Malware Analysis Report

2024-10-16 03:46

Sample ID 240509-wh1cbsaa24
Target red.zip
SHA256 292b6242a8248f18030260bd0c373ec14be1362f7f7494bca33e42fcc97580b0
Tags
evasion persistence trojan amadey healer redline smokeloader news backdoor dropper infostealer crazy nasa krast kira lande 5345987420 discovery masha zgrat rat lamp
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

292b6242a8248f18030260bd0c373ec14be1362f7f7494bca33e42fcc97580b0

Threat Level: Known bad

The file red.zip was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan amadey healer redline smokeloader news backdoor dropper infostealer crazy nasa krast kira lande 5345987420 discovery masha zgrat rat lamp

RedLine

Healer

RedLine payload

Detects Healer an antivirus disabler dropper

ZGRat

Amadey

Detect ZGRat V1

Modifies Windows Defender Real-time Protection settings

SmokeLoader

Drops startup file

Executes dropped EXE

Checks computer location settings

Windows security modification

Checks installed software on the system

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Launches sc.exe

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 17:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win7-20240221-en

Max time kernel

118s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe

"C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 36

Network

N/A

Files

memory/2072-0-0x0000000000080000-0x0000000000081000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6547f1c95bc0b060cd5e5f6b8e5e968b730cd21f758f6dd5371e802b13a5a1de.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\6547f1c95bc0b060cd5e5f6b8e5e968b730cd21f758f6dd5371e802b13a5a1de.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2000 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\6547f1c95bc0b060cd5e5f6b8e5e968b730cd21f758f6dd5371e802b13a5a1de.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe
PID 2000 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\6547f1c95bc0b060cd5e5f6b8e5e968b730cd21f758f6dd5371e802b13a5a1de.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe
PID 2000 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\6547f1c95bc0b060cd5e5f6b8e5e968b730cd21f758f6dd5371e802b13a5a1de.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe
PID 4068 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe
PID 4068 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe
PID 4068 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe
PID 3364 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3364 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4068 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe
PID 4068 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe
PID 4068 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 1220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4400 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4400 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3000 wrote to memory of 4520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6547f1c95bc0b060cd5e5f6b8e5e968b730cd21f758f6dd5371e802b13a5a1de.exe

"C:\Users\Admin\AppData\Local\Temp\6547f1c95bc0b060cd5e5f6b8e5e968b730cd21f758f6dd5371e802b13a5a1de.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x180,0x184,0x188,0x15c,0x18c,0x7ff82ece46f8,0x7ff82ece4708,0x7ff82ece4718

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3552 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5348 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x498 0x4a8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8680313258751025889,4372306206661724062,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2728 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
GB 172.217.169.46:443 www.youtube.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
GB 172.217.169.46:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 142.250.200.22:443 i.ytimg.com tcp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 22.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
IE 209.85.203.84:443 accounts.google.com tcp
IE 209.85.203.84:443 accounts.google.com udp
US 8.8.8.8:53 84.203.85.209.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 142.250.200.42:443 jnn-pa.googleapis.com tcp
GB 142.250.200.42:443 jnn-pa.googleapis.com udp
RU 193.233.132.62:50500 tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.187.206:443 play.google.com tcp
GB 142.250.187.206:443 play.google.com udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 youtube.com udp
GB 216.58.204.78:443 youtube.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
GB 172.217.169.46:443 www.youtube.com udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.226:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BE 88.221.83.226:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 226.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aq8fa68.exe

MD5 e1ca89e321f8198d4253c9178eb523ff
SHA1 fe072ee589998082c37b054c4d8e4f0a6aa4eeb7
SHA256 3e36cb02ee15f0803929c4cc4ae0639ce652b40ae83519e020dc3e5273dde39a
SHA512 af0d2629e4fce28b141f77762d351ff64c64fc965b9fd51bad073948841c6ea19655e34a7d1aed30837c67cac6e0e5f8af52e9eca07d58a77fdf3d213cd59f2d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1aF72hB0.exe

MD5 3e82adb682d9d441331dde8a3c888f6e
SHA1 6dc1fe6731402b85d721946e65559a375878a3e1
SHA256 4b87018ae58796055ba9ae76bc21519c1e51f7dcfa79344b27047efec6d9d666
SHA512 f346d6eea780ae0cf5faf8fcbb7815a0c461de710a013ac5106c9eaad31dd778765c8709550911921653a13c3e94e5d860b472a671944b51edfa840c019ccca7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Xd7831.exe

MD5 fb69bac77dd5e98885e6caea73271736
SHA1 51ad255e0b6ffe879375c4cda30f8791a13e1c55
SHA256 302f18643a0476b96ae334230de72d315f753902124fbb9b97d73d73941eed7e
SHA512 3558688f41a573793d4d717316b1243d1371bb02f7f2c41a5156c60fdbc66a38ab36ce0f3c57f6fb4f4da5b546b6f18eff663d5647829432c02ce2693f856716

memory/4136-17-0x0000000000C60000-0x00000000010CC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

\??\pipe\LOCAL\crashpad_3000_TRGPUKXJVUYJGLRX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

memory/4136-35-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-36-0x0000000000C60000-0x00000000010CC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 46b02b5ff06d8777563509ce5329bf19
SHA1 d9aec33f17941cbf045baeafb702d8ce1130f6b0
SHA256 33747d3e4633021ece9376f777a9716baabe1d46722fe411c284e3287cfd64ab
SHA512 0d624f399ee379a2ce2c1f63d0e71c60f30742bb05fbba2597fb7d0f5ff36a5325753ec0e9ec7d45c62220966a8b0659795babf2feabe9adf3b34bdd717f6ca2

memory/4136-42-0x0000000008EB0000-0x0000000008F26000-memory.dmp

memory/5064-45-0x0000000002680000-0x00000000026B6000-memory.dmp

memory/5064-54-0x0000000005170000-0x0000000005798000-memory.dmp

memory/5064-58-0x00000000050B0000-0x00000000050D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utl4vpvh.tzh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5064-60-0x0000000005810000-0x0000000005876000-memory.dmp

memory/5064-59-0x00000000057A0000-0x0000000005806000-memory.dmp

memory/5064-72-0x0000000005BB0000-0x0000000005F04000-memory.dmp

memory/5064-74-0x0000000005FA0000-0x0000000005FEC000-memory.dmp

memory/5064-73-0x0000000005F70000-0x0000000005F8E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 83ea08822becb6563019281c71661ee6
SHA1 e079e53ccea7000bc7f8e01c846b2aa681ed9192
SHA256 10226246a79872f16ffcc3f345885d469b584a20236ca9a9834dedf0cc0e7240
SHA512 d2355d69f32ab3957638ff73c5c34ffb2877366cbb03a321b66591f1cca527eb7b9ceeca14fded47e88d5fc6d1484bdbb8b0c57ca12689790140c4ef97a52109

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 be182ed9ac62e462f85b0d7ae67798c8
SHA1 84da767480f7dcfb64a995938d118cef5282a004
SHA256 b2948477f8aceacffcf716a12dc83eed1a099f0db37a374491ec2cb9c3526bb3
SHA512 24b1a63c427f5c3c9464dcc97ce4e21a27907340cb630c14215e02a2679232ac9d36788a51096f02db44cc08be9afc8fa8ea9bf311cd2bb2685955beec6d3ba2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 ca390c3e73163d4f8bdeecc332d94bef
SHA1 542c913c51719538c0f680e21bdb58f505198684
SHA256 d831ab4fc8fdd8a4368243f0377f6a9caa221c05426b6201945b09062540021b
SHA512 52ac278d4b7965aab285ab65b989d5bc4f6caa03ad2b82a6012bd318f569d0a4640074ba59710726bfa575ab6d091d149a5549ab14350b0b98935398bda3d943

