Overview
overview
10Static
static
301aa1629bc...16.exe
windows10-2004-x64
1010c3a4b3e3...62.exe
windows10-2004-x64
1012d321d9a6...0f.exe
windows10-2004-x64
102a2e3be04e...f7.exe
windows10-2004-x64
102bca03b9ef...e5.exe
windows10-2004-x64
102d2e176ff1...1c.exe
windows10-2004-x64
102d948afc82...ca.exe
windows10-2004-x64
102ec8f43232...da.exe
windows10-2004-x64
103a0ceb2aa8...f5.exe
windows10-2004-x64
103d5d854d7b...21.exe
windows10-2004-x64
1068ab5c7a84...5d.exe
windows10-2004-x64
107732b3137a...d8.exe
windows10-2004-x64
107c81a593c9...95.exe
windows7-x64
37c81a593c9...95.exe
windows10-2004-x64
108a74314c35...5a.exe
windows10-2004-x64
79b03895e9b...54.exe
windows7-x64
39b03895e9b...54.exe
windows10-2004-x64
10a777a11027...76.exe
windows10-2004-x64
10c0dad59a3b...fd.exe
windows10-2004-x64
10de0b656af4...69.exe
windows10-2004-x64
10e0c981a9f2...55.exe
windows10-2004-x64
10e5410c580a...b5.exe
windows7-x64
1e5410c580a...b5.exe
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 11:56
Static task
static1
Behavioral task
behavioral1
Sample
01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
10c3a4b3e37a803bd0aa6309c39158c1cdc781b3496a972f062f1fe958597862.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
12d321d9a66bfb909ca6ae3097f6aba39263be25c619d424b1dbefd373b20d0f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
2bca03b9ef1fd0076fbe6ffcb97d4378326e6bff7afa395802e5c93bf74f66e5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
2d2e176ff101b33e0adec2558415b76c1425ba9502c4b652c64b4751dd11181c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
3a0ceb2aa80172e3223e5154bd251fc1909cd353262609fa6bfeeb684d7761f5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
3d5d854d7b4667609b1a4eb70e50a6f99578a6ede0809793fc835cf2aebd7221.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
68ab5c7a84977eb7379341d29d2b10434cfd4ae30fb2276c4973f5fa55a7e85d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
7732b3137a721cb543261e9c4ecb5c90b51aa6d810c2df0104df6b11e319dbd8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
8a74314c35a7a341a4dec6d70e0d6801d49282a77f6ca44fee133e1d3ae7b45a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe
Resource
win7-20240220-en
Behavioral task
behavioral17
Sample
9b03895e9b8629528bbb718f6ceab16387b6aba3cfa7fd7750d1372e383a7554.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
a777a11027afe934646141f176344a5c05c946b740bea45e9684b9a8b98f6676.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
e0c981a9f27b4ad406731c3e41ec4ff1248e97b375aacc1a4489a8065a22ed55.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral22
Sample
e5410c580a81399010c4afd0cb43116c8c6e79ed10a16ace6ca24b1180f130b5.exe
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
e5410c580a81399010c4afd0cb43116c8c6e79ed10a16ace6ca24b1180f130b5.exe
Resource
win10v2004-20240426-en
General
-
Target
c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe
-
Size
1.5MB
-
MD5
02d3cc52bf2daf9027e9f5f03f9d5c60
-
SHA1
64a54dee7b09794656ca9507fa03519451ebe600
-
SHA256
c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd
-
SHA512
a13e38a688863d6cf350a3ffb4c4df79b625945d92d7ed0964f1dfaf90b043e39b502695c7fe7e326856406eb536a8aca1537c0375cc5b30dae4f06dbb4b302e
-
SSDEEP
24576:Sy43P8nmHHvHZb/3jXiV4MpypFR7uDMZiq3lDNGKVIAF/smmFJycDaV8ENEMKtAR:5vmHHPZb2KMpypFZflUKKAFmF8cN4Eh
Malware Config
Extracted
redline
masha
77.91.68.48:19071
-
auth_value
55b9b39a0dae383196a4b8d79e5bb805
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral19/memory/808-28-0x0000000000420000-0x000000000042A000-memory.dmp healer behavioral19/files/0x000700000002341b-35.dat healer behavioral19/memory/3124-37-0x0000000000D50000-0x0000000000D5A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a3780934.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b9313119.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b9313119.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a3780934.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a3780934.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a3780934.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b9313119.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" b9313119.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b9313119.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a3780934.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a3780934.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection b9313119.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral19/memory/4524-42-0x0000000000460000-0x0000000000490000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
