Overview
overview
10Static
static
31089300575...d7.exe
windows10-2004-x64
10188abd9448...8c.exe
windows10-2004-x64
101b3c0e5797...06.exe
windows10-2004-x64
10265074d78c...d6.exe
windows7-x64
3265074d78c...d6.exe
windows10-2004-x64
102d6ce3858d...b0.exe
windows7-x64
32d6ce3858d...b0.exe
windows10-2004-x64
103bb8a790f7...4e.exe
windows7-x64
33bb8a790f7...4e.exe
windows10-2004-x64
103df74027fe...88.exe
windows10-2004-x64
103e36cb02ee...9a.exe
windows10-2004-x64
103f3ae36481...68.exe
windows7-x64
13f3ae36481...68.exe
windows10-2004-x64
154ca5c456c...76.exe
windows10-2004-x64
106ade7d6ec7...80.exe
windows10-2004-x64
107abba1ebb5...9b.exe
windows7-x64
37abba1ebb5...9b.exe
windows10-2004-x64
10809359f8fb...a0.exe
windows7-x64
3809359f8fb...a0.exe
windows10-2004-x64
1080a61aa8cf...4c.exe
windows10-2004-x64
855fd4cf22...dc.exe
windows10-2004-x64
10a6d0e60e46...99.exe
windows10-2004-x64
10b07c30e9c2...0f.exe
windows10-2004-x64
10b46951fdb5...f7.exe
windows7-x64
3b46951fdb5...f7.exe
windows10-2004-x64
10bac7076846...e9.exe
windows10-2004-x64
10f358ce518b...e2.exe
windows10-2004-x64
9Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 15:01
Static task
static1
Behavioral task
behavioral1
Sample
10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
188abd944862b0218c2c1eb1ca15b896c802801a2127e4abb847bc5ba1a2eb8c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
1b3c0e579787bcef84732f5265ff9b365cdc639dfb3b301ffbfb808167567506.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe
Resource
win7-20240508-en
Behavioral task
behavioral5
Sample
265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
2d6ce3858dc5849cd0e5ce873e285bbd3b6a34ad11e20937b1827c8f3594abb0.exe
Resource
win7-20240508-en
Behavioral task
behavioral7
Sample
2d6ce3858dc5849cd0e5ce873e285bbd3b6a34ad11e20937b1827c8f3594abb0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe
Resource
win7-20240220-en
Behavioral task
behavioral9
Sample
3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
3df74027fece0dd6e6c9f46260e3c886ecbcfd4dce43ac64a90f1211d78fe588.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
3e36cb02ee15f0803929c4cc4ae0639ce652b40ae83519e020dc3e5273dde39a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
3f3ae364814c4c229616f1792f939131d6af421c4fa431b81f955015d14c8168.exe
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
3f3ae364814c4c229616f1792f939131d6af421c4fa431b81f955015d14c8168.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
54ca5c456ca4541c7a54027ae67295d9bdec93f29d76b9e8ab36e1fd52b1b876.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
7abba1ebb59dafe06cecf717ad708d5d5e873cb2cd6cfa536b3cf5eef782c19b.exe
Resource
win7-20240215-en
Behavioral task
behavioral17
Sample
7abba1ebb59dafe06cecf717ad708d5d5e873cb2cd6cfa536b3cf5eef782c19b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe
Resource
win7-20231129-en
Behavioral task
behavioral19
Sample
809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
80a61aa8cf25695a9f716e44c730ff90e095337b215aae6d732cf04f807bf34c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
a6d0e60e46974bcc2b95d79efe42aef131019e1a1db2f71a780c51a68cc36199.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
b46951fdb517d60cd2516aa317646c027a36d6b4e159c8d97dea70549b3b00f7.exe
Resource
win7-20240508-en
Behavioral task
behavioral25
Sample
b46951fdb517d60cd2516aa317646c027a36d6b4e159c8d97dea70549b3b00f7.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
bac70768466a80a4253c63add9d0601c8d645565be4c9ab0536b250c8e01a0e9.exe
Resource
win10v2004-20240226-en
General
-
Target
10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe
-
Size
389KB
-
MD5
f66ede1e06a086d548beab7306b19c2b
-
SHA1
e3473b146cbe237f60308ded64136d2e0d0e0138
-
SHA256
10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7
-
SHA512
892cd0b6b431c432f1defc9e8519389ac731c4b635e5e8b610790495d7e02ab7cb0057d3ce349a893bca34d9d21185b7f69c744258984ba1ea5947ddb322cd69
-
SSDEEP
12288:EMrZy90J4zMV/aGuDCQsgBYCpxsHJKBCs7:tyc4xHDCQzzzsHJKb7
Malware Config
Extracted
amadey
3.86
http://77.91.68.61
-
install_dir
925e7e99c5
-
install_file
pdates.exe
-
strings_key
ada76b8b0e1f6892ee93c20ab8946117
-
url_paths
/rock/index.php
Extracted
redline
lande
77.91.124.84:19071
-
auth_value
9fa41701c47df37786234f3373f21208
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6671551.exe healer behavioral1/memory/4772-27-0x00000000001B0000-0x00000000001BA000-memory.dmp healer -
Processes:
h6671551.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h6671551.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h6671551.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h6671551.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h6671551.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h6671551.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h6671551.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9678561.exe family_redline behavioral1/memory/5012-32-0x0000000000200000-0x0000000000230000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
g4561643.exepdates.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation g4561643.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation pdates.exe -
Executes dropped EXE 8 IoCs
Processes:
x8602784.exeg4561643.exepdates.exeh6671551.exej9678561.exepdates.exepdates.exepdates.exepid process 1652 x8602784.exe 3104 g4561643.exe 1220 pdates.exe 4772 h6671551.exe 5012 j9678561.exe 344 pdates.exe 3872 pdates.exe 2428 pdates.exe -
Processes:
h6671551.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h6671551.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exex8602784.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x8602784.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