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/5064-121-0x0000000070150000-0x000000007019C000-memory.dmp

memory/5064-120-0x0000000006540000-0x0000000006572000-memory.dmp

memory/5064-131-0x0000000006580000-0x000000000659E000-memory.dmp

memory/5064-135-0x0000000007190000-0x0000000007233000-memory.dmp

memory/5064-140-0x00000000078E0000-0x0000000007F5A000-memory.dmp

memory/5064-143-0x00000000072A0000-0x00000000072BA000-memory.dmp

memory/5064-144-0x0000000007310000-0x000000000731A000-memory.dmp

memory/5064-149-0x0000000007520000-0x00000000075B6000-memory.dmp

memory/5064-153-0x00000000074A0000-0x00000000074B1000-memory.dmp

memory/5064-262-0x00000000074D0000-0x00000000074DE000-memory.dmp

memory/5064-263-0x00000000074E0000-0x00000000074F4000-memory.dmp

memory/5064-264-0x00000000075E0000-0x00000000075FA000-memory.dmp

memory/5064-265-0x00000000075C0000-0x00000000075C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f9a37d7062f04820a29a4b3661393118
SHA1 4bfa5bb7fa860b33277992d539711332b0b6428f
SHA256 f05f5d9517b1594468f7a1a3245f9c02040875e36fb44fc76dd2f2f0ee279128
SHA512 8821115bbf348a19dcc353eaa5559f6f923a1cc4ab98f677c2c41b3508d9887cae59a65cb1e48ab6f69427ef8e01fc8ae6517dbcde6db74f94d000918e17ec3d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f7a8f76429315d2e4c8bd62da6643358
SHA1 115720cb444315162793b0afcc1025e8872f0ae6
SHA256 b29bd748adaeb944e5621beb476734932e8eb90c654744ce0ca84247bcec562a
SHA512 a60d68d66603c715981e9937e75e9ef6f69b71ce8254f4a17345ef96e062926fda0f04e71bf329bb6b2550a7ab722d99e31222d88673fa23fb41a87a65bf6af1

memory/4136-307-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-310-0x0000000000C60000-0x00000000010CC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579bb3.TMP

MD5 67a52ba1df14652b6cda743f5825fa7a
SHA1 f7732074cff1dd66847e1ebe9483727215c1cb98
SHA256 51604b2dfa8b1a07335c1a51f92a252d717d7c14ba943400ee663f012f2fc78b
SHA512 615aae3260ba9100ebb5ccb231e57840227fb6765fb63ff42355214648e34340c4ed89c387046348a63fe93485db37a160dc2bee3dff8b63bafe7084296a6baa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 d9ad6ac3ab39cbb41f274e2942b630f3
SHA1 07ecf23669ce603e8d5561becac4370f1711ac1d
SHA256 ab328fa3f60c764c4e534f2cc07c5687b59b12e2437994aa327887f8ceba5acb
SHA512 ff4dc46dd81cb76380600cb21a257618de519f8bc97268f472d52e9ad9b52075260c1fc660b2b72df7fdbb008652d8f3ad9c871f5d51c3a5bcb93e3171bcf008

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\25566621-4093-4152-9388-088ffa98a216\index-dir\the-real-index~RFe57a170.TMP

MD5 b76fd10c4b3646530f9ba7bb0ad470ee
SHA1 2171442921c7d02542975660284e68ffcab86d78
SHA256 44005d9ea180acc0111a8fc65cafa61ce8edbaa64cdd26b0eebc317a12b5c364
SHA512 3e6cdb23af36c6633f93af40d6b9aaefba5479e0b9de6f14b1547dd31ef6fa0e46d8acef90704e5216c9966df790fbc8c6850b8e477ea37c17c026fd0ee2ea7d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\25566621-4093-4152-9388-088ffa98a216\index-dir\the-real-index

MD5 ebb3eca8dca7160f47ca1f782897ad8e
SHA1 9ca078166885e401c96502487b1ec23e89d348cf
SHA256 20a7bfcc082cd307526b250e62dd83b0fba1d7a677916178468ed4fbda60e539
SHA512 95f6ed7b58a350a4dc741a1701200f3aba377c66f94aef0a2f6f3317f91119b6a6b5ae451739912b970ae10b5d20147379324bf8705b7ca334a9be7beb2cd66d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 227f40dede2a87b399778889ab8b19ef
SHA1 89e5a6fe283a7d33554787183e63fd852c650785
SHA256 4908578efc3f0f3a7caab4d0c877035c3b66dfaf5ad6c340d673ecf8e7e2ad9e
SHA512 7c989fcb2435579a0cbf23720da2e0389cb3bf68913c384006858cf46ce3c2d179c0ef89da62e3819212bff30a96af960996a464d201f4680f1547ae17f96a70

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 085df08173891016a2a1d5e1347ad812
SHA1 3155b0c54f011540fcd839671f1da46250b191ec
SHA256 7723343a3014a4cad351bb4f7dc4d64ab20815b3871602cf68139d85c8a21502
SHA512 d24366d523d2c551899eb9fcbd10e4f3f4e3d55ba69cd9a8f8581b9a7b58a2606c0883a67483d5b7d3150056698ece509edb07220ccbac6c856cfa5e9f1ca199

memory/4136-352-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-353-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-354-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-355-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-370-0x0000000000C60000-0x00000000010CC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 a124ad97e6733c4f0eb72ca157c54310
SHA1 2cc623c0b2a2ddf2b602247632e8a04dc8f7d8a7
SHA256 e3ebd50dafcaa0be352628686a1c398f6ce825a940d993e89ceb5973ff12485f
SHA512 d56f0f8e436bbebe77989f8f62c8ef3e0a9044c93024c0ba0c719d2007ca454fd2e54f2f89ba6925764ef9cfde96eb18aed08e8b977a75f3a6dcc303330a6e3a

memory/4136-394-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-395-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-396-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-397-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-398-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-401-0x0000000000C60000-0x00000000010CC000-memory.dmp

memory/4136-402-0x0000000000C60000-0x00000000010CC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b02c1d45-8628-4684-86de-b46fc0b1b6f7.tmp

MD5 b41d3c497e71c9addabfcb8496e64c82
SHA1 f0d2eee2da23b804ccd055590930f9afd7a255e7
SHA256 d6e773fc7ddfe9b9d0fa6454c633cb6520e0007677d2ea043872a38631a76af3
SHA512 e8a991efa4af5fe7af4721a0997c644094b8ea191fa1fbf70b8619313ed320de02451e249d39f327f1a8aa75e6cc6a335494ebdae43ff2e20337aade73a526be

memory/4136-414-0x0000000000C60000-0x00000000010CC000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2432 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe
PID 2432 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe
PID 2432 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe
PID 2488 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe
PID 2488 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe
PID 2488 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe
PID 1056 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe
PID 1056 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe
PID 1056 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe
PID 1056 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe
PID 1056 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe
PID 1964 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1964 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1964 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2488 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe
PID 2488 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe
PID 2488 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe
PID 2976 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2976 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2976 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2976 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2976 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2976 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 5012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 5012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 5012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 760 wrote to memory of 4624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 4624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 4624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 3632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 3632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 760 wrote to memory of 3632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2432 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe
PID 2432 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe
PID 2432 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe

"C:\Users\Admin\AppData\Local\Temp\6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.209:443 www.bing.com tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 209.83.221.88.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 52.111.229.43:443 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0977630.exe

MD5 9b497b6b1e005de6a787c0bd9d1272fa
SHA1 10e84675f9eff72d4a99c1bf6110797dc5c69f0d
SHA256 13bbb6f14ebbd1a2b4a29fd6996f6ac546b555d0f8b264c0ad971466e4633ebe
SHA512 d8569d11f1c047baf36182282e32c0184bca286b7c40d2a1633fd876b635810d492ca4818c343d3b79e25dbda7dbbc38dc76b3bb40900e9be5b1b784dd188911

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7545579.exe

MD5 86958943dd057021da6c771b6453b53a
SHA1 2738978ca7570c32c278b1d4010f39ac69e9fa8b
SHA256 3f700054b2901755279893023f905c92bbd13e4797f45cbcc0c3711aad4ffd78
SHA512 c4ef49c0462b4b9bce612d8f0c4f6be172159ebd58eb82c53963773a712fc297cd7cf67537a01040dc7c643eeae3c16fa0a3a5b36e0adecdfd790bc54054b94a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a0144100.exe

MD5 3dee36b75657e42f643591ceac6af15a
SHA1 4c2de5072a1ca02bbc13d99e5be250807b3563fd
SHA256 d7a2203f9712448ce305e60cfdfdc8faa013fb121417a2ee41c676e49c3c87d9
SHA512 bcf1886345d8eccd330fa569f15b52be13b8f4a813a9d722c74b52cdf4c2c2d9611985fab51224f298f9554feeb24d3bfc92def9256258e1675567cdf96e928e

memory/4372-21-0x0000000000FF0000-0x0000000000FFA000-memory.dmp

memory/4372-22-0x00007FFAE0BE3000-0x00007FFAE0BE5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b6446034.exe

MD5 1dc772e6085ff2515e39f3c9f98471ef
SHA1 6fb28af6f8bc753525323797c71a3598872a345e
SHA256 f5f062d5f2c9563dbaef81eda64958605b77ba1becbe272f1e8a1bff78e76cfe
SHA512 76ec2f514ba9290fc88ba22aec3bdfb0c93eda47bb038db0a37a05ff72fe62e33e08e8de0f1470399299397e894f6f3209e212690eaa076cf675d41aaa69f873