pid Process 2860 v0089642.exe 3068 v0976851.exe 4576 v0122630.exe 808 a3780934.exe 3124 b9313119.exe 4524 c0933471.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a3780934.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a3780934.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" b9313119.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v0122630.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v0089642.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v0976851.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 808 a3780934.exe 808 a3780934.exe 3124 b9313119.exe 3124 b9313119.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 808 a3780934.exe Token: SeDebugPrivilege 3124 b9313119.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2860 2604 c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe 84 PID 2604 wrote to memory of 2860 2604 c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe 84 PID 2604 wrote to memory of 2860 2604 c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe 84 PID 2860 wrote to memory of 3068 2860 v0089642.exe 85 PID 2860 wrote to memory of 3068 2860 v0089642.exe 85 PID 2860 wrote to memory of 3068 2860 v0089642.exe 85 PID 3068 wrote to memory of 4576 3068 v0976851.exe 86 PID 3068 wrote to memory of 4576 3068 v0976851.exe 86 PID 3068 wrote to memory of 4576 3068 v0976851.exe 86 PID 4576 wrote to memory of 808 4576 v0122630.exe 87 PID 4576 wrote to memory of 808 4576 v0122630.exe 87 PID 4576 wrote to memory of 808 4576 v0122630.exe 87 PID 4576 wrote to memory of 3124 4576 v0122630.exe 98 PID 4576 wrote to memory of 3124 4576 v0122630.exe 98 PID 3068 wrote to memory of 4524 3068 v0976851.exe 99 PID 3068 wrote to memory of 4524 3068 v0976851.exe 99 PID 3068 wrote to memory of 4524 3068 v0976851.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe"C:\Users\Admin\AppData\Local\Temp\c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0089642.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0976851.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0122630.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3780934.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9313119.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0933471.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0933471.exe4⤵
- Executes dropped EXE
PID:4524
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
1.3MB
MD5424a3a9e388e8d4a143b78c18ca1b2c6
SHA17ab6f901d0d5d4fa7975097a215f37f2db0ceef6
SHA256ef55c277b76336f83cf5f0b3e52fba5619ed8d90bc5166f3f9faefa34ac9f0ee
SHA51264582f5fd930e7e42eb98dfffe330270446c6b1ca32b734907b1eddcbce93d04cee79c40f91a8f4704a4824dc5b7087875f961f652f4683a73e048eaaeea9786
-
Filesize
1.2MB
MD5c2009317a168ce808f1b4abba0b792b1
SHA1c16efb6d091d2a71ee9ba39d21d7617ddb324c28
SHA2566429cbb349f93b5aef577412bc38be6d99a71362715c37dec7f671bfd2d43f8f
SHA51240e5c0baa82bd300077d009af450ac76c1c602fe688cd65293565e3fc013151380ee334bd25e1a4505207a4547a1c2e9c95a5e18c71ea4de5ce5cf394ad49d58
-
Filesize
692KB
MD5214c73137cc743a9c012c1c8cf932769
SHA1d0b1f04df8dcb6804a1fed0898ddf2b5b159605c
SHA2565677c49a17a767d7de2e2d88fc5a4fc8bfd93744afd46e6e321df03d5af6b6de
SHA51242ab7caca363775508335667be71f41b8207ffcd96310b1f41e70e0ee4616c8279913e3e44ce5499e718b996df86cb506fb181cc9a248f34760d6a038726958a
-
Filesize
620KB
MD5391fd1a83e790f6dd27276d9cf6d62f9
SHA1ef4797b43151a8843647edbf32ee73f615d07dfe
SHA25682f9a9ce84ade18863aa0e160ca1dd14cf2281d7602b34d0bf2e1c398f5d832a
SHA51287e214f7090817f36b1db1faaf4e823be086f22fa7149619774e1995df7d2d0b61f9e9fafda658979016a66dec65a5d2ca68c1ee97493bc51c445a3cbd3d2a57
-
Filesize
530KB
MD5dc806f3ebddbe8981ea2d83a522f13f5
SHA11c1b91044afdca07c99bece215fa8775c2d53084
SHA256e3fe09c60edbad4bfcc881428c8425e91b9287e2b3116817a6dcc1f39b8ccc50
SHA51220d4a7963ce40638369fa0a8a5633a4d1125947aa874c9ec6f57f0ceca307534ba7bec3ee95b96a7e22c65cb234f13c68536afd783995d0236f7139f1b0884ba
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91