Overview
overview
10Static
static
31d059ca891...d4.exe
windows10-2004-x64
101d90edda9f...51.exe
windows7-x64
31d90edda9f...51.exe
windows10-2004-x64
101e44c41d8d...91.exe
windows10-2004-x64
101ed736973c...3e.exe
windows10-2004-x64
10559234fc52...e2.exe
windows10-2004-x64
105a4570005d...a4.exe
windows7-x64
35a4570005d...a4.exe
windows10-2004-x64
1061f1a776dc...62.exe
windows10-2004-x64
1067045db960...01.exe
windows10-2004-x64
106d684b37ca...5c.exe
windows10-2004-x64
1077cbabe9fe...cf.exe
windows7-x64
377cbabe9fe...cf.exe
windows10-2004-x64
108a73bb4899...c3.exe
windows10-2004-x64
108db3c27c31...88.exe
windows7-x64
38db3c27c31...88.exe
windows10-2004-x64
10b72cfb2517...df.exe
windows10-2004-x64
10c2ef692d84...7e.exe
windows7-x64
3c2ef692d84...7e.exe
windows10-2004-x64
10c39106a352...4e.exe
windows7-x64
10c39106a352...4e.exe
windows10-2004-x64
10ca6d56a637...da.exe
windows10-2004-x64
10db14966ca7...cb.exe
windows7-x64
10db14966ca7...cb.exe
windows10-2004-x64
10e800205bb9...fd.exe
windows7-x64
3e800205bb9...fd.exe
windows10-2004-x64
10f8a2da44f9...41.exe
windows10-2004-x64
10fc8b501a18...d3.exe
windows7-x64
3fc8b501a18...d3.exe
windows10-2004-x64
10Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 11:48
Static task
static1
Behavioral task
behavioral1
Sample
1d059ca891566e0006cb4534dc4ff845fedd1d3d468c12366e12f98a815ed7d4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe
Resource
win7-20240419-en
Behavioral task
behavioral3
Sample
1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
5a4570005d13d7c9c706dbdc0cc5ee5b8dfd33f7be6a6204a95d2134e3a483a4.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
5a4570005d13d7c9c706dbdc0cc5ee5b8dfd33f7be6a6204a95d2134e3a483a4.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
61f1a776dcd13885a5979397d5b945e89d26cfcfe61e000ac89070e4a45bc562.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe
Resource
win7-20240419-en
Behavioral task
behavioral13
Sample
77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
8a73bb4899be69e1a77d74c46f81ca29b85b5c67b642e09f9735dec87b8b4cc3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
c2ef692d84f694cd08e3238ae431c5636be2dc51342782c20a577eb05217557e.exe
Resource
win7-20240508-en
Behavioral task
behavioral19
Sample
c2ef692d84f694cd08e3238ae431c5636be2dc51342782c20a577eb05217557e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e.exe
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe
Resource
win7-20240220-en
General
-
Target
67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe
-
Size
1.2MB
-
MD5
178421ab07fbeb11767d3bda7c24a4d4
-
SHA1
c2fda877254635b05fdda955b6a01651251ec00f
-
SHA256
67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501
-
SHA512
0a48c98fe000cd134b9712e2c812bf92523500b99190b9fe82d4f9e02a05305cabf37daf24ef0feffc5a0bee08d8c7a766c87a29f724652e523c95ef22a58ba2
-
SSDEEP
24576:dyvPA4Sk2aRNRajD7T6B/M2+cjk3w3nz9KXwsvJO6ejg/vi6a:4H3SpaMmk2zk3GzglvoDA
Malware Config
Extracted
redline
lamp
77.91.68.56:19071
-
auth_value
ee1df63bcdbe3de70f52810d94eaff7d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral10/memory/1872-41-0x0000000000490000-0x00000000004CE000-memory.dmp healer behavioral10/files/0x00070000000234be-46.dat healer behavioral10/memory/4468-48-0x00000000006F0000-0x00000000006FA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a2651355.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection b7896309.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" b7896309.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b7896309.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a2651355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a2651355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a2651355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b7896309.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b7896309.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b7896309.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a2651355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a2651355.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral10/memory/440-53-0x00000000005C0000-0x000000000064C000-memory.dmp family_redline behavioral10/memory/440-60-0x00000000005C0000-0x000000000064C000-memory.dmp family_redline -
Executes dropped EXE 7 IoCs
