Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 21:15
Static task
static1
Behavioral task
behavioral1
Sample
956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exe
Resource
win10v2004-20240226-en
General
-
Target
956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exe
-
Size
553KB
-
MD5
5c97aa8453476cb2f8cefc85ad9cb046
-
SHA1
48a20b4470bbcc2745875fd4bfc3416f92795013
-
SHA256
956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee
-
SHA512
9a2c1b518c547f2b03f76b0d7b6c7b01a8f5b8487c956d9c5fed088347bfdcc3789c73d0b7032dd5cf18b01a03150a050743f2fa2d5483cc603b6d7d453359d1
-
SSDEEP
12288:+MrKy90FZqNhV06m6CjFX35RxIQUZ7RiHb6vS32PHmOI5:UyfVy6cHwRQSSmu/5
Malware Config
Extracted
redline
fud
193.233.20.27:4123
-
auth_value
cddc991efd6918ad5321d80dac884b40
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7974Cc.exe healer behavioral1/memory/2636-14-0x0000000000100000-0x000000000010A000-memory.dmp healer -
Processes:
s7974Cc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection s7974Cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" s7974Cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" s7974Cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" s7974Cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" s7974Cc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" s7974Cc.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/4020-25-0x00000000025D0000-0x0000000002616000-memory.dmp family_redline behavioral1/memory/4020-31-0x0000000002760000-0x00000000027A4000-memory.dmp family_redline behavioral1/memory/4020-32-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-33-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-35-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-37-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-39-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-41-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-43-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-45-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-47-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-49-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-51-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-53-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-55-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-57-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-59-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-61-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-63-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-65-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-67-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-69-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-71-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-73-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-75-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-77-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-79-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-81-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-83-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-85-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-87-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-89-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-91-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-93-0x0000000002760000-0x000000000279E000-memory.dmp family_redline behavioral1/memory/4020-95-0x0000000002760000-0x000000000279E000-memory.dmp family_redline -
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7974Cc.exe INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/memory/2636-14-0x0000000000100000-0x000000000010A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
Executes dropped EXE 3 IoCs
Processes:
vkJo3139Cg.exes7974Cc.exet69sm77.exepid process 2468 vkJo3139Cg.exe 2636 s7974Cc.exe 4020 t69sm77.exe -
Processes:
s7974Cc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" s7974Cc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exevkJo3139Cg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vkJo3139Cg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
s7974Cc.exepid process 2636 s7974Cc.exe 2636 s7974Cc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
s7974Cc.exet69sm77.exedescription pid process Token: SeDebugPrivilege 2636 s7974Cc.exe Token: SeDebugPrivilege 4020 t69sm77.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exevkJo3139Cg.exedescription pid process target process PID 1164 wrote to memory of 2468 1164 956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exe vkJo3139Cg.exe PID 1164 wrote to memory of 2468 1164 956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exe vkJo3139Cg.exe PID 1164 wrote to memory of 2468 1164 956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exe vkJo3139Cg.exe PID 2468 wrote to memory of 2636 2468 vkJo3139Cg.exe s7974Cc.exe PID 2468 wrote to memory of 2636 2468 vkJo3139Cg.exe s7974Cc.exe PID 2468 wrote to memory of 4020 2468 vkJo3139Cg.exe t69sm77.exe PID 2468 wrote to memory of 4020 2468 vkJo3139Cg.exe t69sm77.exe PID 2468 wrote to memory of 4020 2468 vkJo3139Cg.exe t69sm77.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exe"C:\Users\Admin\AppData\Local\Temp\956fd03346806e85e9d9ab54a1d25f4d1fbaa8a1bfe0f29f482e41f9c17b32ee.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkJo3139Cg.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkJo3139Cg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7974Cc.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7974Cc.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t69sm77.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t69sm77.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkJo3139Cg.exeFilesize
