996b9
SHA512 f8f43a4c3ef3e7d0d79ad23ad29956d3a2c8d4e8bebbae7cdce7f0ca4ae5dd28408e3c0725ac65173a6b6bafb7c2b38e64f58b0339f4a4754eab76eadc21cc22

memory/4352-53-0x0000000001FB0000-0x000000000203C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4352-60-0x0000000001FB0000-0x000000000203C000-memory.dmp

memory/4352-62-0x00000000043A0000-0x00000000043A6000-memory.dmp

memory/4352-63-0x0000000008660000-0x0000000008C78000-memory.dmp

memory/4352-64-0x00000000080A0000-0x00000000081AA000-memory.dmp

memory/4352-65-0x00000000081D0000-0x00000000081E2000-memory.dmp

memory/4352-66-0x00000000081F0000-0x000000000822C000-memory.dmp

memory/4352-67-0x0000000008260000-0x00000000082AC000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240508-en

Max time kernel

138s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3b67ac2053cfcb67f4034907cf81e72d93541e06f86ab3ac73130c4036c07651.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3b67ac2053cfcb67f4034907cf81e72d93541e06f86ab3ac73130c4036c07651.exe

"C:\Users\Admin\AppData\Local\Temp\3b67ac2053cfcb67f4034907cf81e72d93541e06f86ab3ac73130c4036c07651.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 2.17.196.75:443 www.bing.com tcp
BE 2.17.196.75:443 www.bing.com tcp
US 8.8.8.8:53 75.196.17.2.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
US 8.8.8.8:53 28.73.42.20.in-addr.arpa udp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp
MD 176.123.9.142:14845 tcp

Files

memory/3388-4-0x0000000000401000-0x0000000000403000-memory.dmp

memory/3388-0-0x0000000002050000-0x0000000002080000-memory.dmp

memory/3388-5-0x0000000000400000-0x0000000000443000-memory.dmp

memory/3388-6-0x0000000004960000-0x0000000004966000-memory.dmp

memory/3388-7-0x00000000050F0000-0x0000000005708000-memory.dmp

memory/3388-8-0x0000000004AD0000-0x0000000004BDA000-memory.dmp

memory/3388-9-0x0000000004BF0000-0x0000000004C02000-memory.dmp

memory/3388-10-0x0000000004C10000-0x0000000004C4C000-memory.dmp

memory/3388-11-0x0000000004CC0000-0x0000000004D0C000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win7-20240221-en

Max time kernel

118s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe

"C:\Users\Admin\AppData\Local\Temp\8bdbf47835c5a550c8e2c0097ef280b82cb81138f4766ff4ad2c7987f518d6d8.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 116

Network

N/A

Files

memory/2336-0-0x0000000000238000-0x0000000000239000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240426-en

Max time kernel

145s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4332 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe
PID 4332 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe
PID 4332 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe
PID 1364 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe
PID 1364 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe
PID 1364 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe
PID 2772 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2772 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2772 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1364 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe
PID 1364 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe
PID 912 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 912 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 912 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 912 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 912 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 912 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 3520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 3520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 3520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 1392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 1392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 1392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 3624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 3624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2812 wrote to memory of 3624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4332 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0849012.exe
PID 4332 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0849012.exe
PID 4332 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0849012.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe

"C:\Users\Admin\AppData\Local\Temp\b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0849012.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0849012.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
BE 2.17.196.152:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 152.196.17.2.in-addr.arpa udp
BE 2.17.196.152:443 www.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3593832.exe

MD5 1bdb1b924d67f22749bcbee7ae3a1e82
SHA1 443647090e0cedf605dc123b5e64609f36770989
SHA256 9ecc28c390acb7ab1c244efc49c89664ce92232ff3bd8918b69f974916337d58
SHA512 16c11d475c41865f3285acea200cd7c734538a4c50f1694eb70683f08bc8fd4ed7d292b5055d641b4f47af9d163c1f4022d66e0a189639cc8472a6ff65bf6f9e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9478879.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0953969.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3656-27-0x00000000007C0000-0x00000000007CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j0849012.exe

