Analysis
-
max time kernel
291s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
19/09/2023, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
x2956276.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
x2956276.exe
Resource
win10-20230915-en
General
-
Target
x2956276.exe
-
Size
767KB
-
MD5
1c6c7a45405df7f0ffa13ba4b0e13cdf
-
SHA1
a07565f75853d665ba77066708ca389013eec8c1
-
SHA256
8223ecb59ab7857b5c818e0a2b46f718af34cbfd315ef44aac14abcf7b10eae0
-
SHA512
12ad25bbb3fbcce8c5aec9bef01691f43d1f323d1f13c479d83e66b7072d8e4fa460fa58df0921cc77b96d84480de075bb17b238c655e3c41b8dcd4b9311894e
-
SSDEEP
12288:iMrRy90oJfvnDybDtf2MTTXqdvlyFL+LEVEjqjdd39rNdwxe:PyHuDZ1X6lISxqZL/wA
Malware Config
Extracted
redline
black
77.91.124.82:19071
-
auth_value
c5887216cebc5a219113738140bc3047
Signatures
-
Detects Healer an antivirus disabler dropper 1 IoCs
resource yara_rule behavioral2/memory/4232-21-0x0000000000400000-0x000000000040A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 2352 x3053086.exe 1532 x5182030.exe 1776 g6429604.exe 1876 h4643382.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" x2956276.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x3053086.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x5182030.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1776 set thread context of 4232 1776 g6429604.exe 73 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4232 AppLaunch.exe 4232 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4232 AppLaunch.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3768 wrote to memory of 2352 3768 x2956276.exe 70 PID 3768 wrote to memory of 2352 3768 x2956276.exe 70 PID 3768 wrote to memory of 2352 3768 x2956276.exe 70 PID 2352 wrote to memory of 1532 2352 x3053086.exe 71 PID 2352 wrote to memory of 1532 2352 x3053086.exe 71 PID 2352 wrote to memory of 1532 2352 x3053086.exe 71 PID 1532 wrote to memory of 1776 1532 x5182030.exe 72 PID 1532 wrote to memory of 1776 1532 x5182030.exe 72 PID 1532 wrote to memory of 1776 1532 x5182030.exe 72 PID 1776 wrote to memory of 4232 1776 g6429604.exe 73 PID 1776 wrote to memory of 4232 1776 g6429604.exe 73 PID 1776 wrote to memory of 4232 1776 g6429604.exe 73 PID 1776 wrote to memory of 4232 1776 g6429604.exe 73 PID 1776 wrote to memory of 4232 1776 g6429604.exe 73 PID 1776 wrote to memory of 4232 1776 g6429604.exe 73 PID 1776 wrote to memory of 4232 1776 g6429604.exe 73 PID 1776 wrote to memory of 4232 1776 g6429604.exe 73 PID 1532 wrote to memory of 1876 1532 x5182030.exe 74 PID 1532 wrote to memory of 1876 1532 x5182030.exe 74 PID 1532 wrote to memory of 1876 1532 x5182030.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\x2956276.exe"C:\Users\Admin\AppData\Local\Temp\x2956276.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3053086.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3053086.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5182030.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5182030.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6429604.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6429604.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h4643382.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h4643382.exe4⤵
- Executes dropped EXE
PID:1876
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
492KB
MD5fb222f908910b188d9e6f9c343280e34
SHA1993ae7465553bfd4789b5144cc9f70928e0c299a
SHA25695fb552e223bacb356225f06399cca3ddd1dcc3302de5f39d26a56665c656a75
SHA5121ae6b2185526b0f7b244b945d254e41ae85f334b76e72d9160bd84c135eefc1ad01923425167c5d8449c8497850e0c67fb11595b89f0c1f5c870bd15d2fe182b
-
Filesize
492KB
MD5fb222f908910b188d9e6f9c343280e34
SHA1993ae7465553bfd4789b5144cc9f70928e0c299a
SHA25695fb552e223bacb356225f06399cca3ddd1dcc3302de5f39d26a56665c656a75
SHA5121ae6b2185526b0f7b244b945d254e41ae85f334b76e72d9160bd84c135eefc1ad01923425167c5d8449c8497850e0c67fb11595b89f0c1f5c870bd15d2fe182b
-
Filesize
326KB
MD511924a7c6b34d401fce9a0289a495d90
SHA17e07aa42127ad4e83b4db9988d42f36229275c72
SHA256b610208386aff19bb310792255e5022f47fc360015fde0da73df201153ae013d
SHA5121d1501b04e60ac2e2ebd31a9ec8d62690f556ad4f7b1e3aa7ca822ac8137dc7ae04f8c06e404798973e487f17930fac08237e6329ae0d860a6d3d27218931fb1
-
Filesize
326KB
MD511924a7c6b34d401fce9a0289a495d90
SHA17e07aa42127ad4e83b4db9988d42f36229275c72
SHA256b610208386aff19bb310792255e5022f47fc360015fde0da73df201153ae013d
SHA5121d1501b04e60ac2e2ebd31a9ec8d62690f556ad4f7b1e3aa7ca822ac8137dc7ae04f8c06e404798973e487f17930fac08237e6329ae0d860a6d3d27218931fb1
-
Filesize
242KB
MD58989f700c821326027fe2fe0f49e5377
SHA142caa5229b3098681604d0ef16959b4bf0bbb4c2
SHA256f083e0adfc6196b5a9eff007132b1bbce34ff64ea672a9aebe64ed0bcf745421
SHA5122405054d42419eacc4e4ee9630e80a146e3a359a22152ad7d49098aac72691b218db1c3085a3d4b5ac604ddc874bc8369719f8e0ad126f6b1c4abdcfcfb2e368
-
Filesize
242KB
MD58989f700c821326027fe2fe0f49e5377
SHA142caa5229b3098681604d0ef16959b4bf0bbb4c2
SHA256f083e0adfc6196b5a9eff007132b1bbce34ff64ea672a9aebe64ed0bcf745421
SHA5122405054d42419eacc4e4ee9630e80a146e3a359a22152ad7d49098aac72691b218db1c3085a3d4b5ac604ddc874bc8369719f8e0ad126f6b1c4abdcfcfb2e368
-
Filesize
174KB
MD51827ae586ad2402dc0adc144a7669594
SHA17c4c2a6be7c2cb469e0ca47d971957620938edea
SHA2560429a60d41dd59931c21923cfaf7158b5678f26d4cd8b2832ba200487a17ab78
SHA5120d20f12df977497f7959a22a5568bc5b681f2e7caad0c6014f19c5a70d49b1ee56e5bf548a3679ce51618d687c68975565ae13a2e1808ba64329d25d6a13f71e
-
Filesize
174KB
MD51827ae586ad2402dc0adc144a7669594
SHA17c4c2a6be7c2cb469e0ca47d971957620938edea
SHA2560429a60d41dd59931c21923cfaf7158b5678f26d4cd8b2832ba200487a17ab78
SHA5120d20f12df977497f7959a22a5568bc5b681f2e7caad0c6014f19c5a70d49b1ee56e5bf548a3679ce51618d687c68975565ae13a2e1808ba64329d25d6a13f71e