Overview
overview
10Static
static
31089300575...d7.exe
windows10-2004-x64
10188abd9448...8c.exe
windows10-2004-x64
101b3c0e5797...06.exe
windows10-2004-x64
10265074d78c...d6.exe
windows7-x64
3265074d78c...d6.exe
windows10-2004-x64
102d6ce3858d...b0.exe
windows7-x64
32d6ce3858d...b0.exe
windows10-2004-x64
103bb8a790f7...4e.exe
windows7-x64
33bb8a790f7...4e.exe
windows10-2004-x64
103df74027fe...88.exe
windows10-2004-x64
103e36cb02ee...9a.exe
windows10-2004-x64
103f3ae36481...68.exe
windows7-x64
13f3ae36481...68.exe
windows10-2004-x64
154ca5c456c...76.exe
windows10-2004-x64
106ade7d6ec7...80.exe
windows10-2004-x64
107abba1ebb5...9b.exe
windows7-x64
37abba1ebb5...9b.exe
windows10-2004-x64
10809359f8fb...a0.exe
windows7-x64
3809359f8fb...a0.exe
windows10-2004-x64
1080a61aa8cf...4c.exe
windows10-2004-x64
855fd4cf22...dc.exe
windows10-2004-x64
10a6d0e60e46...99.exe
windows10-2004-x64
10b07c30e9c2...0f.exe
windows10-2004-x64
10b46951fdb5...f7.exe
windows7-x64
3b46951fdb5...f7.exe
windows10-2004-x64
10bac7076846...e9.exe
windows10-2004-x64
10f358ce518b...e2.exe
windows10-2004-x64
9Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 15:01
Static task
static1
Behavioral task
behavioral1
Sample
10893005755e760cedfd88c67f168c3e2f1e26fafad63a929c1e953e718f49d7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
188abd944862b0218c2c1eb1ca15b896c802801a2127e4abb847bc5ba1a2eb8c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
1b3c0e579787bcef84732f5265ff9b365cdc639dfb3b301ffbfb808167567506.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe
Resource
win7-20240508-en
Behavioral task
behavioral5
Sample
265074d78c68ba95d07246920d7362962c973dc99f27f0f0a587385fa5df10d6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
2d6ce3858dc5849cd0e5ce873e285bbd3b6a34ad11e20937b1827c8f3594abb0.exe
Resource
win7-20240508-en
Behavioral task
behavioral7
Sample
2d6ce3858dc5849cd0e5ce873e285bbd3b6a34ad11e20937b1827c8f3594abb0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe
Resource
win7-20240220-en
Behavioral task
behavioral9
Sample
3bb8a790f7feb85fb0d0f7d2087ce3d7e4eb5577393162c735eec885b66a044e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
3df74027fece0dd6e6c9f46260e3c886ecbcfd4dce43ac64a90f1211d78fe588.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
3e36cb02ee15f0803929c4cc4ae0639ce652b40ae83519e020dc3e5273dde39a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
3f3ae364814c4c229616f1792f939131d6af421c4fa431b81f955015d14c8168.exe
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
3f3ae364814c4c229616f1792f939131d6af421c4fa431b81f955015d14c8168.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
54ca5c456ca4541c7a54027ae67295d9bdec93f29d76b9e8ab36e1fd52b1b876.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
7abba1ebb59dafe06cecf717ad708d5d5e873cb2cd6cfa536b3cf5eef782c19b.exe
Resource
win7-20240215-en
Behavioral task
behavioral17
Sample
7abba1ebb59dafe06cecf717ad708d5d5e873cb2cd6cfa536b3cf5eef782c19b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe
Resource
win7-20231129-en
Behavioral task
behavioral19
Sample
809359f8fb559a3e0706be1ec11da34660665a2a47a87b69f26c35bc7ece21a0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
80a61aa8cf25695a9f716e44c730ff90e095337b215aae6d732cf04f807bf34c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
a6d0e60e46974bcc2b95d79efe42aef131019e1a1db2f71a780c51a68cc36199.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
b46951fdb517d60cd2516aa317646c027a36d6b4e159c8d97dea70549b3b00f7.exe
Resource
win7-20240508-en
Behavioral task
behavioral25
Sample
b46951fdb517d60cd2516aa317646c027a36d6b4e159c8d97dea70549b3b00f7.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
bac70768466a80a4253c63add9d0601c8d645565be4c9ab0536b250c8e01a0e9.exe
Resource
win10v2004-20240226-en
General
-
Target
b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe
-
Size
925KB
-
MD5
dd93ee60c259b6d6649066385f4244ee
-
SHA1
d07a767c2cc5a3f4e22536f80cd5403d48e79f31
-
SHA256
b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f
-
SHA512
77da63cbd5f5c49e42b7c8d31388ce5a5f310ab7435e9200ad94f74339d371dd8e4100c1de2700f908c44f849e293b4ae80d8354c03e9c20ab5057df4d2d126f
-
SSDEEP
24576:jyvRZtvqBOv+fxZ0j5MqJu/2vUx4SoSoG:2vXtCVxZ06qg/lX
Malware Config
Extracted
redline
lamp
77.91.68.56:19071
-
auth_value
ee1df63bcdbe3de70f52810d94eaff7d
Signatures
-
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral23/memory/5104-28-0x0000000000570000-0x00000000005AE000-memory.dmp healer -
Processes:
k4201526.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection k4201526.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k4201526.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k4201526.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k4201526.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k4201526.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k4201526.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral23/memory/4420-35-0x0000000001FF0000-0x000000000207C000-memory.dmp family_redline behavioral23/memory/4420-42-0x0000000001FF0000-0x000000000207C000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
