Overview
overview
10Static
static
30b4bb67302...ca.exe
windows10-2004-x64
910f472a1b5...37.exe
windows10-2004-x64
101208df4133...ab.exe
windows10-2004-x64
1022c8884d0e...34.exe
windows10-2004-x64
10277f52adcf...94.exe
windows10-2004-x64
103a484bb7d4...29.exe
windows10-2004-x64
103bdb06aad8...f3.exe
windows7-x64
103bdb06aad8...f3.exe
windows10-2004-x64
103d03f2fde9...00.exe
windows10-2004-x64
1040fbde6d35...71.exe
windows10-2004-x64
1053b6f1fa7f...02.exe
windows7-x64
1053b6f1fa7f...02.exe
windows10-2004-x64
106286d393c9...52.exe
windows7-x64
36286d393c9...52.exe
windows10-2004-x64
1066b71ef5ba...21.exe
windows10-2004-x64
107c73d83c0a...75.exe
windows10-2004-x64
10bccb41d4cd...17.exe
windows10-2004-x64
10c1c526ed2a...52.exe
windows10-2004-x64
10c726b1e0ec...ab.exe
windows10-2004-x64
10c8c3182273...54.exe
windows10-2004-x64
10d1e8dbd667...dd.exe
windows10-2004-x64
10d4fbce6f6a...86.exe
windows7-x64
3d4fbce6f6a...86.exe
windows10-2004-x64
10d7873c75af...a3.exe
windows10-2004-x64
10e25842dbe6...9e.exe
windows10-2004-x64
10fa1fbbcbd6...cf.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 15:27
Static task
static1
Behavioral task
behavioral1
Sample
0b4bb67302386646ed679bf7dbfd9e44d9c5eb985f2c043ef415113edb2b2eca.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
1208df413315575653953f79f71da4afa0f3816339cca881a3bd12be0cc7f0ab.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
22c8884d0e33db7ed2cd497936f31b5efeaa43a037af2f4c61a1a768919a6334.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
277f52adcffdae3b95ac4c1b928de6c4a507600023471054f5c9d34f3b852f94.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
3a484bb7d4882d8f4ab5dcb7c60a4d1397a642611888b68c5e13702926794729.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
3bdb06aad8f213ba8c98a80c76648a19cb074038ed82c6e1c890c4181bbd59f3.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
3bdb06aad8f213ba8c98a80c76648a19cb074038ed82c6e1c890c4181bbd59f3.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
40fbde6d35302d77db924d8a4db6569c23336d9205e82f12a82228cc100edb71.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
6286d393c93044fd5b8363ccad5324fadfde3e3d9b340ec908941eab3fe90652.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
66b71ef5ba881cda863dc50bab8ede20c8bdff7c699aa7b767f476f2b83eb421.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
7c73d83c0a0062c5cead0597dac9f90beac93ae125536330571cadd52acefe75.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
bccb41d4cd07f22dc7128aa361e7b2b43320ef072e11627fd143b376cdee0817.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
c1c526ed2ab259f0f169f9f6ea8e5765aeff3889749ee6e4c140d24a06cd2f52.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
c726b1e0ec6fea88dec580a790bb738a4976fe2f076a838067ec66bc403054ab.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
c8c3182273e1f34a2e9b4a2afb39aa5e5fa9ae93368dd9487b95f7ca43f17d54.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
d1e8dbd66731cd0a95e444d0fda9ebdc32fdc49845c43907cd292619ac4e88dd.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral22
Sample
d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186.exe
Resource
win7-20240508-en
Behavioral task
behavioral23
Sample
d4fbce6f6a714d781d28b578580461d8811477b0156700a58b25cdce361c4186.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral24
Sample
d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
e25842dbe6ab8469f81bd821ab70c2818962c7a681f45dfcd09f741409b2bb9e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral26
Sample
fa1fbbcbd6fb540be61aeb0eb89533d4e8d0fb64c2d0bcdd3f9263ff954a2acf.exe
Resource
win10v2004-20240508-en
General
-
Target
10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe
-
Size
235KB
-
MD5
ee5e79d00a13fde9e96a1f9953f35fea
-
SHA1
788be8b6304f138f5c7bdf00fe98562de6f2790d
-
SHA256
10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837
-
SHA512
26b1209bb16d6e5ed3dabe6fc18e6ec425197ecfd26f2038d9d796cff93d25597c774ca01fec5d975457ef7e544b9d7f7d09372e391c1823b4a7e3bcf94d0c49
-
SSDEEP
6144:KCy+bnr+0p0yN90QEdHyEL9MR1SKgfYLNYs1Ul8C2N:6Mrcy90zgoYLWs6l8V
Malware Config
Extracted
amadey
3.85
http://77.91.68.3
-
install_dir
3ec1f323b5
-
install_file
danke.exe
-
strings_key
827021be90f1e85ab27949ea7e9347e8
-
url_paths
/home/love/index.php
