Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 13:32
Static task
static1
Behavioral task
behavioral1
Sample
c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f.exe
Resource
win10v2004-20241007-en
General
-
Target
c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f.exe
-
Size
697KB
-
MD5
d011bdeafc9d639c8aab88be54964389
-
SHA1
fcb99cf59fdbff8c408e764a8d3ea8b7b4cc94eb
-
SHA256
c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f
-
SHA512
97e3cc43b6bb07820f6a841d163d68e4b454ee53038bd9fd2a21edf79ffe60c9567ba904fb7bede579e7d7f8ce768aaa8733ef83f873e4857d2bb8c9c1555e93
-
SSDEEP
12288:WMr/y90fbCj3wnR9ZaP+GC9bqie5k5Sbj0T:ZyilkuG5n3y
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/3312-18-0x00000000048C0000-0x00000000048DA000-memory.dmp healer behavioral1/memory/3312-20-0x0000000004AC0000-0x0000000004AD8000-memory.dmp healer behavioral1/memory/3312-48-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-45-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-37-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-31-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-29-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-25-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/3312-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2868.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2868.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2868.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2868.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2868.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2868.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/960-60-0x0000000004C50000-0x0000000004C96000-memory.dmp family_redline behavioral1/memory/960-61-0x0000000004E70000-0x0000000004EB4000-memory.dmp family_redline behavioral1/memory/960-67-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-75-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-96-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-93-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-91-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-89-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-87-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-86-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-83-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-81-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-79-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-73-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-71-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-69-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-77-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-65-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-63-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline behavioral1/memory/960-62-0x0000000004E70000-0x0000000004EAF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 3208 un261198.exe 3312 pro2868.exe 960 qu4756.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2868.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2868.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un261198.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4640 3312 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un261198.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro2868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu4756.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3312 pro2868.exe 3312 pro2868.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3312 pro2868.exe Token: SeDebugPrivilege 960 qu4756.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4464 wrote to memory of 3208 4464 c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f.exe 84 PID 4464 wrote to memory of 3208 4464 c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f.exe 84 PID 4464 wrote to memory of 3208 4464 c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f.exe 84 PID 3208 wrote to memory of 3312 3208 un261198.exe 85 PID 3208 wrote to memory of 3312 3208 un261198.exe 85 PID 3208 wrote to memory of 3312 3208 un261198.exe 85 PID 3208 wrote to memory of 960 3208 un261198.exe 97 PID 3208 wrote to memory of 960 3208 un261198.exe 97 PID 3208 wrote to memory of 960 3208 un261198.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f.exe"C:\Users\Admin\AppData\Local\Temp\c1a9724724603d3e11396f2782bfc3d6c038342f015a4aca3692b5c1bf7a600f.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un261198.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un261198.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2868.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2868.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 10964⤵
- Program crash
PID:4640
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4756.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4756.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3312 -ip 33121⤵PID:4224
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
555KB
MD50a0544753c486b6003353f65c0e9a26a
SHA1ad9518d0c4ee31c2179cdc6c87813409385a34f7
SHA256fa4217e76164a007da502e1a90155d57fdd49c71efe3fd002e44ce5d6c39da24
SHA512fe1200843fdd136d2e056a0147edb4dabd2a04b646765a754e527fe13f2e574943c8e095278778de400f530ebc6c11b5d25397b74881d956f874a16bae3bbb2c
-
Filesize
348KB
MD5cf6c2ce298c0074e0a4fff4813ea83ed
SHA193df11cadfff34e0066a5f9d1e2e73a04c373808
SHA2568a947225e3bd0d4a3fda50739774813c68729f46a3b8ccab9cedcb7ece9b948e
SHA512bd71957e46c1408c3a1ea1374c9e3a306e6448541f68a4037c04bd5787c86c21872a1d740b7e252fe1d6c886b0f6ddfa3982633d9f21d6fdadfcd2b7572a458f
-
Filesize
406KB
MD5728ffb3c629a491c13bc9a4c1fbc1ab6
SHA1b3fca26feb7417e8b2f16b0d1b46897d768ee384
SHA25648d393d21c84f06b57b12a456f77732b999a89ac04593e617e9080f772a0d460
SHA512bca1024b6cbdbec04eae5550f683f67d30ac184f2a39b83ff7ec00e2a1f6bdde67fca8880fa935651693722d8a041feffbcb99db59d09e32891389cdda220ba7