Analysis
-
max time kernel
292s -
max time network
298s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
19-09-2023 06:52
Static task
static1
Behavioral task
behavioral1
Sample
x0651453.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
x0651453.exe
Resource
win10-20230915-en
General
-
Target
x0651453.exe
-
Size
492KB
-
MD5
8c62495f62de77222ca27558fbf5e0bc
-
SHA1
109f944d602fe8a613193b97715c8432e90cd1b2
-
SHA256
8afd755682fd51de8c541b0e31ab2ee1d6bdde402a7e4d566fe0494dbdb16d3f
-
SHA512
0b1f795298c2a9763240a209033268e0b612f5eee43febb6a093988b40ced4330de1419341028bd84c8b0cc58fc503afc30dfe05025756bcf5839677ae21fda0
-
SSDEEP
12288:rMrLy90fFxMvNrah9F+ucMoIKAGs4WF3bpRhiBd:gyYTM1r7ucM/R4s3FREBd
Malware Config
Extracted
redline
black
77.91.124.82:19071
-
auth_value
c5887216cebc5a219113738140bc3047
Signatures
-
Detects Healer an antivirus disabler dropper 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2672-25-0x0000000000400000-0x000000000040A000-memory.dmp healer behavioral1/memory/2672-26-0x0000000000400000-0x000000000040A000-memory.dmp healer behavioral1/memory/2672-28-0x0000000000400000-0x000000000040A000-memory.dmp healer behavioral1/memory/2672-30-0x0000000000400000-0x000000000040A000-memory.dmp healer behavioral1/memory/2672-32-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
Processes:
x8002878.exeg3089245.exeh8345542.exepid process 2996 x8002878.exe 2648 g3089245.exe 2692 h8345542.exe -
Loads dropped DLL 7 IoCs
Processes:
x0651453.exex8002878.exeg3089245.exeh8345542.exepid process 2604 x0651453.exe 2996 x8002878.exe 2996 x8002878.exe 2996 x8002878.exe 2648 g3089245.exe 2996 x8002878.exe 2692 h8345542.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
x0651453.exex8002878.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" x0651453.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x8002878.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
g3089245.exedescription pid process target process PID 2648 set thread context of 2672 2648 g3089245.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2672 AppLaunch.exe 2672 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2672 AppLaunch.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
x0651453.exex8002878.exeg3089245.exedescription pid process target process PID 2604 wrote to memory of 2996 2604 x0651453.exe x8002878.exe PID 2604 wrote to memory of 2996 2604 x0651453.exe x8002878.exe PID 2604 wrote to memory of 2996 2604 x0651453.exe x8002878.exe PID 2604 wrote to memory of 2996 2604 x0651453.exe x8002878.exe PID 2604 wrote to memory of 2996 2604 x0651453.exe x8002878.exe PID 2604 wrote to memory of 2996 2604 x0651453.exe x8002878.exe PID 2604 wrote to memory of 2996 2604 x0651453.exe x8002878.exe PID 2996 wrote to memory of 2648 2996 x8002878.exe g3089245.exe PID 2996 wrote to memory of 2648 2996 x8002878.exe g3089245.exe PID 2996 wrote to memory of 2648 2996 x8002878.exe g3089245.exe PID 2996 wrote to memory of 2648 2996 x8002878.exe g3089245.exe PID 2996 wrote to memory of 2648 2996 x8002878.exe g3089245.exe PID 2996 wrote to memory of 2648 2996 x8002878.exe g3089245.exe PID 2996 wrote to memory of 2648 2996 x8002878.exe g3089245.