Overview
overview
10Static
static
319408d20ed...1b.exe
windows7-x64
319408d20ed...1b.exe
windows10-2004-x64
10209f361ec5...19.exe
windows7-x64
3209f361ec5...19.exe
windows10-2004-x64
102260e01650...fc.exe
windows10-2004-x64
1024b96bca46...df.exe
windows10-2004-x64
102a4e0bfefe...ad.exe
windows10-2004-x64
1030b28fbbc6...6a.exe
windows10-2004-x64
1045405e3261...66.exe
windows10-2004-x64
1055ab9707d2...50.exe
windows10-2004-x64
106568836094...3d.exe
windows10-2004-x64
1072a27ce3ad...a5.exe
windows10-2004-x64
109be0387d86...b9.exe
windows10-2004-x64
109d44150fdc...7d.exe
windows10-2004-x64
6b2402bf5ca...fa.exe
windows10-2004-x64
10c6bd926d58...44.exe
windows10-2004-x64
10cd321830f5...bc.exe
windows10-2004-x64
10cfcca94dd6...6e.exe
windows10-2004-x64
10dfa156ac28...ff.exe
windows10-2004-x64
10f1ae7fab47...cc.exe
windows10-2004-x64
10f25337a343...56.exe
windows10-2004-x64
10f5d16598bf...16.exe
windows7-x64
10f5d16598bf...16.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 17:57
Static task
static1
Behavioral task
behavioral1
Sample
19408d20edf49736ff3e86b9c52dcd2bf4b3da61eff72888392b2de04e27351b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
19408d20edf49736ff3e86b9c52dcd2bf4b3da61eff72888392b2de04e27351b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
209f361ec54d3eb7e8c1324ecea4c86835a53f08014f20d8acdb405a98c70e19.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
209f361ec54d3eb7e8c1324ecea4c86835a53f08014f20d8acdb405a98c70e19.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
24b96bca469764debd638550bc2704add4701110cc7a691fae627e361d8188df.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
45405e326148ce7f80326893b92fe8efe62819ee5465fdc13767a76472e21566.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
55ab9707d2ed04fd65eb47b64da270cf7fa47cedb721831c5dd0567bda7cc950.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
72a27ce3ad4f2daa863374d24914b9bdd41f5b34e08b440b9988fd847de7a3a5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
9be0387d865bef272b66fe34363fa38f5c4e2be5b6b773526bfc1d14b4791eb9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
9d44150fdc90939c6efc8d7882f0d89238b77267f40bd7b9e9fdff66d41f587d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
b2402bf5ca4c67871f6519e689231078532c147c35500668d062dec52e27e9fa.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
c6bd926d58aa119662ccfb970124884439404950b8aa818378fa47a61a658a44.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
dfa156ac28a140cde5b62ac7d594d1000da526091fd584c8e8caa96c692a5bff.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
f1ae7fab47b54b57b64fe4b0569d28421b914cc77c243cf2d59a0645d15e8ecc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
f25337a343c26cdecd99eb7f095938fd24fb233463a8af3fa69acc5201eed956.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral22
Sample
f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616.exe
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616.exe
Resource
win10v2004-20240508-en
General
-
Target
6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe
-
Size
390KB
-
MD5
a6f8f7131f6c47621b2e965cd6b6c981
-
SHA1
327a8177a15d3a0838e98aa40ea5a8a46c655d95
-
SHA256
6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d
-
SHA512
d2b98015331f39aefb690df721fc0a0696dd17a621828cf729efca2cde927a8e603e5f88df50414d46020df7a52b49470df60cd7eb08a0ca9301a6ba50d00b3f
-
SSDEEP
6144:KSy+bnr+Sp0yN90QE3zx3tQ3dNyVO12a/QNe9EOgqOLjBavFo4:mMr2y90pV3tQVo0QCaFma4
Malware Config
Extracted
amadey
3.85
http://77.91.68.3
-
install_dir
3ec1f323b5
-
install_file
danke.exe
-
strings_key
827021be90f1e85ab27949ea7e9347e8
-
url_paths
/home/love/index.php
Extracted
redline
nasa
77.91.68.68:19071
-
auth_value
6da71218d8a9738ea3a9a78b5677589b
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral11/files/0x0007000000023438-26.dat healer behavioral11/memory/2524-27-0x0000000000580000-0x000000000058A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h4793949.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h4793949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h4793949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h4793949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h4793949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h4793949.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral11/files/0x0007000000023435-30.dat family_redline behavioral11/memory/3620-32-0x0000000000590000-0x00000000005C0000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation g0925805.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 7 IoCs