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c4034930.exe

MD5 203da1f790ddfa54124b731334a820df
SHA1 4b8478a077b4053ff9f69705f888aaeecefc14dc
SHA256 47a99c2f3c457d009db77e5985d95a96dd4be2ab35d64c53516a196e5ed35d7f
SHA512 a631197e543edbeae0d256676513a2371f1ff539f26c102894d270bad9541624c0a15cac69e209d132b78af9e08e334a1dedcc660d7afcdd614793bd5babc989

memory/808-39-0x0000000000400000-0x0000000000409000-memory.dmp

memory/808-42-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d5914663.exe

MD5 89351eab443679ae0585e5d0c1515274
SHA1 7828c9bcd09ef64234b58c41e2ff15ffd08db306
SHA256 123f04ade0250cb30a448146ce4b74429ef38cd2811dce57126ef47db84f5bf6
SHA512 5983d02df411cf86d49e5a90b1f0d56200b3e31c187d3c36002f84657646950d1377f1fad039cc57df4757c524798d6d12c9df4633537438a55a75563f8ead8c

memory/2200-46-0x0000000000E60000-0x0000000000E90000-memory.dmp

memory/2200-47-0x0000000003170000-0x0000000003176000-memory.dmp

memory/2200-48-0x000000000B290000-0x000000000B8A8000-memory.dmp

memory/2200-49-0x000000000AE10000-0x000000000AF1A000-memory.dmp

memory/2200-50-0x000000000AD50000-0x000000000AD62000-memory.dmp

memory/2200-51-0x000000000ADB0000-0x000000000ADEC000-memory.dmp

memory/2200-52-0x00000000030D0000-0x000000000311C000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4536 set thread context of 1328 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe

"C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4536 -ip 4536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 152

Network

Country Destination Domain Proto
RU 83.97.73.129:19068 tcp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
BE 88.221.83.227:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 227.83.221.88.in-addr.arpa udp
RU 83.97.73.129:19068 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
RU 83.97.73.129:19068 tcp
US 8.8.8.8:53 107.211.222.173.in-addr.arpa udp
RU 83.97.73.129:19068 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

memory/4536-5-0x0000000000BD7000-0x0000000000BD8000-memory.dmp

memory/1328-1-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1328-6-0x000000007440E000-0x000000007440F000-memory.dmp

memory/1328-7-0x0000000000FD0000-0x0000000000FD6000-memory.dmp

memory/1328-8-0x0000000005670000-0x0000000005C88000-memory.dmp

memory/1328-9-0x0000000005160000-0x000000000526A000-memory.dmp

memory/1328-10-0x0000000005070000-0x0000000005082000-memory.dmp

memory/1328-11-0x00000000050D0000-0x000000000510C000-memory.dmp

memory/1328-12-0x0000000074400000-0x0000000074BB0000-memory.dmp

memory/1328-13-0x0000000005110000-0x000000000515C000-memory.dmp

memory/1328-14-0x000000007440E000-0x000000007440F000-memory.dmp

memory/1328-15-0x0000000074400000-0x0000000074BB0000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3304 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe
PID 3304 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe
PID 3304 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe
PID 2576 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe
PID 2576 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe
PID 2576 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe
PID 2576 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe
PID 2576 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe
PID 3864 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3864 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3864 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3304 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9717486.exe
PID 3304 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9717486.exe
PID 3304 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9717486.exe
PID 2212 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2212 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2212 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2212 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 1836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 1836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 1836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 4584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 4584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 4584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2016 wrote to memory of 4248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe

"C:\Users\Admin\AppData\Local\Temp\9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9717486.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9717486.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 203.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0515483.exe

MD5 8e8dcb69298862c8e668caadf000d56b
SHA1 64bd07301629ed835f94e66930aeb00de32a34bd
SHA256 6863fa04f26dac7fef86030b46197d1907eecdfc7c92c60c96c3b64fb0a7669c
SHA512 6392f331129ca9b1a6396d824d4f61fe6186256bfeffbb03fc69cf049201ed9c1b7de05ab219376ed7fc8b90dcb15f31b678c8213022b0089f77922a70db5d48

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5883440.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4068-14-0x0000000000580000-0x000000000058A000-memory.dmp

memory/4068-15-0x00007FFF46CF3000-0x00007FFF46CF5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7898422.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9717486.exe

MD5 b9e7e782e124ec5b7c10fad805071842
SHA1 0c319f4c35e74909f338a72dc0330a6891194006
SHA256 02ddd4c1d829c57774b953c38da94fd99faca421aaab4a8db877433b66dca9f0
SHA512 6377d68363b458404e9a3b167983720fa94fa7b3d2e6e5f3e419a8b40c238d0ec4976756572faaf9a331a496e823dd6ea348b48fd42b694299fce16a285c7607

memory/1028-33-0x0000000000C80000-0x0000000000CB0000-memory.dmp

memory/1028-34-0x0000000002F00000-0x0000000002F06000-memory.dmp

memory/1028-35-0x0000000005CF0000-0x0000000006308000-memory.dmp

memory/1028-36-0x00000000057E0000-0x00000000058EA000-memory.dmp

memory/1028-37-0x0000000005500000-0x0000000005512000-memory.dmp

memory/1028-38-0x0000000005560000-0x000000000559C000-memory.dmp

memory/1028-39-0x00000000056D0000-0x000000000571C000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win7-20240220-en

Max time kernel

122s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe

"C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 92

Network

N/A

Files

memory/1508-0-0x00000000008A0000-0x00000000008A1000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3176 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe
PID 3176 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe
PID 3176 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe
PID 3032 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe
PID 3032 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe
PID 3032 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe
PID 3032 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe
PID 3032 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe
PID 1028 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1028 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1028 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3176 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0719762.exe
PID 3176 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0719762.exe
PID 3176 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0719762.exe
PID 1096 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1096 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1096 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1096 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1096 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1096 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 1232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 1232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 1232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 4720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 4720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 4720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1052 wrote to memory of 760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe

"C:\Users\Admin\AppData\Local\Temp\50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0719762.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0719762.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 203.83.221.88.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 52.111.227.11:443 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6113972.exe

MD5 28b95f5298f01087e4a6f83eacb5d2c0
SHA1 1d7104dc75153497ff6b1b617d7553adc8770fdb
SHA256 c944881d4954b33e789d004b85f14bbdd0f1c6d780efd272c08459049d358f48
SHA512 2f878bd71b07c64cba93724acccd81b5df3830800b48ee1c65a08fecd6779c7371213305367c93615185275492801604a10d7cbb5393f1271ac38029a9d21865

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1282336.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4444-14-0x00007FFBF7AC3000-0x00007FFBF7AC5000-memory.dmp

memory/4444-15-0x00000000001E0000-0x00000000001EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4375569.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0719762.exe

MD5 cf7730bfe63aa718777f8c5502d13e68
SHA1 86992691be36d5e4cfe1a7b145cdec21ac001225
SHA256 7cdfdcb99c22bd7a9535439775b3f4a6fd77f96fedc974811f3e60c5f91416de
SHA512 0b6c17b9c690b614b789a396b9ecea841842a7136a81f32ec1a173808de9ce9dc77643f6862a3cfb0c8fe1912cbb5d829bba7375e8015e51070ea4651c4e324b

memory/1228-33-0x0000000000280000-0x00000000002B0000-memory.dmp

memory/1228-34-0x0000000000A70000-0x0000000000A76000-memory.dmp

memory/1228-35-0x0000000005310000-0x0000000005928000-memory.dmp

memory/1228-36-0x0000000004E00000-0x0000000004F0A000-memory.dmp

memory/1228-37-0x00000000025B0000-0x00000000025C2000-memory.dmp

memory/1228-38-0x0000000004C80000-0x0000000004CBC000-memory.dmp

memory/1228-39-0x0000000004CF0000-0x0000000004D3C000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win7-20240508-en

Max time kernel

132s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1244 set thread context of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1244 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe

"C:\Users\Admin\AppData\Local\Temp\53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"

Network

Country Destination Domain Proto
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp
RU 83.97.73.129:19068 tcp

Files

memory/1244-0-0x0000000000C87000-0x0000000000C88000-memory.dmp

memory/2188-1-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2188-2-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2188-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2188-9-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2188-8-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2188-10-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

memory/2188-11-0x0000000000650000-0x0000000000656000-memory.dmp

memory/2188-12-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2188-13-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

memory/2188-14-0x0000000074D30000-0x000000007541E000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1432 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe
PID 1432 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe
PID 1432 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe
PID 3504 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe
PID 3504 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe
PID 3504 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe
PID 3504 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe
PID 3504 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe
PID 3504 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe