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2648 wrote to memory of 2672 2648 g3089245.exe AppLaunch.exe PID 2996 wrote to memory of 2692 2996 x8002878.exe h8345542.exe PID 2996 wrote to memory of 2692 2996 x8002878.exe h8345542.exe PID 2996 wrote to memory of 2692 2996 x8002878.exe h8345542.exe PID 2996 wrote to memory of 2692 2996 x8002878.exe h8345542.exe PID 2996 wrote to memory of 2692 2996 x8002878.exe h8345542.exe PID 2996 wrote to memory of 2692 2996 x8002878.exe h8345542.exe PID 2996 wrote to memory of 2692 2996 x8002878.exe h8345542.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\x0651453.exe"C:\Users\Admin\AppData\Local\Temp\x0651453.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8002878.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8002878.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3089245.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3089245.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8345542.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8345542.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8002878.exeFilesize
326KB
MD5d450a74effe247298e76be251e9d20b6
SHA12ec5fbbbd9ea9125beb84d456fac275f9dc42adc
SHA256c22b6ac1147733913380ba7c0f23d9e8802bb8f91b681e416aa5c5a0f942d105
SHA5121d4d264d1e20603a5d9dccac06c5055b5ec2555f3d6d390b4bd066a45ff23ede0ea15df9eec5154ac3601c7f28537b4096d703ea294295973e99fbf2b149d678
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8002878.exeFilesize
326KB
MD5d450a74effe247298e76be251e9d20b6
SHA12ec5fbbbd9ea9125beb84d456fac275f9dc42adc
SHA256c22b6ac1147733913380ba7c0f23d9e8802bb8f91b681e416aa5c5a0f942d105
SHA5121d4d264d1e20603a5d9dccac06c5055b5ec2555f3d6d390b4bd066a45ff23ede0ea15df9eec5154ac3601c7f28537b4096d703ea294295973e99fbf2b149d678
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3089245.exeFilesize
242KB
MD5d1139a672dbbf2080d65e428ab2a5e89
SHA1ba26ec755852555edba81f15f9937884666845c5
SHA2562f587191e89b78e30307e3d1c06e7fc8abcda40f2bbea21bb522c5c9dd07a8f6
SHA5125d9b0361549f6cc589dd9de63ed7af83b1a434524ff66cec60d6414d2fe3153f879f7a43d364e71fce933da89617d550d4b3858d48c2f19418f1db74809d52ca
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3089245.exeFilesize
242KB
MD5d1139a672dbbf2080d65e428ab2a5e89
SHA1ba26ec755852555edba81f15f9937884666845c5
SHA2562f587191e89b78e30307e3d1c06e7fc8abcda40f2bbea21bb522c5c9dd07a8f6
SHA5125d9b0361549f6cc589dd9de63ed7af83b1a434524ff66cec60d6414d2fe3153f879f7a43d364e71fce933da89617d550d4b3858d48c2f19418f1db74809d52ca
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3089245.exeFilesize
242KB
MD5d1139a672dbbf2080d65e428ab2a5e89
SHA1ba26ec755852555edba81f15f9937884666845c5
SHA2562f587191e89b78e30307e3d1c06e7fc8abcda40f2bbea21bb522c5c9dd07a8f6
SHA5125d9b0361549f6cc589dd9de63ed7af83b1a434524ff66cec60d6414d2fe3153f879f7a43d364e71fce933da89617d550d4b3858d48c2f19418f1db74809d52ca
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8345542.exeFilesize
174KB
MD524a7f85e7aba85d56e39eabf594afb44
SHA133e1f059adfe93d5bdf2a7880a0193c88a7ad1c4
SHA256179783183da481296e77d35b9a3a73c8247ad2420d49a4e7fd35ae12efadd467
SHA512a19c25638b6209e447bd2ef8eabf7377188f4bf89d12333ca25c17fff91e5b0c52d2e0504df3c465b781d6e0b75776c02752492f8e24e54a0e19385c1f326c67
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8345542.exeFilesize
174KB
MD524a7f85e7aba85d56e39eabf594afb44
SHA133e1f059adfe93d5bdf2a7880a0193c88a7ad1c4
SHA256179783183da481296e77d35b9a3a73c8247ad2420d49a4e7fd35ae12efadd467
