Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2024 22:16
Static task
static1
Behavioral task
behavioral1
Sample
81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exe
Resource
win10v2004-20240226-en
General
-
Target
81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exe
-
Size
540KB
-
MD5
b2fd644488c1be4c52a5c3ac7bb03d2d
-
SHA1
cca376208325d857a146d92e6c9b1359749a05a9
-
SHA256
81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95
-
SHA512
5ac96f09c2c183bb792bc3336e00d51959f8062bd1fe530087c63ea4d6847f62b2ac06b0c02f8ea5d834c7f4fa0235f3f04d40521468212eff233c5fe242504d
-
SSDEEP
12288:eMrcy90fMn/TjdU/iE3bx89E0dAC0GWvpDEL4oV3RRX1vwj:2yD/vSbAeC0GWxDEnV3RRX8
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9570.exe healer behavioral1/memory/3256-14-0x0000000000F20000-0x0000000000F2A000-memory.dmp healer -
Processes:
pro9570.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9570.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9570.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9570.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9570.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro9570.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9570.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2216-25-0x0000000002350000-0x0000000002396000-memory.dmp family_redline behavioral1/memory/2216-30-0x0000000004C20000-0x0000000004C64000-memory.dmp family_redline behavioral1/memory/2216-31-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-32-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-34-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-36-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-44-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-42-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-46-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-40-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-56-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-54-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-52-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-50-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-48-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-60-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-62-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-72-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-70-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-74-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-68-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-76-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-80-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-78-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-66-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-64-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-58-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-84-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-82-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-38-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-86-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-88-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-90-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-92-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline behavioral1/memory/2216-94-0x0000000004C20000-0x0000000004C5E000-memory.dmp family_redline -
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9570.exe INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/memory/3256-14-0x0000000000F20000-0x0000000000F2A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
Executes dropped EXE 3 IoCs
Processes:
unio5889.exepro9570.exequ0591.exepid process 4116 unio5889.exe 3256 pro9570.exe 2216 qu0591.exe -
Processes:
pro9570.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9570.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exeunio5889.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio5889.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pro9570.exepid process 3256 pro9570.exe 3256 pro9570.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pro9570.exequ0591.exedescription pid process Token: SeDebugPrivilege 3256 pro9570.exe Token: SeDebugPrivilege 2216 qu0591.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exeunio5889.exedescription pid process target process PID 3880 wrote to memory of 4116 3880 81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exe unio5889.exe PID 3880 wrote to memory of 4116 3880 81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exe unio5889.exe PID 3880 wrote to memory of 4116 3880 81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exe unio5889.exe PID 4116 wrote to memory of 3256 4116 unio5889.exe pro9570.exe PID 4116 wrote to memory of 3256 4116 unio5889.exe pro9570.exe PID 4116 wrote to memory of 2216 4116 unio5889.exe qu0591.exe PID 4116 wrote to memory of 2216 4116 unio5889.exe qu0591.exe PID 4116 wrote to memory of 2216 4116 unio5889.exe qu0591.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exe"C:\Users\Admin\AppData\Local\Temp\81c89076b5ecf2c1a1c8a10a89a362840e7eb95fe17a06e0635a51e3810e2b95.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5889.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5889.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9570.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9570.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0591.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0591.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5889.exeFilesize
398KB
MD589becce2ad61128322cfec2e457c8295
SHA10db3aadb49ba546ea0b3a0d65c2b549cdcb42c7a
SHA2564cf08db048be7e1c8e681b4efdbbbd91afc756afef6bca3a6c438fe7900e3fba
SHA512d1a505f43e928ee84608aae662b25e8c0a4439239a78b8d8a34902088ad033e7d83039e4ed3fd2cee41745a5439f1d7741e9b0a138423e9e1c36b559bec079a3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9570.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0591.exeFilesize
358KB
MD5c974adb7843276455aa64660ba257bf4
SHA132802155913a9d51c8afc52620a13de87d6ba5e4
SHA256a847435bfeda6dd639c9511bf6f859e87587bdac87d2b9d3702e95c424be036e
SHA512697333a4fd641aacea8375d8a705a419b23cb2829d87b592e5fb7974adb2db13bbfaccaa0364ea1ea597319ae84cb654a04f99f6d1567f98e4e8af338e871d2d
-
memory/2216-22-0x0000000000710000-0x0000000000810000-memory.dmpFilesize
1024KB
-
memory/2216-23-0x00000000005B0000-0x00000000005FB000-memory.dmpFilesize
300KB
-
memory/2216-24-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2216-26-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/2216-25-0x0000000002350000-0x0000000002396000-memory.dmpFilesize
280KB
-
memory/2216-27-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2216-28-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2216-29-0x0000000004D30000-0x00000000052D4000-memory.dmpFilesize
5.6MB
-
memory/2216-30-0x0000000004C20000-0x0000000004C64000-memory.dmpFilesize
272KB
-
memory/2216-31-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-32-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-34-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-36-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-44-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-42-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-46-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-40-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-56-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-54-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-52-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-50-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-48-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-60-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-62-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-72-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-70-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-74-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-68-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-76-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-80-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-78-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-66-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-64-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-58-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-84-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-82-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-38-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-86-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-88-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-90-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-92-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-94-0x0000000004C20000-0x0000000004C5E000-memory.dmpFilesize
248KB
-
memory/2216-937-0x00000000052E0000-0x00000000058F8000-memory.dmpFilesize
6.1MB
-
memory/2216-938-0x0000000005900000-0x0000000005A0A000-memory.dmpFilesize
1.0MB
-
memory/2216-939-0x0000000005A30000-0x0000000005A42000-memory.dmpFilesize
72KB
-
memory/2216-940-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2216-941-0x0000000005A50000-0x0000000005A8C000-memory.dmpFilesize
240KB
-
memory/2216-942-0x0000000005BA0000-0x0000000005BEC000-memory.dmpFilesize
304KB
-
memory/2216-944-0x0000000000710000-0x0000000000810000-memory.dmpFilesize
1024KB
-
memory/2216-945-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2216-946-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/2216-947-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2216-949-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/2216-950-0x0000000004D20000-0x0000000004D30000-memory.dmpFilesize
64KB
-
memory/3256-14-0x0000000000F20000-0x0000000000F2A000-memory.dmpFilesize
40KB
-
memory/3256-15-0x00007FFE02EA0000-0x00007FFE03961000-memory.dmpFilesize
10.8MB
-
memory/3256-17-0x00007FFE02EA0000-0x00007FFE03961000-memory.dmpFilesize
10.8MB