pid Process 4812 v9063373.exe 1580 v6210097.exe 4500 v9238337.exe 3428 v3931201.exe 1872 a2651355.exe 4468 b7896309.exe 440 c4075312.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a2651355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a2651355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" b7896309.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v9063373.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v6210097.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v9238337.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" v3931201.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1872 a2651355.exe 1872 a2651355.exe 4468 b7896309.exe 4468 b7896309.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1872 a2651355.exe Token: SeDebugPrivilege 4468 b7896309.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1056 wrote to memory of 4812 1056 67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe 83 PID 1056 wrote to memory of 4812 1056 67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe 83 PID 1056 wrote to memory of 4812 1056 67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe 83 PID 4812 wrote to memory of 1580 4812 v9063373.exe 84 PID 4812 wrote to memory of 1580 4812 v9063373.exe 84 PID 4812 wrote to memory of 1580 4812 v9063373.exe 84 PID 1580 wrote to memory of 4500 1580 v6210097.exe 85 PID 1580 wrote to memory of 4500 1580 v6210097.exe 85 PID 1580 wrote to memory of 4500 1580 v6210097.exe 85 PID 4500 wrote to memory of 3428 4500 v9238337.exe 86 PID 4500 wrote to memory of 3428 4500 v9238337.exe 86 PID 4500 wrote to memory of 3428 4500 v9238337.exe 86 PID 3428 wrote to memory of 1872 3428 v3931201.exe 87 PID 3428 wrote to memory of 1872 3428 v3931201.exe 87 PID 3428 wrote to memory of 1872 3428 v3931201.exe 87 PID 3428 wrote to memory of 4468 3428 v3931201.exe 98 PID 3428 wrote to memory of 4468 3428 v3931201.exe 98 PID 4500 wrote to memory of 440 4500 v9238337.exe 99 PID 4500 wrote to memory of 440 4500 v9238337.exe 99 PID 4500 wrote to memory of 440 4500 v9238337.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe"C:\Users\Admin\AppData\Local\Temp\67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9063373.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6210097.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9238337.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3931201.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2651355.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7896309.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4075312.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4075312.exe5⤵
- Executes dropped EXE
PID:440
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
1.0MB
MD52c2992bee297eb92a1c30c47f171520d
SHA11aa27a41eb69ed9a6ab90e36fcfb302fd0fd89af
SHA2561ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396
SHA512efb5cd6594ce8dbc6635cc04210e5e362f0a3ae2c65d5bc161ec903cd96cd58ffaee72fef87fd72fd71e67e09cb7ee0255e82d9944940d6cdb96277f4eacbbb7
-
Filesize
908KB
MD5e4759911e541d7a543ea033b0928ddf4
SHA1e39c427a6cf47b16cddabfd2c7fb00038e1dbe1f
SHA256f8dfa98c4e38deff7955c243f9db7b01692e43c0997eca9e5e141cc565cf05be
SHA5127760d634d8a8b0a2e2c9847c4c367589607de2d7ac43112830289dbf3585902dd0f824ebfcab04040f701afa6b86884824aed2f032e6c09714ac8575b7bf9e42
-
Filesize
724KB
MD5f4f787db36502a2e05f39da6a313e914
SHA14f842c75ce854d86420f9790c47c81bdcecd7c5d
SHA2563df74027fece0dd6e6c9f46260e3c886ecbcfd4dce43ac64a90f1211d78fe588
SHA5120728509f9668750a075e73175e48f90625f5e62ef3d1e95641d654d43f749dacb1012110c6e445aa64308a64b0d23c447041ab0ec994300a6b06a1091523d52b
-
Filesize
491KB
MD5dd10174f7fa3d017558c8310bf07d851
SHA108d795a3d2334906da989e46a7e57d4ba9aa9f41
SHA256cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604
SHA512a714e8babdc8d8a0a9f8e6ef6430d4f1cde70d3d80a902a1e247eb93bdf76e91fa89c4132708e0c632469b725c625ae65e30a908f02018f10b23460a02ec9d05
-
Filesize
325KB
MD5a11dbc01603450452854f17aa7ea1eef
SHA118436f7c4a7a4477c0baa93ddc108babce9491bf
SHA2562d2e176ff101b33e0adec2558415b76c1425ba9502c4b652c64b4751dd11181c
SHA5121ac3b35ac7b8742c8eded217595f30ae25eff216409bddd3cc18809ff6e5d873c7feae6e1e3501dc02bebe2205f9f9e8db9718c76315b679ca8ce73aca2135bf
-
Filesize
294KB
MD5175e3db636d9fd541cc11991815ea662
SHA1c5e30c78f298c1aa26768bc036795e19ed7e60d7
SHA256c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e
SHA51206b1bc8a9746e8dfd1a4d72e98b8b76a1f543ae0c72c9e0233dce81451d7521f586da373e69459170a8d9442da4883f8247cfb9714227744c765c892583ac5c9
-
Filesize
11KB
MD506d9b8f9236b959006976da775fea5e7
SHA146d5c5e6a3e7de6138cd764509a6754ce24d9484
SHA25677353ead4144432dfd0e8fc833c458c8b88fb5d6bf7c9818ac430be40983b7f5
SHA512ec0c6135f2b39d70cb35bd713d5fd9a0876055b46584f3535067f0f162be149024770c990e61ee041eabe5d3daf53aac49e747bb96189c3fa17346774a5edc6d