SHA512a19c25638b6209e447bd2ef8eabf7377188f4bf89d12333ca25c17fff91e5b0c52d2e0504df3c465b781d6e0b75776c02752492f8e24e54a0e19385c1f326c67
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8002878.exeFilesize
326KB
MD5d450a74effe247298e76be251e9d20b6
SHA12ec5fbbbd9ea9125beb84d456fac275f9dc42adc
SHA256c22b6ac1147733913380ba7c0f23d9e8802bb8f91b681e416aa5c5a0f942d105
SHA5121d4d264d1e20603a5d9dccac06c5055b5ec2555f3d6d390b4bd066a45ff23ede0ea15df9eec5154ac3601c7f28537b4096d703ea294295973e99fbf2b149d678
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8002878.exeFilesize
326KB
MD5d450a74effe247298e76be251e9d20b6
SHA12ec5fbbbd9ea9125beb84d456fac275f9dc42adc
SHA256c22b6ac1147733913380ba7c0f23d9e8802bb8f91b681e416aa5c5a0f942d105
SHA5121d4d264d1e20603a5d9dccac06c5055b5ec2555f3d6d390b4bd066a45ff23ede0ea15df9eec5154ac3601c7f28537b4096d703ea294295973e99fbf2b149d678
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3089245.exeFilesize
242KB
MD5d1139a672dbbf2080d65e428ab2a5e89
SHA1ba26ec755852555edba81f15f9937884666845c5
SHA2562f587191e89b78e30307e3d1c06e7fc8abcda40f2bbea21bb522c5c9dd07a8f6
SHA5125d9b0361549f6cc589dd9de63ed7af83b1a434524ff66cec60d6414d2fe3153f879f7a43d364e71fce933da89617d550d4b3858d48c2f19418f1db74809d52ca
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3089245.exeFilesize
242KB
MD5d1139a672dbbf2080d65e428ab2a5e89
SHA1ba26ec755852555edba81f15f9937884666845c5
SHA2562f587191e89b78e30307e3d1c06e7fc8abcda40f2bbea21bb522c5c9dd07a8f6
SHA5125d9b0361549f6cc589dd9de63ed7af83b1a434524ff66cec60d6414d2fe3153f879f7a43d364e71fce933da89617d550d4b3858d48c2f19418f1db74809d52ca
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3089245.exeFilesize
242KB
MD5d1139a672dbbf2080d65e428ab2a5e89
SHA1ba26ec755852555edba81f15f9937884666845c5
SHA2562f587191e89b78e30307e3d1c06e7fc8abcda40f2bbea21bb522c5c9dd07a8f6
SHA5125d9b0361549f6cc589dd9de63ed7af83b1a434524ff66cec60d6414d2fe3153f879f7a43d364e71fce933da89617d550d4b3858d48c2f19418f1db74809d52ca
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8345542.exeFilesize
174KB
MD524a7f85e7aba85d56e39eabf594afb44
SHA133e1f059adfe93d5bdf2a7880a0193c88a7ad1c4
SHA256179783183da481296e77d35b9a3a73c8247ad2420d49a4e7fd35ae12efadd467
SHA512a19c25638b6209e447bd2ef8eabf7377188f4bf89d12333ca25c17fff91e5b0c52d2e0504df3c465b781d6e0b75776c02752492f8e24e54a0e19385c1f326c67
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8345542.exeFilesize
174KB
MD524a7f85e7aba85d56e39eabf594afb44
SHA133e1f059adfe93d5bdf2a7880a0193c88a7ad1c4
SHA256179783183da481296e77d35b9a3a73c8247ad2420d49a4e7fd35ae12efadd467
SHA512a19c25638b6209e447bd2ef8eabf7377188f4bf89d12333ca25c17fff91e5b0c52d2e0504df3c465b781d6e0b75776c02752492f8e24e54a0e19385c1f326c67
-
memory/2672-26-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2672-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2672-28-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2672-30-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2672-32-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2672-25-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2672-24-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2672-23-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2692-39-0x0000000001370000-0x00000000013A0000-memory.dmpFilesize
192KB
-
memory/2692-40-0x0000000000230000-0x0000000000236000-memory.dmpFilesize
24KB