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral2/files/0x0009000000023407-5.dat healer behavioral2/memory/4284-7-0x0000000000350000-0x000000000035A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a6528505.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a6528505.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a6528505.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a6528505.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a6528505.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a6528505.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation b2742260.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation danke.exe -
Executes dropped EXE 5 IoCs
pid Process 4284 a6528505.exe 4552 b2742260.exe 3484 danke.exe 220 danke.exe 1552 danke.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6528505.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2404 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4284 a6528505.exe 4284 a6528505.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4284 a6528505.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1984 wrote to memory of 4284 1984 10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe 82 PID 1984 wrote to memory of 4284 1984 10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe 82 PID 1984 wrote to memory of 4552 1984 10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe 88 PID 1984 wrote to memory of 4552 1984 10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe 88 PID 1984 wrote to memory of 4552 1984 10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe 88 PID 4552 wrote to memory of 3484 4552 b2742260.exe 89 PID 4552 wrote to memory of 3484 4552 b2742260.exe 89 PID 4552 wrote to memory of 3484 4552 b2742260.exe 89 PID 3484 wrote to memory of 2404 3484 danke.exe 90 PID 3484 wrote to memory of 2404 3484 danke.exe 90 PID 3484 wrote to memory of 2404 3484 danke.exe 90 PID 3484 wrote to memory of 652 3484 danke.exe 92 PID 3484 wrote to memory of 652 3484 danke.exe 92 PID 3484 wrote to memory of 652 3484 danke.exe 92 PID 652 wrote to memory of 5044 652 cmd.exe 94 PID 652 wrote to memory of 5044 652 cmd.exe 94 PID 652 wrote to memory of 5044 652 cmd.exe 94 PID 652 wrote to memory of 4972 652 cmd.exe 95 PID 652 wrote to memory of 4972 652 cmd.exe 95 PID 652 wrote to memory of 4972 652 cmd.exe 95 PID 652 wrote to memory of 3024 652 cmd.exe 96 PID 652 wrote to memory of 3024 652 cmd.exe 96 PID 652 wrote to memory of 3024 652 cmd.exe 96 PID 652 wrote to memory of 232 652 cmd.exe 97 PID 652 wrote to memory of 232 652 cmd.exe 97 PID 652 wrote to memory of 232 652 cmd.exe 97 PID 652 wrote to memory of 4748 652 cmd.exe 98 PID 652 wrote to memory of 4748 652 cmd.exe 98 PID 652 wrote to memory of 4748 652 cmd.exe 98 PID 652 wrote to memory of 5072 652 cmd.exe 99 PID 652 wrote to memory of 5072 652 cmd.exe 99 PID 652 wrote to memory of 5072 652 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe"C:\Users\Admin\AppData\Local\Temp\10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6528505.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a6528505.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2742260.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2742260.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F4⤵
- Creates scheduled task(s)
PID:2404
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:5044
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:N"5⤵PID:4972
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "danke.exe" /P "Admin:R" /E5⤵PID:3024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:232
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:N"5⤵PID:4748
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\3ec1f323b5" /P "Admin:R" /E5⤵PID:5072
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:220
-
C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exeC:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe1⤵
- Executes dropped EXE
PID:1552
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD584bab76f53d09527ab0783ba2ece2e2e
SHA1bfdc2db1addb613025d32d8a288fc7b70b8b22ee
SHA2568f1eae62ef850d5a0a78054f853cbbe4c3b547bfc34ee890746405cee8bbfe95
SHA51245f0fa0cf107c116e6bd6e8145cfa5580cc007c3755e5b290f5aede15e195c83e296b90d4a6bbbbd619dfdb98168569c2efe8f2e4c9c5a7083a849ed65c670c9
-
Filesize
226KB
MD5144f0c96d774f813d87132e84b2a46ed
SHA1ce04450c00f605252c5c7df6960c0a3ed0705ef1
SHA2562a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e
SHA5127d21efad7312382185caf26b1b62c1a10ec25fe085d0a28a9e0dd2182fcb181ee92ef658d5778cbe2914ed46423e4a0a4f14434beceed4abf34eaa28be97fcda