"C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.107.113:443 www.bing.com tcp
BE 2.17.107.113:443 www.bing.com tcp
US 8.8.8.8:53 113.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 107.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe

MD5 2fa0b20366653721bfd1f84d5b98b444
SHA1 c773631701fe88e4005f677f6c1ef79214e86b67
SHA256 fc2efa5d597bb9ee814cf60cad1a3bd950f888f9872e9eb0641122d6970f1b4e
SHA512 55c6446678428d769252290284b4fb7e8754e2bea6eec83aa69c89265d73bbadd5960ccb4a3fcc72814adfe3ba9210695047d20fde33db059896cb8dd8f36b46

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe

MD5 d34061162711706e5dd2ab26f14dcb48
SHA1 6d82cb68928bdff681abb7d57e189134b423cbb9
SHA256 d9acdfeecdcc8d68575f0b12776b8de817879244b722cbfce99bebee466e058a
SHA512 030b52f1fdf8e23d5928804f83b885eef245c4997bfde8cf84f553b17495c5e2480c0586f646c93fa229c1dde281d296e766880bf7a13efd70ba0fe8d4273379

memory/2884-14-0x0000000000401000-0x0000000000402000-memory.dmp

memory/2884-15-0x0000000000510000-0x000000000051A000-memory.dmp

memory/2884-19-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe

MD5 c1324e71cf7b600ddcd634bd62a66011
SHA1 c4931a75b47ef4d24cb2d207ef2541d632fcd9a1
SHA256 76fa42dfdd3e0ada08e4534c0cd169ef3d15c0561ca01074b43f621e885011d7
SHA512 1ff9c15bb553dd793413ad5f58b02c45bbeeeea5663235132c5771e6ff5b917c1a4985790682200c94b44d617b795b9846d81904226431389b5f185c26c3332c

memory/4912-25-0x0000000000510000-0x0000000000540000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4912-30-0x0000000002060000-0x0000000002066000-memory.dmp

memory/4912-31-0x0000000009F70000-0x000000000A588000-memory.dmp

memory/4912-32-0x000000000A590000-0x000000000A69A000-memory.dmp

memory/4912-33-0x0000000004B80000-0x0000000004B92000-memory.dmp

memory/4912-34-0x0000000004BA0000-0x0000000004BDC000-memory.dmp

memory/4912-35-0x0000000001FE0000-0x000000000202C000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe N/A

SmokeLoader

trojan backdoor smokeloader

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e3182762.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e3182762.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e3182762.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3788 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe
PID 3788 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe
PID 3788 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe
PID 2212 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe
PID 2212 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe
PID 2212 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe
PID 2160 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe
PID 2160 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe
PID 2160 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe
PID 4804 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe
PID 4804 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe
PID 4804 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe
PID 4804 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe
PID 4804 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe
PID 2160 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4643628.exe
PID 2160 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4643628.exe
PID 2160 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4643628.exe
PID 2212 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe
PID 2212 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe
PID 2212 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe
PID 4052 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4052 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 4052 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3788 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e3182762.exe
PID 3788 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e3182762.exe
PID 3788 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e3182762.exe
PID 3504 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3504 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3504 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 3504 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3504 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3504 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 4264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 4264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4384 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe

"C:\Users\Admin\AppData\Local\Temp\d599ef82af0badf49dd8c6cc5d7bad517685798e47a31291d482c5768dae4e3c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4643628.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4643628.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4036 -ip 4036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 148

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e3182762.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e3182762.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 203.83.221.88.in-addr.arpa udp
BE 88.221.83.203:443 www.bing.com tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.3:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3957176.exe

MD5 0eb146aff03fe3691adcd9f4868a2c92
SHA1 79a2705a7ad866a6ac6b910f6cdc19244e46a994
SHA256 676f02befb31399a6056351d7af6a8f4f6c184d4a37138d258cdbea305e85941
SHA512 a34b7ffd2724090bf6ec2f640b5e19e68e5c0ce9504755df9a424518448dd6a1d72d12dd35cfb9b035053828fcc2109257772279a0e2b430d57788e6a3f55df9

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8736931.exe

MD5 b39241026c1ed186cd4e42ddd7ea348a
SHA1 4a8544ff1953a55310fdfc15fece4fe5a60b8ac5
SHA256 e2803c440127124b1b1f6b602ff0cb6a4005711fb94c31914495c81d3ed13087
SHA512 072e3b3b933d45b35c108bc5f9fe446df6e409493acbaa2c988515f08e2a9929b3065d9926d09401c884b4fa4bdff444c3b75e4a49a9752745f235286efd595f

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2754402.exe

MD5 7afd85a46bb49633882b3bf8d238809d
SHA1 672898304e1e65df9d340ecc3a982c6688b093bb
SHA256 936e76d0decaa39c3e8a0fc62b3922cff07afdf0d6ba9dbdef41eeed335133a1
SHA512 875bbe201b05cf389e4a670b137b4ffd1bc84b30b61bed4bacbc81a2f2a8f1bcc4ba8fe793f1a40e487b87d168b6913a2378b26512407a3147d1983fea5175a9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8618896.exe

MD5 e1937625c146013e91b004bd0c96c213
SHA1 398b955d16c4af75709052acd824faef6e329008
SHA256 d22288c81e07ac5f3646690dcb36b86e50aebd8e1e21908e34c14ac4593ba953
SHA512 1c3a32b21e4fbb32cbd7d985b166c8ecf31758ee826dbc8c27c1d2c5fe6d46fb9e0ba778053fcc91f8eae8da0543e887daa7b95950efa3cdcc77212b6a29ed06

memory/2016-28-0x0000000000510000-0x000000000051A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6736511.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1348-37-0x0000000000220000-0x000000000022A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c4643628.exe

MD5 78583f649f60e9165673deabb6edabf2
SHA1 b9baedff717ab749ada9ced5c32ac6620a121cd5
SHA256 2f32e68cd87ea35f818908033b87e62fa4a7bebbc62306d3ac80436f49de0feb
SHA512 c8791beb11d2f8a796b123a13768ec75bd225adfe53cc6deeb067d6d6a2f6c47cadfb7adb101834eb05e13259fe2a93747b2a44d309d0a76ecd0b55eb8cee8c1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d1546097.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

memory/1828-57-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e3182762.exe

MD5 35a15fad3767597b01a20d75c3c6889a
SHA1 eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA256 90ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512 c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577

memory/1828-60-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1428 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe
PID 1428 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe
PID 1428 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe
PID 4264 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe
PID 4264 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe
PID 4264 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe
PID 4264 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe
PID 4264 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe
PID 1364 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1364 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1364 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 1428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2381940.exe
PID 1428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2381940.exe
PID 1428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2381940.exe
PID 1596 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 1596 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 1596 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 1596 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 4004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 4004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 4004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 2964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 2964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 2964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 4124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 4124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 4124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 4284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 4284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1468 wrote to memory of 4284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe

"C:\Users\Admin\AppData\Local\Temp\d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2381940.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2381940.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
BE 88.221.83.209:443 www.bing.com tcp
US 8.8.8.8:53 209.83.221.88.in-addr.arpa udp
BE 88.221.83.209:443 www.bing.com tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 52.111.227.11:443 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3493246.exe

MD5 e30e7bb37197900b224d513bf491d4ac
SHA1 b7e2fa656095ba82def6410446f88c3b7f784d15
SHA256 3a4e621f407a95c60f3343139d38c1faeb187db0a9aa3d1b95dc8f09b04848c6
SHA512 e7a947fe80881d49f7153c85634913c344b123f5ec1d07341aa8a969389352decb6136f168b59ab1467723f06beaac7c24330a374b16eab27e6cebacb746b6e4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1056703.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1096-15-0x00007FFA542F3000-0x00007FFA542F5000-memory.dmp

memory/1096-14-0x0000000000D00000-0x0000000000D0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7933406.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n2381940.exe