pid Process 2176 x8271297.exe 4628 g0925805.exe 2772 danke.exe 2524 h4793949.exe 3620 j9474715.exe 4420 danke.exe 2492 danke.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h4793949.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x8271297.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4984 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2524 h4793949.exe 2524 h4793949.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2524 h4793949.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4056 wrote to memory of 2176 4056 6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe 83 PID 4056 wrote to memory of 2176 4056 6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe 83 PID 4056 wrote to memory of 2176 4056 6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe 83 PID 2176 wrote to memory of 4628 2176 x8271297.exe 85 PID 2176 wrote to memory of 4628 2176 x8271297.exe 85 PID 2176 wrote to memory of 4628 2176 x8271297.exe 85 PID 4628 wrote to memory of 2772 4628 g0925805.exe 87 PID 4628 wrote to memory of 2772 4628 g0925805.exe 87 PID 4628 wrote to memory of 2772 4628 g0925805.exe 87 PID 2176 wrote to memory of 2524 2176 x8271297.exe 88 PID 2176 wrote to memory of 2524 2176 x8271297.exe 88 PID 2772 wrote to memory of 4984 2772 danke.exe 89 PID 2772 wrote to memory of 4984 2772 danke.exe 89 PID 2772 wrote to memory of 4984 2772 danke.exe 89 PID 2772 wrote to memory of 1804 2772 danke.exe 90 PID 2772 wrote to memory of 1804 2772 danke.exe 90 PID 2772 wrote to memory of 1804 2772 danke.exe 90 PID 1804 wrote to memory of 2708 1804 cmd.exe 93 PID 1804 wrote to memory of 2708 1804 cmd.exe 93 PID 1804 wrote to memory of 2708 1804 cmd.exe 93 PID 1804 wrote to memory of 2044 1804 cmd.exe 94 PID 1804 wrote to memory of 2044 1804 cmd.exe 94 PID 1804 wrote to memory of 2044 1804 cmd.exe 94 PID 1804 wrote to memory of 4472 1804 cmd.exe 95 PID 1804 wrote to memory of 4472 1804 cmd.exe 95 PID 1804 wrote to memory of 4472 1804 cmd.exe 95 PID 1804 wrote to memory of 4612 1804 cmd.exe 96 PID 1804 wrote to memory of 4612 1804 cmd.exe 96 PID 1804 wrote to memory of 4612 1804 cmd.exe 96 PID 1804 wrote to memory of 2484 1804 cmd.exe 97 PID 1804 wrote to memory of 2484 1804 cmd.exe 97 PID 1804 wrote to memory of 2484 1804 cmd.exe 97 PID 1804 wrote to memory of 3060 1804 cmd.exe 98 PID 1804 wrote to memory of 3060 1804 cmd.exe 98 PID 1804 wrote to memory of 3060 1804 cmd.exe 98 PID 4056 wrote to memory of 3620 4056 6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe 99 PID 4056 wrote to memory of 3620 4056 6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe 99 PID 4056 wrote to memory of 3620 4056 6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe"C:\Users\Admin\AppData\Local\Temp\6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8271297.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8271297.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0925805.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0925805.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F5⤵
- Creates scheduled task(s)
PID:4984
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2708
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"6⤵PID:2044
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E6⤵PID:4472
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4612
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"6⤵PID:2484
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E6⤵PID:3060
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4793949.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4793949.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9474715.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9474715.exe2⤵
- Executes dropped EXE
PID:3620
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:4420
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:2492
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173KB
MD55bcc3128559b24417ec36706579aa398
SHA1452c8a8c62a3fae74f2d66f3b4a1c55a7c325dae
SHA256e309d8d8fb69a982109fe2f05733cc678ab7f1d0a13ad98c8b69337a678bc626
SHA51288fd7a0c187b7b20cb763fd5e2d22febd134a542f7b071f308e512f8e6e34b1c3ed42cff78c8f6efd6f11649a1fc146753ba7404d066c224d617a7d64b0c5b83
-
Filesize
234KB
MD5a30b3b2fa2e720d72abc0e99733025c5
SHA1183ad1e7f10bfe4b99a43663a27032c5c8c6c87c
SHA256004bc4b8f10885b589e3046c83c19e90977aff1b65554b677b1fb5328e2fe3d4
SHA512bd2068627036b0a5907cd9eb06efb61cecc0384a7a487def15bbef2bc3f148286d7a161680c3a24abb17de2f0defd6a01d57f31424dd686b77a06f60348c9ef2
-
Filesize
224KB
MD58c6b79ec436d7cf6950a804c1ec7d3e9
SHA14a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA2564e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
SHA51206f2de433876963bb7bbddbe93cab0b7dd22164d1c10726294445944dcf5fa4a0fb450fc683c32565177a81a6103f6a5f11d291958bc7fcff7fdb9cf41a001ce
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91