MD5 f47fc5942c03599ea2437a52731da8bd
SHA1 58615298465a3a5b1ccfe4371036b0c4153458be
SHA256 5272b9712c21b85da266a21a40944cc642c331839752af0c43e35db98ce542f6
SHA512 dd1e8128ef792456c7b429b08418352429b536dd5bc205d3f636664d7eb3c06bde0a0ac5340fb0e5cd495747c147aa8a567fc20fc7b4e040d4d81273868443a1

memory/2228-32-0x0000000000450000-0x0000000000480000-memory.dmp

memory/2228-33-0x0000000000C80000-0x0000000000C86000-memory.dmp

memory/2228-34-0x000000000A820000-0x000000000AE38000-memory.dmp

memory/2228-35-0x000000000A310000-0x000000000A41A000-memory.dmp

memory/2228-36-0x000000000A200000-0x000000000A212000-memory.dmp

memory/2228-37-0x000000000A260000-0x000000000A29C000-memory.dmp

memory/2228-38-0x0000000002670000-0x00000000026BC000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3636 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe
PID 3636 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe
PID 3636 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe
PID 4036 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe
PID 4036 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe
PID 4036 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe
PID 220 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2449513.exe
PID 220 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2449513.exe
PID 220 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2449513.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe

"C:\Users\Admin\AppData\Local\Temp\cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2449513.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2449513.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
BE 2.17.196.152:443 www.bing.com tcp
BE 2.17.196.184:443 www.bing.com tcp
US 8.8.8.8:53 184.196.17.2.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe

MD5 d081767b3ebd2d7a9f764ffdc139b168
SHA1 324dad2bd1bcb73d4a86a95b9cfc80eb72f1c13f
SHA256 1a1bf62585b043a497f850e2097e2c2c302220b510ac659141202b160b406dba
SHA512 64fd3d036809f81a37021617148aaf59edf58c8b34d61cff6014d32a672a3c9b6443dbb972ff82b9222516852a51bd7eab4058c0486d1c53d8dfdc64022c85ef

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe

MD5 1be061f2129856d382bdd733e29d650d
SHA1 c4fb0dcb3492572568a006a780330bcd923b6fdd
SHA256 5d7ecfa5673031117f93ed47b53a3cd36d6b89e9a74cbb4ada57112be8d69ed7
SHA512 4ee268d6358592c1bdd78c56adcb94f6fdfa83333519e762860a1032d2578292a07fd8efc9b492ca08523fdd7e95bce27249d7bf9ccf5b45da01e3409c0423f1

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2449513.exe

MD5 17d5bd158552db313dbb6baa180c8473
SHA1 cbe14bf1767f5589b1923a0d4c1be1fd54292ae3
SHA256 d139a831bbd93c34c0a0e69bc443c5de93ba54dd39bfa4301cc6314d0e8d8352
SHA512 2f1a8c10ca00b75cdaa9255254988926390c48950f2e8dc85aaca875e9ca9d41c24797c76c584f750f51f072692f1c7dcec3e58a3825663a7a640b926a21d3f4

memory/4980-22-0x0000000000401000-0x0000000000404000-memory.dmp

memory/4980-23-0x0000000001F60000-0x0000000001FEC000-memory.dmp

memory/4980-28-0x0000000001F60000-0x0000000001FEC000-memory.dmp

memory/4980-29-0x00000000024C0000-0x00000000024C1000-memory.dmp

memory/4980-30-0x00000000024D0000-0x00000000024D6000-memory.dmp

memory/4980-31-0x0000000005150000-0x0000000005768000-memory.dmp

memory/4980-32-0x0000000004BC0000-0x0000000004CCA000-memory.dmp

memory/4980-33-0x0000000004CF0000-0x0000000004D02000-memory.dmp

memory/4980-34-0x0000000004D10000-0x0000000004D4C000-memory.dmp

memory/4980-35-0x0000000004D80000-0x0000000004DCC000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-05-09 17:35