MD5 0d9085f6725a2f95b4e38de514aaec88
SHA1 6ee08eef95c607a91d713d9d994ad8b701ee6228
SHA256 7bd6c2901ba566221d0a4d9cbbd98004cc65ea7ab27baa41fabd6a1fec632146
SHA512 ec8ddbc5d3294c77825c8dc7e28bb57a2b9a52732c4f0c5361fbb96c923a0d8fe8de9b2afc8140588a806e0800d91ee7c3d11fadc6eeeff033eaa03aeee10556

memory/2192-33-0x0000000000A10000-0x0000000000A40000-memory.dmp

memory/2192-34-0x0000000002EE0000-0x0000000002EE6000-memory.dmp

memory/2192-35-0x0000000005B20000-0x0000000006138000-memory.dmp

memory/2192-36-0x0000000005610000-0x000000000571A000-memory.dmp

memory/2192-37-0x00000000054D0000-0x00000000054E2000-memory.dmp

memory/2192-38-0x0000000005540000-0x000000000557C000-memory.dmp

memory/2192-39-0x0000000005580000-0x00000000055CC000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5100 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe
PID 5100 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe
PID 5100 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe
PID 1588 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe
PID 1588 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe
PID 1588 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe
PID 1588 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe
PID 1588 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe
PID 3944 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3944 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 3944 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 5100 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9594507.exe
PID 5100 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9594507.exe
PID 5100 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9594507.exe
PID 2376 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2376 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2376 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 2376 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2376 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 2376 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 1516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 1516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 1516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 608 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe

"C:\Users\Admin\AppData\Local\Temp\e7b8d2cb79d76cc4434f9525644c524179ad84cea43f8c12ee7ad387710dfc0b.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9594507.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9594507.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp
FI 77.91.68.3:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1165923.exe

MD5 6cf5b88a8f1de7c9d8bde4a2c15a9f34
SHA1 378d5d8fafaadea1c6b15492884b264a68363cd7
SHA256 40f3020f9d56e422e329ed6ab0348521ff90abbb3479bd6f905f6eca6a1ffa31
SHA512 183547b850b6b8041cd4dabba212d6ec353ce86ade1e1ba97d05f44fd044fa6324cf1a304403224f75e4ab0fcae2b74f3d05a564549a42833542cc034d5dd82f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2939922.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4536-14-0x00007FFD3F923000-0x00007FFD3F925000-memory.dmp

memory/4536-15-0x0000000000380000-0x000000000038A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1219188.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n9594507.exe

MD5 5bc8799c2299c3fd35a7e29516558771
SHA1 a9c2383a0962e3d5e4bd1aeab5980dbbbfcd67d8
SHA256 9e437b03e735e4c4ca66bae913a65735a33d7fe5dd9fcbf3ce0482ba7bd5ea66
SHA512 1aa21c0f9d557a95486b349a99433e241fe71b989061bed735c12ee631e2710a121066f6ba8660e860d1da3ad156122f856c7ed3b5b62217302e40a7a2df5a27

memory/3740-33-0x0000000000EB0000-0x0000000000EE0000-memory.dmp

memory/3740-34-0x00000000032E0000-0x00000000032E6000-memory.dmp

memory/3740-35-0x000000000B2E0000-0x000000000B8F8000-memory.dmp

memory/3740-36-0x000000000AE60000-0x000000000AF6A000-memory.dmp

memory/3740-37-0x000000000ADA0000-0x000000000ADB2000-memory.dmp

memory/3740-38-0x000000000AE00000-0x000000000AE3C000-memory.dmp

memory/3740-39-0x000000000AF70000-0x000000000AFBC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe
PID 2672 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe
PID 2672 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe
PID 2956 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe
PID 2956 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe
PID 2956 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe
PID 2080 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2080 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2080 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2956 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe
PID 2956 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe
PID 3952 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3952 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3952 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3952 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3952 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3952 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 4356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 4356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 4356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 3020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2224 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2672 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4694930.exe
PID 2672 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4694930.exe
PID 2672 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4694930.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe

"C:\Users\Admin\AppData\Local\Temp\1b26ae68f4d9a6a0bfd1a8c92489c6dcdb1a4e6ca483442c2b307329cdfb9345.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4694930.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4694930.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8270681.exe

MD5 c8209dae69220b506d54fcc21e59783b
SHA1 aa4c82181f758c0ffa39a5fc012a25098c4040c5
SHA256 dde0b9fb3a83891cb016ba0d2778ba3f3afaceb6a4749f38c3b704a9bde6d49e
SHA512 1c845e1d6b9e4537ba5f2dcb3dc53c02f238fd6cef6a87fbf4682ef67c71196d360fb2a24bb034965ebcc280e7ecd9086a58e1d201ba3d3380dd43e32110f8b9

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7379939.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2404745.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3196-27-0x0000000000EC0000-0x0000000000ECA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j4694930.exe

MD5 76faa0956c0773b8c302cb47600b093b
SHA1 c5e0a711681e6fc40a47e8f6b7e1eaa64be02ec6
SHA256 b68066492d0e6126ba4d01dbcdefb7c13a58b0d296aa279cf87eaa9d3b065c0b
SHA512 1d4740d16b3d0ec9f8e7f6045ad92a5533e6b6f2e697648383518bb8809159b6439410d7b86528c67bd2a967efb43819bb3cf5d3a17606c7c8cacafbfb5939e2

memory/4696-32-0x0000000000530000-0x0000000000560000-memory.dmp

memory/4696-33-0x0000000004D10000-0x0000000004D16000-memory.dmp

memory/4696-34-0x000000000A820000-0x000000000AE38000-memory.dmp

memory/4696-35-0x000000000A3A0000-0x000000000A4AA000-memory.dmp

memory/4696-36-0x000000000A2E0000-0x000000000A2F2000-memory.dmp

memory/4696-37-0x000000000A340000-0x000000000A37C000-memory.dmp

memory/4696-38-0x0000000002690000-0x00000000026DC000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240226-en

Max time kernel

158s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4452 set thread context of 4824 N/A C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4452 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4452 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4452 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4452 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4452 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4452 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4452 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4452 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe

"C:\Users\Admin\AppData\Local\Temp\6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.42:443 chromewebstore.googleapis.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 104.20.3.235:443 tcp
US 104.20.3.235:443 tcp
US 104.20.3.235:443 tcp
US 104.20.3.235:443 tcp
US 104.20.3.235:443 tcp

Files

memory/4452-0-0x00000000005F0000-0x00000000005F1000-memory.dmp

memory/4824-1-0x0000000000400000-0x0000000000422000-memory.dmp

memory/4824-2-0x00000000746FE000-0x00000000746FF000-memory.dmp

memory/4824-3-0x00000000057F0000-0x0000000005856000-memory.dmp

memory/4824-4-0x00000000062C0000-0x00000000068D8000-memory.dmp

memory/4824-5-0x0000000005D40000-0x0000000005D52000-memory.dmp

memory/4824-6-0x0000000005E70000-0x0000000005F7A000-memory.dmp

memory/4824-7-0x00000000746F0000-0x0000000074EA0000-memory.dmp

memory/4824-8-0x00000000746FE000-0x00000000746FF000-memory.dmp

memory/4824-9-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6c066f3c43054e87d83f1b9983162f080d1fb4f01c5d81ac389dad5406dc5119.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\6c066f3c43054e87d83f1b9983162f080d1fb4f01c5d81ac389dad5406dc5119.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1296 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\6c066f3c43054e87d83f1b9983162f080d1fb4f01c5d81ac389dad5406dc5119.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe
PID 1296 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\6c066f3c43054e87d83f1b9983162f080d1fb4f01c5d81ac389dad5406dc5119.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe
PID 1296 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\6c066f3c43054e87d83f1b9983162f080d1fb4f01c5d81ac389dad5406dc5119.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe
PID 904 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe
PID 904 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe
PID 904 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe
PID 908 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe
PID 908 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe
PID 908 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe
PID 3464 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe
PID 3464 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe
PID 3464 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe
PID 3464 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe
PID 3464 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe
PID 908 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2489469.exe
PID 908 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2489469.exe
PID 908 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2489469.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6c066f3c43054e87d83f1b9983162f080d1fb4f01c5d81ac389dad5406dc5119.exe

"C:\Users\Admin\AppData\Local\Temp\6c066f3c43054e87d83f1b9983162f080d1fb4f01c5d81ac389dad5406dc5119.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2489469.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2489469.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.203:443 www.bing.com tcp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 203.83.221.88.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
FI 77.91.68.48:19071 tcp
FI 77.91.68.48:19071 tcp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3594017.exe

MD5 6dcf605b283d99f56267f2b456b144b0
SHA1 07c2968c300b767ea952dfa70766de0f5e0a01e4
SHA256 338a566494a7bec1e3b1a3402a6411cdce4f6b9a43f91cf635b6e623e841b0b2
SHA512 19db68dbdb0a91825cecd2cc95dff3c4b6ea4e7bda9bd5133a8659889278e2050e52a19c7b2e3c92f3141ed5c0f01218b274b84b34750fb8f184dd1018d7f6ff