h6671551.exepid process 4772 h6671551.exe 4772 h6671551.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
h6671551.exedescription pid process Token: SeDebugPrivilege 4772 h6671551.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exex8602784.exeg4561643.exepdates.execmd.exedescription pid process target process PID 1096 wrote to memory of 1652 1096 10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe x8602784.exe PID 1096 wrote to memory of 1652 1096 10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe x8602784.exe PID 1096 wrote to memory of 1652 1096 10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe x8602784.exe PID 1652 wrote to memory of 3104 1652 x8602784.exe g4561643.exe PID 1652 wrote to memory of 3104 1652 x8602784.exe g4561643.exe PID 1652 wrote to memory of 3104 1652 x8602784.exe g4561643.exe PID 3104 wrote to memory of 1220 3104 g4561643.exe pdates.exe PID 3104 wrote to memory of 1220 3104 g4561643.exe pdates.exe PID 3104 wrote to memory of 1220 3104 g4561643.exe pdates.exe PID 1652 wrote to memory of 4772 1652 x8602784.exe h6671551.exe PID 1652 wrote to memory of 4772 1652 x8602784.exe h6671551.exe PID 1220 wrote to memory of 2428 1220 pdates.exe schtasks.exe PID 1220 wrote to memory of 2428 1220 pdates.exe schtasks.exe PID 1220 wrote to memory of 2428 1220 pdates.exe schtasks.exe PID 1220 wrote to memory of 4536 1220 pdates.exe cmd.exe PID 1220 wrote to memory of 4536 1220 pdates.exe cmd.exe PID 1220 wrote to memory of 4536 1220 pdates.exe cmd.exe PID 4536 wrote to memory of 2732 4536 cmd.exe cmd.exe PID 4536 wrote to memory of 2732 4536 cmd.exe cmd.exe PID 4536 wrote to memory of 2732 4536 cmd.exe cmd.exe PID 4536 wrote to memory of 3848 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 3848 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 3848 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 2856 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 2856 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 2856 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 1552 4536 cmd.exe cmd.exe PID 4536 wrote to memory of 1552 4536 cmd.exe cmd.exe PID 4536 wrote to memory of 1552 4536 cmd.exe cmd.exe PID 4536 wrote to memory of 1684 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 1684 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 1684 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 688 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 688 4536 cmd.exe cacls.exe PID 4536 wrote to memory of 688 4536 cmd.exe cacls.exe PID 1096 wrote to memory of 5012 1096 10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe j9678561.exe PID 1096 wrote to memory of 5012 1096 10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe j9678561.exe PID 1096 wrote to memory of 5012 1096 10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe j9678561.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe"C:\Users\Admin\AppData\Local\Temp\10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8602784.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8602784.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4561643.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4561643.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F5⤵
- Creates scheduled task(s)
PID:2428 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2732
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"6⤵PID:3848
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E6⤵PID:2856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1552
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"6⤵PID:1684
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E6⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6671551.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6671551.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9678561.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9678561.exe2⤵
- Executes dropped EXE
PID:5012
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:344
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:3872
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:2428
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j9678561.exeFilesize
174KB
MD501fbc2e8c93fc30759bade720633ebdb
SHA1f544f0f1ff531a4823da16b60285752dc0ffb4c7
SHA2565794274655913978bacec7a6954014b341610dd8f7a0bd4f3e7adc0085c9c432
SHA512a2d63948051193345094e81b03ce12a4430e10fac84b7e76e9da1f5b6f5233ce04559879dd9e2e076792bc49b5ecb1d708d55833799dfb5bd297becd6b0db8ea
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8602784.exeFilesize
234KB
MD5240e5609e77a92707de8871a8c8bd65d
SHA11bb5ffbfe39840f12e11bf018b7654f0a49caa62
SHA2561df9c8772bbc82dc78581b5730b3dac39df1de094f4032fc828f00db7844ae98
SHA512d8269c62c5cac596800aff0cf20b8e58445f7856ad42637a919d0eaf8574ca67dfc122081a88922ea5a71f976f23de3e0b4ed15ecd76b65d950ee6d288340a7b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g4561643.exeFilesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6671551.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
memory/4772-27-0x00000000001B0000-0x00000000001BA000-memory.dmpFilesize
40KB
-
memory/5012-32-0x0000000000200000-0x0000000000230000-memory.dmpFilesize
192KB
-
memory/5012-33-0x00000000024C0000-0x00000000024C6000-memory.dmpFilesize
24KB
-
memory/5012-34-0x000000000A640000-0x000000000AC58000-memory.dmpFilesize
6.1MB
-
memory/5012-35-0x000000000A1B0000-0x000000000A2BA000-memory.dmpFilesize
1.0MB
-
memory/5012-36-0x000000000A0F0000-0x000000000A102000-memory.dmpFilesize
72KB
-
memory/5012-37-0x000000000A150000-0x000000000A18C000-memory.dmpFilesize
240KB
-
memory/5012-38-0x0000000002440000-0x000000000248C000-memory.dmpFilesize
304KB