Overview
overview
10Static
static
31668096fbf...95.exe
windows10-2004-x64
102159151861...2d.exe
windows10-2004-x64
1022c5bd0a3e...19.exe
windows10-2004-x64
102a0ae333a9...1a.exe
windows7-x64
32a0ae333a9...1a.exe
windows10-2004-x64
104f86d48b3d...df.exe
windows10-2004-x64
1053ecffef24...36.exe
windows10-2004-x64
1075ccbf328f...af.exe
windows10-2004-x64
1077ba6e9303...c2.exe
windows10-2004-x64
10798aee8abb...5b.exe
windows10-2004-x64
1079eaddd1dc...70.exe
windows10-2004-x64
1080ada740eb...52.exe
windows10-2004-x64
109e3cf610e6...f0.exe
windows7-x64
109e3cf610e6...f0.exe
windows10-2004-x64
10a5bd0160df...49.exe
windows10-2004-x64
10aee53fccee...da.exe
windows10-2004-x64
10af9c5ff480...30.exe
windows7-x64
3af9c5ff480...30.exe
windows10-2004-x64
10bfe644d3bd...29.exe
windows10-2004-x64
10ca9f078739...a4.exe
windows10-2004-x64
10dda511575f...2f.exe
windows10-2004-x64
10ff541e0752...bb.exe
windows10-2004-x64
10Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 08:13
Static task
static1
Behavioral task
behavioral1
Sample
1668096fbfea278168a053bdb5fffa557e8bf8afd9b1ea6f4de43adb16c9cd95.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
22c5bd0a3e3c03e512f45c0ebd81b9cf7695279360a1c40cec90cf3efea5f219.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
2a0ae333a9b72768e8a05e7ebbfe4b15cf581f8c08129c0639aeed58eaf7901a.exe
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
2a0ae333a9b72768e8a05e7ebbfe4b15cf581f8c08129c0639aeed58eaf7901a.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
4f86d48b3d0bdaa6f4d6e224cb3d78d45d0e5ff02992de35aad4053a747106df.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
53ecffef24ddea22780ff63e0224bd9c1bf9d8533760949fff138bd5c432ce36.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
75ccbf328f1e4ec3537ebd63e6afcf1b951f8765d8b1c734b87a7073333332af.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
77ba6e93030c34c0c9c7b7ce05174d89515be6f64d93ad8fd6c5a7efd813f4c2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
798aee8abbe13acdcba7ded2507144abfb3a7bdb36dfad1f88ebd752af5e0c5b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
80ada740ebfd0573ea8825fc2b499a0d326897ebf254fc015852802a58a05452.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
9e3cf610e66102e164150efe5b2dee630cac04b4e4e29770c91180e956b39df0.exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
9e3cf610e66102e164150efe5b2dee630cac04b4e4e29770c91180e956b39df0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
aee53fccee33b73dab9491356e6eb50d71b3b380ca589b649b6ec63ff792c3da.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
af9c5ff480fec8f9f7f8c274ed08c18a4e5a894eec2eb3577031e60657b87b30.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
af9c5ff480fec8f9f7f8c274ed08c18a4e5a894eec2eb3577031e60657b87b30.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral22
Sample
ff541e0752957750759a393b41c2885b8177a2e7daf8234bf11068c537e215bb.exe
Resource
win10v2004-20240508-en
General
-
Target
bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe
-
Size
390KB
-
MD5
797a5feff99655f0d85ce2a57b7db03c
-
SHA1
4e6faef04eb706282a621b44f12ab9f1d46c2922
-
SHA256
bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229
-
SHA512
33d1c0e066306f4d67d1db2aef636e142c515c2fdc4c471c7d0abfb8643181196e752715b44cb6fcf8a7188c93244e109c6e7c02b6c412d2b82293103dc19251
-
SSDEEP
6144:Kty+bnr+1p0yN90QETEySSJAvVcQlhRAbR4SZZ1QMmHYYgtVNaAL0C/:fMrxy90xEyFkXARPqkNTYC/
Malware Config
Extracted
amadey
3.86
http://77.91.68.61
-
install_dir
925e7e99c5
-
install_file
pdates.exe
-
strings_key
ada76b8b0e1f6892ee93c20ab8946117
-
url_paths
/rock/index.php
Extracted
redline
lande
77.91.124.84:19071
-
auth_value
9fa41701c47df37786234f3373f21208
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral19/files/0x0008000000023428-12.dat healer behavioral19/memory/3100-15-0x00000000009D0000-0x00000000009DA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k4194493.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k4194493.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k4194493.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k4194493.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k4194493.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k4194493.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral19/files/0x0007000000023426-31.dat family_redline behavioral19/memory/3088-33-0x00000000009A0000-0x00000000009D0000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation l4381627.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation pdates.exe -
Executes dropped EXE 7 IoCs