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6910325.exe

MD5 4b8bec8c7d90c10a6c3a4206cd0daacd
SHA1 3ee5c267c9f1941a77df3fe9f7496ee317c9b946
SHA256 5bbd2b8698ae1d319de29643dedf3409bb9dd36465d0819a5ee0f8d2bc699dc3
SHA512 21541e4b32b87567499a5630950c46d3cdb93daa1cd56bfff2fb510b3df2d1483973a183a4a7cdbd5f966f5af043999eb70b5fc41d47e6af2e743884062ffe74

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7180197.exe

MD5 b16e4a16f725f2433e720ce4e53b11c3
SHA1 d0ce61897edd0987c07973f8528843657059e1c7
SHA256 5cd250f298fde835d29a5626f9f04885e6ab5d2038524b54c17418a7803aa4ed
SHA512 805c1a61ca8023438f695bf72c69cf6e7eca12f0378ad7cf429607481da678c53eaea9bf0849505e493e83fbcab61abc240320f9d10d0633eb9c046a63e0fc03

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8123398.exe

MD5 168857576903636965cac80e95ea7283
SHA1 96d8cac6e77c26e6eb0f998486ab5fa944dcefd6
SHA256 929f8a773b6bd8b411cc67be1d2d091486dc07b342b953778f3bb11296e04013
SHA512 61af83f8484c30e950c940eba5cb112f3981ad408c8133d50a321e1239b16ebb0e031b8d683437386baf925734a103a76b904cdf1a8bff0090a144199df07ab4

memory/1036-28-0x0000000000420000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6245387.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/5016-37-0x0000000000C00000-0x0000000000C0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2489469.exe

MD5 e6cd29bf585e04ccee606ec312366e6e
SHA1 6ce37e0bce59a8902615918436a0e9f8771aedab
SHA256 0c52bae0af3af62e8abfeb1f39bef2518d59a00d62e3b0f8a3617f1b934192bf
SHA512 02258ada9982d2553c99abd3d8ecf5322aadfaceaa09373bd77029a43f743a55992206cc9d16394a112ef989a24bd96ba50cbaa0ec9557f207f8d42207c60100

memory/4824-42-0x0000000000540000-0x0000000000570000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/4824-47-0x0000000002060000-0x0000000002066000-memory.dmp

memory/4824-48-0x0000000004C20000-0x0000000005238000-memory.dmp

memory/4824-49-0x0000000005240000-0x000000000534A000-memory.dmp

memory/4824-50-0x0000000005360000-0x0000000005372000-memory.dmp

memory/4824-51-0x0000000005380000-0x00000000053BC000-memory.dmp

memory/4824-52-0x0000000005420000-0x000000000546C000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5024 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe
PID 5024 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe
PID 5024 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe
PID 3060 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe
PID 3060 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe
PID 3060 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe
PID 3060 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe
PID 3060 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe
PID 752 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 752 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 752 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 5024 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5696080.exe
PID 5024 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5696080.exe
PID 5024 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5696080.exe
PID 2208 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2208 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2208 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2208 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 1920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1100 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe

"C:\Users\Admin\AppData\Local\Temp\3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5696080.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5696080.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.219:443 www.bing.com tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 219.83.221.88.in-addr.arpa udp
BE 88.221.83.219:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0728975.exe

MD5 9cc42cc38736fdf07b728a32da081af4
SHA1 67ce6f975992c816f874b1867e8ec7be19efa2cd
SHA256 59924752aa75dd3a0534f535b1f605c40848bf4f7fdaded276d44e8cb657348e
SHA512 1cab1a385cad5081da2c6d86ddcf8a9dedfb102a93a6994e458a721efd4d0258ca8a3bf73e9d4d25198349c6da26a42d5072d44698aeddeea9d71fbabc2095af

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1408241.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/208-14-0x0000000000790000-0x000000000079A000-memory.dmp

memory/208-15-0x00007FFB9C983000-0x00007FFB9C985000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9468821.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5696080.exe

MD5 a4ff0e9e931a0084687ad5d812338aed
SHA1 6ddba896b9fd7ff59d89ed7e0452c4a3ab0e73da
SHA256 cc8ec5f11e19e39c19b393bb65293b0dba57876984d7c9899a97a8f3c2b43cf7
SHA512 5aa7861fc21b55505fed3681157a0d0a30fdd1d78cbb2454036f0529f37decfd7669a4eb5bd733d2fc3fca0c85c6c0fa38bb6eb025e94591f42ab9ef663b45e1

memory/1952-33-0x0000000000B30000-0x0000000000B60000-memory.dmp

memory/1952-34-0x0000000002D80000-0x0000000002D86000-memory.dmp

memory/1952-35-0x0000000005BC0000-0x00000000061D8000-memory.dmp

memory/1952-36-0x00000000056C0000-0x00000000057CA000-memory.dmp

memory/1952-37-0x0000000005600000-0x0000000005612000-memory.dmp

memory/1952-38-0x0000000005660000-0x000000000569C000-memory.dmp

memory/1952-39-0x00000000057D0000-0x000000000581C000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe
PID 2060 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe
PID 2060 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe
PID 4080 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe
PID 4080 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe
PID 4080 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe
PID 4080 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe
PID 4080 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe
PID 2780 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2780 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2780 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 2060 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t4774635.exe
PID 2060 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t4774635.exe
PID 2060 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t4774635.exe
PID 4532 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 4532 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 4532 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 4532 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4532 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 4532 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 3168 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 3168 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 3168 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 3492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 3492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 3492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 5020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 5020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 5020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2320 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe

"C:\Users\Admin\AppData\Local\Temp\ae66f2f0715075257fd7cda872646950fd845087e7735d1171fc72267d7c4707.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t4774635.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t4774635.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
BE 88.221.83.219:443 www.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 219.83.221.88.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
NL 52.142.223.178:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
SE 5.42.92.67:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4575459.exe

MD5 0fcf9bd4753b93185be2b31f52161be6
SHA1 21bae7d8090d81e8d411bc12cdac0b5f7476b5e2
SHA256 60769b17ad4bb4c6b3e44a8f222ca21f33b6167fe61ffd06e148a0d0235ab596
SHA512 a8415967a72b9012cd09822aeb9280e396704637a3298738c8b1093c9f552357c04bef3760fe62e7471539357cf41653f64d6f58559f918d8ed2d28494c67f9c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8160324.exe

MD5 62e08f66fca3b5fc9a3f6624a38fd20f
SHA1 6f3b427d87e4f8c045e24a280c597fec9ab4c42c
SHA256 7059693aa2a0f89fb51d5de5c77c53340bd48e33895c28f8dcc604521dffbfa5
SHA512 d8566437800709c1e40da61eb7bfee0debd61a6f7c9331ed7929f6cf8ce30709b90903a235543d4a1d78dab99e5f6bed70695ce3b238b94392bb6f346a53387d

memory/3068-14-0x00007FFFE4913000-0x00007FFFE4915000-memory.dmp

memory/3068-15-0x00000000003A0000-0x00000000003AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7057128.exe

MD5 ed853abe6e4d7338966e053579ab227b
SHA1 e298af34158e3658d74e21d4edaf08b6ea63cb2d
SHA256 00f8ae6daf2664fb85f5d2d593d937617fa0e41c0e00108aa6a876f834b5ee3b
SHA512 42fc5e8f4d1c19be33618499db1a8c8230a95293d91ef37e0df235c8bd55d77b57e5bf380ec4a748084546eb3c599f4f08f83528f6e550803bb3b891d15c025b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t4774635.exe

MD5 a286f244579be57765882ea235a52ffe
SHA1 183bc33000f31407601c78381178d6ed4a760a2b
SHA256 2b26e1de50aa576e5fe5d4ae2226b82f388722cc467ece0443cfa91aa5008185
SHA512 9d084800d3551fbc9360ac6298baac3d33286a23d27ac84a1a9ee35f6cc0252a1d7c56ffe6e090eccd1a944656e80b3201d1a358796217cdca9961ad4497cc3f

memory/4884-33-0x00000000004A0000-0x00000000004D0000-memory.dmp

memory/4884-34-0x0000000000D10000-0x0000000000D16000-memory.dmp

memory/4884-35-0x0000000005400000-0x0000000005A18000-memory.dmp

memory/4884-36-0x0000000004EF0000-0x0000000004FFA000-memory.dmp

memory/4884-37-0x0000000004E30000-0x0000000004E42000-memory.dmp

memory/4884-38-0x0000000004E90000-0x0000000004ECC000-memory.dmp

memory/4884-39-0x0000000005000000-0x000000000504C000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1648 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe
PID 1648 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe
PID 1648 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe
PID 1940 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe
PID 1940 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe
PID 1940 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe
PID 2808 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2808 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2808 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 1940 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe
PID 1940 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe
PID 932 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 932 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 932 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 932 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 932 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 932 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 4924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 4924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 4924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4984 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1648 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6393599.exe
PID 1648 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6393599.exe
PID 1648 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6393599.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe

