Overview
overview
10Static
static
31089300575...d7.exe
windows10-2004-x64
10188abd9448...8c.exe
windows10-2004-x64
101b3c0e5797...06.exe
windows10-2004-x64
10265074d78c...d6.exe
windows7-x64
3265074d78c...d6.exe
windows10-2004-x64
102d6ce3858d...b0.exe
windows7-x64
32d6ce3858d...b0.exe
windows10-2004-x64
103bb8a790f7...4e.exe
windows7-x64
33bb8a790f7...4e.exe
windows10-2004-x64
103df74027fe...88.exe
windows10-2004-x64
103e36cb02ee...9a.exe
windows10-2004-x64
103f3ae36481...68.exe
windows7-x64
13f3ae36481...68.exe
windows10-2004-x64
154ca5c456c...76.exe
windows10-2004-x64
106ade7d6ec7...80.exe
windows10-2004-x64
107abba1ebb5...9b.exe
windows7-x64
37abba1ebb5...9b.exe
windows10-2004-x64
10809359f8fb...a0.exe
windows7-x64
3809359f8fb...a0.exe
windows10-2004-x64
1080a61aa8cf...4c.exe
windows10-2004-x64
855fd4cf22...dc.exe
windows10-2004-x64
10a6d0e60e46...99.exe
windows10-2004-x64
10b07c30e9c2...0f.exe
windows10-2004-x64
10b46951fdb5...f7.exe
windows7-x64
3b46951fdb5...f7.exe
windows10-2004-x64
10bac7076846...e9.exe
windows10-2004-x64
10f358ce518b...e2.exe
windows10-2004-x64
9Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 15:01
Static task
static1
Behavioral task
behavioral1
Sample
10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
188abd944862b0218c2c1eb1ca15b896c802801a2127e4abb847bc5ba1a2eb8c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
1b3c0e579787bcef84732f5265ff9b365cdc639dfb3b301ffbfb808167567506.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe
Resource
win7-20240508-en
Behavioral task
behavioral5
Sample
265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
2d6ce3858dc5849cd0e5ce873e285bbd3b6a34ad11e20937b1827c8f3594abb0.exe
Resource
win7-20240508-en
Behavioral task
behavioral7
Sample
2d6ce3858dc5849cd0e5ce873e285bbd3b6a34ad11e20937b1827c8f3594abb0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe
Resource
win7-20240220-en
Behavioral task
behavioral9
Sample
3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
3df74027fece0dd6e6c9f46260e3c886ecbcfd4dce43ac64a90f1211d78fe588.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
3e36cb02ee15f0803929c4cc4ae0639ce652b40ae83519e020dc3e5273dde39a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
3f3ae364814c4c229616f1792f939131d6af421c4fa431b81f955015d14c8168.exe
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
3f3ae364814c4c229616f1792f939131d6af421c4fa431b81f955015d14c8168.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
54ca5c456ca4541c7a54027ae67295d9bdec93f29d76b9e8ab36e1fd52b1b876.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
7abba1ebb59dafe06cecf717ad708d5d5e873cb2cd6cfa536b3cf5eef782c19b.exe
Resource
win7-20240215-en
Behavioral task
behavioral17
Sample
7abba1ebb59dafe06cecf717ad708d5d5e873cb2cd6cfa536b3cf5eef782c19b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe
Resource
win7-20231129-en
Behavioral task
behavioral19
Sample
809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
80a61aa8cf25695a9f716e44c730ff90e095337b215aae6d732cf04f807bf34c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
a6d0e60e46974bcc2b95d79efe42aef131019e1a1db2f71a780c51a68cc36199.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
b46951fdb517d60cd2516aa317646c027a36d6b4e159c8d97dea70549b3b00f7.exe
Resource
win7-20240508-en
Behavioral task
behavioral25
Sample
b46951fdb517d60cd2516aa317646c027a36d6b4e159c8d97dea70549b3b00f7.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
bac70768466a80a4253c63add9d0601c8d645565be4c9ab0536b250c8e01a0e9.exe
Resource
win10v2004-20240226-en
General
-
Target
6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe
-
Size
924KB
-
MD5
f2a435288af42881303cdb4793ee7400
-
SHA1
9f5bd3e4f31299347372107b08b89938437393df
-
SHA256
6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680
-
SHA512
18a69e04bd6ae02bf78bb2673dbe3b7710c889afa62189238db4837f1230d5debc6b97f02a8a8d677f5df5cc19b6fc735ef1502a35c05a060d767a9fcd550e5d
-
SSDEEP
24576:oyWuYzzI8C7pWy5JAFCCMr58qneW2i4IFoYYOiG:vmzIls0OMr58qneni4EoYYj
Malware Config
Extracted
redline
lamp
77.91.68.56:19071
-
auth_value