pid Process 1648 y2494307.exe 3100 k4194493.exe 4248 l4381627.exe 4404 pdates.exe 3088 n0777759.exe 4524 pdates.exe 4364 pdates.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k4194493.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y2494307.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1416 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3100 k4194493.exe 3100 k4194493.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3100 k4194493.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4248 l4381627.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1648 2216 bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe 81 PID 2216 wrote to memory of 1648 2216 bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe 81 PID 2216 wrote to memory of 1648 2216 bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe 81 PID 1648 wrote to memory of 3100 1648 y2494307.exe 82 PID 1648 wrote to memory of 3100 1648 y2494307.exe 82 PID 1648 wrote to memory of 4248 1648 y2494307.exe 89 PID 1648 wrote to memory of 4248 1648 y2494307.exe 89 PID 1648 wrote to memory of 4248 1648 y2494307.exe 89 PID 4248 wrote to memory of 4404 4248 l4381627.exe 90 PID 4248 wrote to memory of 4404 4248 l4381627.exe 90 PID 4248 wrote to memory of 4404 4248 l4381627.exe 90 PID 2216 wrote to memory of 3088 2216 bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe 91 PID 2216 wrote to memory of 3088 2216 bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe 91 PID 2216 wrote to memory of 3088 2216 bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe 91 PID 4404 wrote to memory of 1416 4404 pdates.exe 92 PID 4404 wrote to memory of 1416 4404 pdates.exe 92 PID 4404 wrote to memory of 1416 4404 pdates.exe 92 PID 4404 wrote to memory of 876 4404 pdates.exe 94 PID 4404 wrote to memory of 876 4404 pdates.exe 94 PID 4404 wrote to memory of 876 4404 pdates.exe 94 PID 876 wrote to memory of 1076 876 cmd.exe 96 PID 876 wrote to memory of 1076 876 cmd.exe 96 PID 876 wrote to memory of 1076 876 cmd.exe 96 PID 876 wrote to memory of 4920 876 cmd.exe 97 PID 876 wrote to memory of 4920 876 cmd.exe 97 PID 876 wrote to memory of 4920 876 cmd.exe 97 PID 876 wrote to memory of 4924 876 cmd.exe 98 PID 876 wrote to memory of 4924 876 cmd.exe 98 PID 876 wrote to memory of 4924 876 cmd.exe 98 PID 876 wrote to memory of 4328 876 cmd.exe 99 PID 876 wrote to memory of 4328 876 cmd.exe 99 PID 876 wrote to memory of 4328 876 cmd.exe 99 PID 876 wrote to memory of 5096 876 cmd.exe 100 PID 876 wrote to memory of 5096 876 cmd.exe 100 PID 876 wrote to memory of 5096 876 cmd.exe 100 PID 876 wrote to memory of 1896 876 cmd.exe 101 PID 876 wrote to memory of 1896 876 cmd.exe 101 PID 876 wrote to memory of 1896 876 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe"C:\Users\Admin\AppData\Local\Temp\bfe644d3bd33f0f28361b0b64f6fba6444cbce7ffc0fb0746a6226305bffb229.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2494307.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2494307.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4194493.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4194493.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4381627.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4381627.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F5⤵
- Creates scheduled task(s)
PID:1416
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"6⤵PID:4920
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E6⤵PID:4924
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4328
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"6⤵PID:5096
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E6⤵PID:1896
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0777759.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n0777759.exe2⤵
- Executes dropped EXE
PID:3088
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:4524
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:4364
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173KB
MD5aaf6bfab945e6d0876f5ad39b900a0a1
SHA1961f4b11b2e842899251859736529041cb7b2d40
SHA256a67205ca871f9e817c446f8902e781b5fa730f7715640426171af105ffb5cf87
SHA512027211fda3063e2f5d96b7ff4627af0cb5e351cf1fc215a33651f8d6d120273f03496603ee15dc7256845958af1888f5f7b7d9ba835ad9f5822ffbd13233be79
-
Filesize
234KB
MD5c595e391a6c2d8292b85ce9a79fa9883
SHA197d613132aa62df943470481766f3d5601a29b17
SHA25611bbce44c061f0fbfcb9264c7f5255414bbe4e23988aa79e6f132d07ea498653
SHA512046a14c4537530d56cafac2608a9199cc8ec0287922f136d06768fde086e0efbe70c08fce9532be168b8f1537e81fe1be1383affede1ee6adfa64f6de5e438a5
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
223KB
MD5aea234064483f651010cf9d981f59fea
SHA1002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA25658b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434