"C:\Users\Admin\AppData\Local\Temp\b7da28873d43a4b6acac44b82b109a2489323a219d2cece98db41b834a2f30d0.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6393599.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6393599.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 203.83.221.88.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3808787.exe

MD5 44d1faadbdaaed55d6489315e8654a26
SHA1 4943587d08ac92268127020ebbc7a9fead9f63ed
SHA256 b85ea7757921143cabca2247f40bd10391fa0131d9f85ac4c611c19263cef2e8
SHA512 8d1609076b74f4717a8dc64d1f0ea57278c11a7ae7b2d9773b4cbaf1a0540363e46fe996fed89b67be8874ced9685b65990a47bad333b34c53e329522d94fd47

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3763358.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9174965.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3708-27-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6393599.exe

MD5 80dfed945324669f04323d054b02fc81
SHA1 c37107a15cf5165e1acff596124130bf9ec28642
SHA256 3baa7966ad070468194bfebe7865379c71e5b7b084165e2823aa0d5fe992b94f
SHA512 98e79f30aa15c8822c6c35dca0c6267b383fdaaa65938c4ad81136f0da8c53f9940db815282d06364ec18c0be43d9d80efa1a5ab4dca8db77021fe23e9846881

memory/3880-32-0x00000000007D0000-0x0000000000800000-memory.dmp

memory/3880-33-0x0000000000E40000-0x0000000000E46000-memory.dmp

memory/3880-34-0x000000000AC40000-0x000000000B258000-memory.dmp

memory/3880-35-0x000000000A780000-0x000000000A88A000-memory.dmp

memory/3880-36-0x000000000A6C0000-0x000000000A6D2000-memory.dmp

memory/3880-37-0x000000000A720000-0x000000000A75C000-memory.dmp

memory/3880-38-0x0000000002A90000-0x0000000002ADC000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

ZGRat

rat zgrat

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4516 set thread context of 1512 N/A C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4516 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4516 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4516 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4516 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4516 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4516 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4516 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4516 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe

"C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
RU 147.45.47.64:11837 tcp
RU 147.45.47.64:11837 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
RU 147.45.47.64:11837 tcp
RU 147.45.47.64:11837 tcp
RU 147.45.47.64:11837 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
RU 147.45.47.64:11837 tcp
RU 147.45.47.64:11837 tcp
RU 147.45.47.64:11837 tcp

Files

memory/4516-1-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

memory/1512-0-0x0000000000400000-0x000000000044A000-memory.dmp

memory/1512-2-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

memory/1512-3-0x0000000005660000-0x0000000005C04000-memory.dmp

memory/1512-4-0x00000000050B0000-0x0000000005142000-memory.dmp

memory/1512-5-0x0000000074D60000-0x0000000075510000-memory.dmp

memory/1512-6-0x0000000005080000-0x000000000508A000-memory.dmp

memory/1512-7-0x0000000006680000-0x0000000006C98000-memory.dmp

memory/1512-8-0x0000000006200000-0x000000000630A000-memory.dmp

memory/1512-9-0x0000000006130000-0x0000000006142000-memory.dmp

memory/1512-10-0x0000000006190000-0x00000000061CC000-memory.dmp

memory/1512-11-0x0000000006310000-0x000000000635C000-memory.dmp

memory/1512-12-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

memory/1512-13-0x0000000074D60000-0x0000000075510000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\db2419395b2091b54fbda644944d811a11fcb035dba5ab2e6d4b5ee327abbdf8.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\db2419395b2091b54fbda644944d811a11fcb035dba5ab2e6d4b5ee327abbdf8.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3224 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\db2419395b2091b54fbda644944d811a11fcb035dba5ab2e6d4b5ee327abbdf8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe
PID 3224 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\db2419395b2091b54fbda644944d811a11fcb035dba5ab2e6d4b5ee327abbdf8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe
PID 3224 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\db2419395b2091b54fbda644944d811a11fcb035dba5ab2e6d4b5ee327abbdf8.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe
PID 4792 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe
PID 4792 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe
PID 4792 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe
PID 1252 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe
PID 1252 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe
PID 1252 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe
PID 1252 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1840153.exe
PID 1252 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1840153.exe
PID 1252 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1840153.exe

Processes

C:\Users\Admin\AppData\Local\Temp\db2419395b2091b54fbda644944d811a11fcb035dba5ab2e6d4b5ee327abbdf8.exe

"C:\Users\Admin\AppData\Local\Temp\db2419395b2091b54fbda644944d811a11fcb035dba5ab2e6d4b5ee327abbdf8.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1840153.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1840153.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.203:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 203.83.221.88.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 107.211.222.173.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
FI 77.91.68.56:19071 tcp
FI 77.91.68.56:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8183835.exe

MD5 b16e7a02200768a1fccf17706d1e6384
SHA1 2fd83a85fa2b3e64b2a6a9627a91b755fdcf9cd7
SHA256 bf0bfad2a4d4bb0fb65f9c51016a8a79df53a741a325b5d7e77029c52d287115
SHA512 5fcdc1c318ba823d8fd2d924dd87d07aad3721a81bd23d783d3bb64f23641af142ec023f6e233a2c53f9e3cb70f19a61a3384e477e9d839bc070ad2545e6ece2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8302952.exe

MD5 5e2ef93242949ebb6b073111e0de8de3
SHA1 e7dde3687d5ca2119db422ded3c5fcb3bfe7571a
SHA256 2b7b3aa6b3c709f3036196cacb0010e10c5ac329830ee1113bc0460cef3a58e3
SHA512 b3e89a3a9ac0dfb9fc5691d6f821769743780fbce6cb5b349892d60006b895f326a93813580e2ce5a9008e06b0898e02dbc03ceceefe425323b809bfbe58fa70

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7274434.exe

MD5 1d8814cfd0da1297541e50804c23c9a0
SHA1 52069eb776deeaf79f5490a861ed8cea3baaff13
SHA256 ba6aceb985fe2bf23de8f9b9592ab165c24079eba6d1b8ea70adba0f1844f979
SHA512 0f940b3257a6cbf34af2526875812188a702d0c0b5c6580857608ae5ac03261837e6835e17e68bce5303e9bacd439708f2d3249cd8e848744c7ae924e8593db5

memory/4116-21-0x0000000000401000-0x0000000000404000-memory.dmp

memory/4116-22-0x0000000000580000-0x00000000005BE000-memory.dmp

memory/4116-28-0x0000000000580000-0x00000000005BE000-memory.dmp

memory/4116-29-0x0000000002550000-0x0000000002551000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1840153.exe

MD5 fac73899ad9c86ccf2fdb940b50359a9
SHA1 914a3d6c18771357eecaa1fe699964451061e112
SHA256 41a6a70bf15d432815ebc3ca66941532e52f0852dd2110c144f7bb1b161f8a55
SHA512 82cb802893b6cef8881c8a0764fd7b33e0cee8b90ae4c0228065ec806e078638915e22b2386b099b9201db869d3ad46017712e92966e145992e94e6c59fbe5be

memory/1156-35-0x00000000005D0000-0x000000000065C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/1156-42-0x00000000005D0000-0x000000000065C000-memory.dmp

memory/1156-44-0x0000000002510000-0x0000000002516000-memory.dmp

memory/1156-45-0x0000000007330000-0x0000000007948000-memory.dmp

memory/1156-46-0x0000000006D10000-0x0000000006E1A000-memory.dmp

memory/1156-47-0x0000000006E20000-0x0000000006E32000-memory.dmp

memory/1156-48-0x0000000006E40000-0x0000000006E7C000-memory.dmp

memory/1156-49-0x0000000006EA0000-0x0000000006EEC000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3052 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe
PID 3052 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe
PID 3052 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe
PID 3408 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe
PID 3408 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe
PID 3408 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe
PID 3408 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe
PID 3408 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe
PID 3116 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 3116 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 3116 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe
PID 3052 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6075708.exe
PID 3052 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6075708.exe
PID 3052 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6075708.exe
PID 1412 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 1412 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 1412 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\schtasks.exe
PID 1412 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 1492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 1492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 1492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2328 wrote to memory of 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe

"C:\Users\Admin\AppData\Local\Temp\00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6075708.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6075708.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legola.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ebb444342c" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
BE 2.17.107.113:443 www.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
BE 2.17.107.113:443 www.bing.com tcp
US 8.8.8.8:53 113.107.17.2.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
SE 5.42.92.67:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
SE 5.42.92.67:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4914129.exe