y2482363.exey5282091.exek4201526.exel6091152.exepid process 556 y2482363.exe 2728 y5282091.exe 5104 k4201526.exe 4420 l6091152.exe -
Processes:
k4201526.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k4201526.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k4201526.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exey2482363.exey5282091.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y2482363.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y5282091.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
k4201526.exepid process 5104 k4201526.exe 5104 k4201526.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
k4201526.exedescription pid process Token: SeDebugPrivilege 5104 k4201526.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exey2482363.exey5282091.exedescription pid process target process PID 3572 wrote to memory of 556 3572 b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe y2482363.exe PID 3572 wrote to memory of 556 3572 b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe y2482363.exe PID 3572 wrote to memory of 556 3572 b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe y2482363.exe PID 556 wrote to memory of 2728 556 y2482363.exe y5282091.exe PID 556 wrote to memory of 2728 556 y2482363.exe y5282091.exe PID 556 wrote to memory of 2728 556 y2482363.exe y5282091.exe PID 2728 wrote to memory of 5104 2728 y5282091.exe k4201526.exe PID 2728 wrote to memory of 5104 2728 y5282091.exe k4201526.exe PID 2728 wrote to memory of 5104 2728 y5282091.exe k4201526.exe PID 2728 wrote to memory of 4420 2728 y5282091.exe l6091152.exe PID 2728 wrote to memory of 4420 2728 y5282091.exe l6091152.exe PID 2728 wrote to memory of 4420 2728 y5282091.exe l6091152.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe"C:\Users\Admin\AppData\Local\Temp\b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2482363.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2482363.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5282091.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5282091.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4201526.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4201526.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6091152.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6091152.exe4⤵
- Executes dropped EXE
PID:4420
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2482363.exeFilesize
769KB
MD5672bff291b38885617823399ef70b555
SHA14a7f60f83e53a7da12068d50e8e0a92c4633f187
SHA256b536b905629c03cb86e63c1bf94b1cbf8a7a792df24d4904c4918e64d7c18fec
SHA512167ecae7df2a247e326c6bb329953b19e41b2cff7e730e11a3f6fabf1aefb6c119f1cf2495388dec0961328c2e7b585b0b01b4ccc9ed32f6f206c56d08afb769
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5282091.exeFilesize
585KB
MD5b33a2914d46d878780b909b6f1c9e28a
SHA137365cb918168c76217112923047b8cb5fce24ff
SHA256cd76d29e86c9061251c4db66dd62b6e9721e8f333e800e7b3e8dd3ab7f23384b
SHA5121c42a950e9b4ad4c63d07b2da343cb273057337d379f38bbd7914de31b8a527b2c7b0bc9fe07a2096fd4726ca88a3c1df2e2e7a7d2a643b24f84aff32325ee49
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4201526.exeFilesize
295KB
MD509eec7f364a56ec5491caf643ad17697
SHA16b1d0a4ca9ed4ced105e7eec6dfc2a7d3e65d415
SHA2563c95a536651751d027c53005524d9d580917f52e4c0a0c30fac8f6fd55279cf3
SHA5124f97ae75bdbac6f2c52c8189c31ee3b80c6991a15b017f0a5aac6feebe83c6505fefaf0d79c980f967bd5efec7c35961d30e50ddb19969a05be8aec5cdbbb1a0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6091152.exeFilesize
493KB
MD5dc11c027caa1f3eca389e929921e4a1a
SHA17bc540dbfa7367f8c7e1761c4de6cb110aceda76
SHA256cc338e14b24d1832ff2badca78ba12388cc65b05124b525e95080c969e805966
SHA512b1153e9eecbf5bdae7093fc472f331f0c71aedeee8072fc54b9657986d42a5a653e88a8712fa9230bdf1bc516ff630e5c1c791ab41ed822b6592ff60103c5105
-
memory/4420-45-0x0000000005D40000-0x0000000006358000-memory.dmpFilesize
6.1MB
-
memory/4420-35-0x0000000001FF0000-0x000000000207C000-memory.dmpFilesize
560KB
-
memory/4420-42-0x0000000001FF0000-0x000000000207C000-memory.dmpFilesize
560KB
-
memory/4420-44-0x00000000024D0000-0x00000000024D6000-memory.dmpFilesize
24KB
-
memory/4420-46-0x0000000006360000-0x000000000646A000-memory.dmpFilesize
1.0MB
-
memory/4420-47-0x0000000004AA0000-0x0000000004AB2000-memory.dmpFilesize
72KB
-
memory/4420-48-0x0000000006470000-0x00000000064AC000-memory.dmpFilesize
240KB
-
memory/4420-49-0x00000000064E0000-0x000000000652C000-memory.dmpFilesize
304KB
-
memory/5104-29-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/5104-28-0x0000000000570000-0x00000000005AE000-memory.dmpFilesize
248KB
-
memory/5104-27-0x0000000000401000-0x0000000000404000-memory.dmpFilesize
12KB
-
memory/5104-21-0x0000000000570000-0x00000000005AE000-memory.dmpFilesize
248KB