409KB
MD5e66a323ae5efd997d96be1b60708c128
SHA1eaba7a9a12b80bf3395c1b482c1b2c261918b95c
SHA256a8f5ab1970d58c6d360880d90a2cdb7805213e6f86ead7e90c1fa5eb4a83d13b
SHA51224ed6526b00bc405a277379b9c681971cba92351e3f2b3c0a7bb41ee35b9de510c283ebdd4d4675dfc35832a156ad5d688eec8c449cc1ad9bca2a5bb6d0c3377
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s7974Cc.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t69sm77.exeFilesize
380KB
MD50e598ae27453b8349302a232a8fa3c8d
SHA1c314d820ba348ec2a155a2fb1d177af33d36d0be
SHA2562ea0bdd6a345b67435ffb4208a1fd0d05057a590cf2030e6b49887815ae6dc44
SHA512918c6c5c7ba2b177f0c837a37e793bfbb7baa34d330a64dfb3497571cb58b9475e5ef222b189df01f06adeec1664164245ed96e01a926021f4432fa109e7d7ec
-
memory/2636-14-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/2636-15-0x00007FFD04910000-0x00007FFD053D1000-memory.dmpFilesize
10.8MB
-
memory/2636-17-0x00007FFD04910000-0x00007FFD053D1000-memory.dmpFilesize
10.8MB
-
memory/4020-23-0x0000000001F20000-0x0000000001F6B000-memory.dmpFilesize
300KB
-
memory/4020-22-0x0000000000570000-0x0000000000670000-memory.dmpFilesize
1024KB
-
memory/4020-24-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4020-26-0x00000000749F0000-0x00000000751A0000-memory.dmpFilesize
7.7MB
-
memory/4020-27-0x0000000002970000-0x0000000002980000-memory.dmpFilesize
64KB
-
memory/4020-25-0x00000000025D0000-0x0000000002616000-memory.dmpFilesize
280KB
-
memory/4020-28-0x0000000002970000-0x0000000002980000-memory.dmpFilesize
64KB
-
memory/4020-29-0x0000000002970000-0x0000000002980000-memory.dmpFilesize
64KB
-
memory/4020-30-0x0000000004D30000-0x00000000052D4000-memory.dmpFilesize
5.6MB
-
memory/4020-31-0x0000000002760000-0x00000000027A4000-memory.dmpFilesize
272KB
-
memory/4020-32-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-33-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-35-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-37-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-39-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-41-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-43-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-45-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-47-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-49-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-51-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-53-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-55-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-57-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-59-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-61-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-63-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-65-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-67-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-69-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-71-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-73-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-75-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-77-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-79-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-81-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-83-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-85-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-87-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-89-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-91-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-93-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-95-0x0000000002760000-0x000000000279E000-memory.dmpFilesize
248KB
-
memory/4020-938-0x00000000052E0000-0x00000000058F8000-memory.dmpFilesize
6.1MB
-
memory/4020-939-0x0000000005900000-0x0000000005A0A000-memory.dmpFilesize
1.0MB
-
memory/4020-940-0x0000000005A30000-0x0000000005A42000-memory.dmpFilesize
72KB
-
memory/4020-941-0x0000000002970000-0x0000000002980000-memory.dmpFilesize
64KB
-
memory/4020-942-0x0000000005A50000-0x0000000005A8C000-memory.dmpFilesize
240KB
-
memory/4020-943-0x0000000005BA0000-0x0000000005BEC000-memory.dmpFilesize
304KB
-
memory/4020-944-0x0000000000570000-0x0000000000670000-memory.dmpFilesize
1024KB
-
memory/4020-946-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4020-947-0x00000000749F0000-0x00000000751A0000-memory.dmpFilesize
7.7MB
-
memory/4020-948-0x0000000002970000-0x0000000002980000-memory.dmpFilesize
64KB
-
memory/4020-950-0x0000000002970000-0x0000000002980000-memory.dmpFilesize
64KB
-
memory/4020-951-0x0000000002970000-0x0000000002980000-memory.dmpFilesize
64KB