MD5 f2ff1b96e7ad02a8fec772d48caaefb2
SHA1 3567d0d7c6fcc186af300490f1d4ea777cbfefef
SHA256 cb8148d39bb144e32c8e4eced6081e2a11f162e1c8061de3096c652aa64bc652
SHA512 04b7c0e07bb249010c21725ddbcc4267b4ec2b09a2cd16c031719d6d17c8d8ecaf03e9ffb4d154c407bbe8c5ec567e8484185fad5a8bcb77576d6a101dd48a2d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1338143.exe

MD5 2daf21140ef736623a838840c7d683c6
SHA1 9e44e8e94072bec6aee371de55a6ba5bd82d2129
SHA256 29d231389bb9d6ee847960edfbe9be3e4dd4e4910891c06052c31a0568aa10e6
SHA512 c48b3a4936ff03c838e047b5c623fbd2663a613af9fcd3d973fdd564e0819d977d2c86631319bb4dd4155b255cdca4328c6ee7370ccafae9159b880cd971c256

memory/3904-14-0x00007FFAE9113000-0x00007FFAE9115000-memory.dmp

memory/3904-15-0x0000000000A40000-0x0000000000A4A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8000492.exe

MD5 f15b4c2bcdedc878427d5fac4d89a541
SHA1 84f4b89b281e42b0b67e1a1c14347b1bd151a024
SHA256 daa7fdb4063dac06672ff968a5ba19922dd31b7f9c3800685a0ae1e10effebc9
SHA512 595c261a58b8bcbe99fe4200a2ea7b72baa8c270f322adbd013e345c7d4f21e391d315db98d35db24fb24290f054e9df2cd150dd90e2ab0505ca29a3f5c14003

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t6075708.exe

MD5 8da782a1b6654af76b13201fd64b998b
SHA1 ff9964fe94e4e2af8426b0c011cb47235b58eaee
SHA256 a1f40df21d5d45e6ecf8cd80b567eb002cbc3895c527519d23d0d86dfb7dbc77
SHA512 0d76b25034788ca9c8ef2896ba5b2c2a3b82e8d73bbfc4c8c426bdfc85a9ef93dc088660867d426de740e35d83bb5f5f75a8012bfb37456612a3f6d3a3e52545

memory/4760-33-0x0000000000160000-0x0000000000190000-memory.dmp

memory/4760-34-0x0000000002530000-0x0000000002536000-memory.dmp

memory/4760-35-0x0000000005260000-0x0000000005878000-memory.dmp

memory/4760-36-0x0000000004D50000-0x0000000004E5A000-memory.dmp

memory/4760-37-0x0000000004C40000-0x0000000004C52000-memory.dmp

memory/4760-38-0x0000000004CA0000-0x0000000004CDC000-memory.dmp

memory/4760-39-0x0000000004CE0000-0x0000000004D2C000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\277f52adcffdae3b95ac4c1b928de6c4a507600023471054f5c9d34f3b852f94.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\277f52adcffdae3b95ac4c1b928de6c4a507600023471054f5c9d34f3b852f94.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1369519.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\277f52adcffdae3b95ac4c1b928de6c4a507600023471054f5c9d34f3b852f94.exe

"C:\Users\Admin\AppData\Local\Temp\277f52adcffdae3b95ac4c1b928de6c4a507600023471054f5c9d34f3b852f94.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1369519.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1369519.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2710542.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2710542.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.209:443 www.bing.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.209:443 www.bing.com tcp
US 8.8.8.8:53 209.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1369519.exe

MD5 f34c885bc0878d18d10ff2a2bcab37bf
SHA1 183ec4b6099090f5e12f2977855a5b8a47434b11
SHA256 bc0bd82e116a9895ebc746eb946211813684173fb091a3b5beb68d633d8f8ed7
SHA512 ac17cb90087c25fec2966c8ef59192b88d9ae2752d235af76a9b7e73900319750aef27becf5877f89560046b0c0cb43d2901cd501a032295f354fb2f7b27495d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3758178.exe

MD5 452bb0fa072d8b5b84e96b8135b88a33
SHA1 958d7ebe07651e7de76fa57dad744174a6948840
SHA256 e4864ebb7779217e5e02467385f0e1b64b27e1eda7c6ce12c81fa2ba5886d6af
SHA512 1f7f6066b5b8c076894aed53d85f46a9c643d41a5faebc84400437bcb797a9b220c70b75be4139c9213121c841e868f2677096bbd167f3f151d7b3152cbdad9b

memory/3172-14-0x00007FFE245E3000-0x00007FFE245E5000-memory.dmp

memory/3172-15-0x0000000000E80000-0x0000000000E8A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2710542.exe

MD5 29d290bc7cf52245c18068dd18a2b56b
SHA1 80834b85700772615c39a38757267968e32f3240
SHA256 f66d99d19231a0f6abba5374f8916cdcb478e715c50f29d6e436e54ee0e2db44
SHA512 86e90ae7c792bbae7bba8f0ee029c71233e540d74f9786aa3c5f381d2394ce7aa72c5cd6045eb9410821e59ba201558da773fc14e267cff0ca09ccc4a5314bed

memory/4788-20-0x00000000004D0000-0x0000000000500000-memory.dmp

memory/4788-21-0x0000000002780000-0x0000000002786000-memory.dmp

memory/4788-22-0x000000000A900000-0x000000000AF18000-memory.dmp

memory/4788-23-0x000000000A480000-0x000000000A58A000-memory.dmp

memory/4788-24-0x000000000A3C0000-0x000000000A3D2000-memory.dmp

memory/4788-25-0x000000000A420000-0x000000000A45C000-memory.dmp

memory/4788-26-0x00000000047D0000-0x000000000481C000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-09 17:56

Reported

2024-05-09 17:59

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3280 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe
PID 3280 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe
PID 3280 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe
PID 2300 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe
PID 2300 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe
PID 2300 wrote to memory of 460 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe
PID 460 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 460 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 460 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe
PID 2300 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe
PID 4988 wrote to memory of 5684 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4988 wrote to memory of 5684 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4988 wrote to memory of 5684 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\schtasks.exe
PID 4988 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4988 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 4988 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 4408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 4408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 4408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 5240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 5240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 5240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 5128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 5128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 5128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 3512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 3512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 3512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 5156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 5156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3768 wrote to memory of 5156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3280 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6523031.exe
PID 3280 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6523031.exe
PID 3280 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6523031.exe

Processes

C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe

"C:\Users\Admin\AppData\Local\Temp\32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "danke.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\3ec1f323b5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6523031.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6523031.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
BE 88.221.83.219:443 www.bing.com tcp
FI 77.91.68.3:80 tcp
BE 88.221.83.219:443 www.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 219.83.221.88.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
US 8.8.8.8:53 107.211.222.173.in-addr.arpa udp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
FI 77.91.68.3:80 tcp
FI 77.91.68.68:19071 tcp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7645372.exe

MD5 e2ea177b037d675453ea1d36414518fa
SHA1 9ece6794cd21fbba9eefa360b108918ac4591e25
SHA256 23a6463d015328affa3cd869b06429b905648da2a2a7323cc24ef1331ee66370
SHA512 ce83a8df589590468d14250b7590313cc93000f7b3d4402273d60d4a1aedd269721419cb9037c297ba5ab318e8a9e1e74370c84b788332a143e90a193fb0ce36

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6275927.exe

MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA512 06f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3866298.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2480-27-0x0000000000E00000-0x0000000000E0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6523031.exe

MD5 415533bb2aacac48283c470e4efc5628
SHA1 aa86a7e050b6dd2120d1e72620d59f24b4a93778
SHA256 032beebdac1783f396ccf9f9a7b0123c2e224b4c39cb280f66fc7c9f82a586c3
SHA512 3a65c34f68d5a3e787d9761d7212d39c8d0649386f9a06c2f963ddcb32e5647b3dd634ebe6b2e9cf27e7e7dbed198b1e3b8a46af0f0970b66af7770249da5e58

memory/1848-32-0x0000000000F10000-0x0000000000F40000-memory.dmp

memory/1848-33-0x0000000005830000-0x0000000005836000-memory.dmp

memory/1848-34-0x000000000B3B0000-0x000000000B9C8000-memory.dmp

memory/1848-35-0x000000000AEC0000-0x000000000AFCA000-memory.dmp

memory/1848-36-0x000000000AE00000-0x000000000AE12000-memory.dmp

memory/1848-37-0x000000000AE60000-0x000000000AE9C000-memory.dmp

memory/1848-38-0x00000000032C0000-0x000000000330C000-memory.dmp