ee1df63bcdbe3de70f52810d94eaff7d
Signatures
-
Detects Healer an antivirus disabler dropper 1 IoCs
resource yara_rule behavioral15/memory/2012-28-0x0000000001F90000-0x0000000001FCE000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k3687580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k3687580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k3687580.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection k3687580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k3687580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k3687580.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral15/memory/764-36-0x0000000001FD0000-0x000000000205C000-memory.dmp family_redline behavioral15/memory/764-42-0x0000000001FD0000-0x000000000205C000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 920 y4939975.exe 2740 y8386149.exe 2012 k3687580.exe 764 l1580374.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k3687580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k3687580.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y8386149.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y4939975.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4912 sc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2012 k3687580.exe 2012 k3687580.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2012 k3687580.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1704 wrote to memory of 920 1704 6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe 83 PID 1704 wrote to memory of 920 1704 6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe 83 PID 1704 wrote to memory of 920 1704 6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe 83 PID 920 wrote to memory of 2740 920 y4939975.exe 84 PID 920 wrote to memory of 2740 920 y4939975.exe 84 PID 920 wrote to memory of 2740 920 y4939975.exe 84 PID 2740 wrote to memory of 2012 2740 y8386149.exe 85 PID 2740 wrote to memory of 2012 2740 y8386149.exe 85 PID 2740 wrote to memory of 2012 2740 y8386149.exe 85 PID 2740 wrote to memory of 764 2740 y8386149.exe 97 PID 2740 wrote to memory of 764 2740 y8386149.exe 97 PID 2740 wrote to memory of 764 2740 y8386149.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe"C:\Users\Admin\AppData\Local\Temp\6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4939975.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4939975.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8386149.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8386149.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3687580.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3687580.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1580374.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1580374.exe4⤵
- Executes dropped EXE
PID:764
-
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:4912
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
769KB
MD54e2ed87ab13740312980b1234c473f30
SHA1e0fa5e983211bfddc5455f561eb851b270831d21
SHA25644c2d430d0e632ac382ff69f145c780dc7d5edfa076d654f2a50addb2cec44c5
SHA512d65f7fcf177a42a019ddc24d5806c1c0ea45c7a2abb1f79fb9a9b46fa3c1725a07dcceaf7488e46ac5b6e4535d40edcf30d259cc7e093b13b2b06b02f240fe62
-
Filesize
585KB
MD568fad26ce9ec0769a342a98d678121aa
SHA1a016b3f5a0b8d4028fc34d1d88739069f9118f4a
SHA256dd392838a4ada327f8d19ff9267f07a66c77cff37c0fe896a11e6976d2ec4ad2
SHA512fb4d57ec4f2219fd0c1f735a1f256c60f8efb2f0b3e39126bfeeb6601f8ab70b38733455120941a864c8d7eebace2cb68299c2109407143bad4a0e87eb8b48e9
-
Filesize
293KB
MD582da915b520ee55a0c99f15ebfcb20a9
SHA113aa02baafd27b191cbc444d5d0495390ab21944
SHA256633271b1342a29011618b4f80c9593600520342c364bb28432e2ecdc7d88887f
SHA5121ba2ca8c73f574d98bf0be1be56abfc2275798823ceb2236764042222fd76470eaa948ba6d87b74d5cb8313a3fa2eb8fcd96c7674cb80512342788d998081864
-
Filesize
491KB
MD5818ec8db504a8cf205c9a72d83261269
SHA14477b0959d99ebe973613b184b77dd983269d375
SHA25623c2976f15feed76828bf10c91d4d631cba06e041c388e8d8068d161a4ce98c4
SHA5121fc28585a58ab00f36cde57307ebc70b7ad1b6f07736614cade71ed918fcbd2d1798cd61cc625196a7208ba258a7a1e647694c6c9270097ee4c3f4230fd85da5