Reported

2024-05-09 17:39

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3540 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe
PID 3540 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe
PID 3540 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe
PID 3840 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe
PID 3840 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe
PID 3840 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe
PID 3724 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe
PID 3724 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe
PID 3724 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe
PID 1628 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe
PID 1628 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe
PID 1628 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe
PID 1628 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe
PID 1628 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe
PID 3724 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8416204.exe
PID 3724 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8416204.exe
PID 3724 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8416204.exe

Processes

C:\Users\Admin\AppData\Local\Temp\edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe

"C:\Users\Admin\AppData\Local\Temp\edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8416204.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8416204.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 177.196.17.2.in-addr.arpa udp
BE 2.17.196.177:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.48:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3665369.exe

MD5 88773599612927c81ecef94a2c1cb259
SHA1 736875eb05d6591ff1a9685404958daa9ac738df
SHA256 3ae06bd179618c3c48444faded7da364e22e85b4131f0c400971d677460e5800
SHA512 3750866571c7a21ea0eed8697c1bfafefba56bc1bf38b74dbb262eed43a71da9f61a477544b19acc70bb3a73c26b3e386ffffb5aadef14908c9a5aec487a14f9

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9691337.exe

MD5 d04de7179f8c93e437ace78dd63a696f
SHA1 c95ef97c25606182390722946446f2f02d833923
SHA256 c851a481fffee75f3f360ae3f0827f8df9756435fd08ae4e60854573db317067
SHA512 02250e2205231677194bc37459dc21fea827ea89e2acbae2231e0031a0c535ae434d5773762886b70547e466d3af71c2d4368c3df4e34e9ca7c616a7ddc61197

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4825974.exe

MD5 e13583e7ee42802adbeec105f49fce0c
SHA1 c4c756c6d8f337db93bf24230dc40e443155ba29
SHA256 6d2beed5cea3792f6114184da5355d0d9f4e8ae72a1eebb169d57e2f3ee10fec
SHA512 ad5d7df026cc83e4c7cd31783a8a32612ff7e2f6330f5184aba6576b5f1d8b13ca1a955483e40aee3fb04d41d78b0e57a408f17e8eb7bb3e0ed150136c23f76e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4278579.exe

MD5 f7fd74cf9422244d88d0f989eab1bd5a
SHA1 3dea8ab8e08324c952a30dc0973e07556c73bcdd
SHA256 5e9c2e2a27311859ff0200fb786743589b04c5db27ce9696c32f01091f94deee
SHA512 0ff7e267e2e7940fb92d6f20f6aa1a05ccf33ecb2b975ab52db0c96ea0e1a4c3eab67562da3a70107ee3ed390559fd1a274f3c2db7531ed92be2934b1041dcc8

memory/4468-28-0x00000000005F0000-0x00000000005FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5934250.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2364-37-0x0000000000F00000-0x0000000000F0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8416204.exe

MD5 8538b3c88d840e9739967c70ffd433a3
SHA1 e072f6bffa09ebb88d2db47b23d98c5d85332926
SHA256 8fdd24124ab1156cf0f5b475254cb1405acb713249ba8b770e3e218c515db5b6
SHA512 efcc66e144067f4a54e92b6fe1d050ee8de4101d984d94e92c562f525d39850042e78d054b80fdf8299eb342bf4a5863b1cd9efc460aeea870845597692972e9

memory/4904-42-0x0000000000450000-0x0000000000480000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4904-47-0x0000000002610000-0x0000000002616000-memory.dmp

memory/4904-48-0x0000000009F30000-0x000000000A548000-memory.dmp

memory/4904-49-0x000000000A550000-0x000000000A65A000-memory.dmp

memory/4904-50-0x0000000004A80000-0x0000000004A92000-memory.dmp

memory/4904-51-0x000000000A660000-0x000000000A69C000-memory.dmp

memory/4904-52-0x0000000002490000-0x00000000024DC000-memory.dmp