Analysis
-
max time kernel
147s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 14:36
Static task
static1
Behavioral task
behavioral1
Sample
19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235.exe
Resource
win10v2004-20241007-en
General
-
Target
19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235.exe
-
Size
817KB
-
MD5
2b85149b9f99175e4523eb8301ff18c2
-
SHA1
4b98a2fc41a168311df66359180eecf56bf8fb0a
-
SHA256
19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235
-
SHA512
f3e9bc83f5f063e24eeeda03eb7f934807c9d5ee79157cf45ae277ea1092c45ae57b180ca6b1021160a9a7482859cd0aa61b6accd12161597b83c2d0d0237e10
-
SSDEEP
24576:0yJY0IBC/LkicMuXzTcJmzEwcp/Vz8gJyM8GHYkYwR4m:DJGaC5zExNz8FMdHYkYwR
Malware Config
Extracted
redline
dubka
193.233.20.13:4136
-
auth_value
e5a9421183a033f283b2f23139b471f0
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
resource yara_rule behavioral1/files/0x0008000000023ca2-20.dat healer behavioral1/memory/4320-22-0x0000000000200000-0x000000000020A000-memory.dmp healer behavioral1/memory/1340-29-0x00000000024A0000-0x00000000024BA000-memory.dmp healer behavioral1/memory/1340-31-0x0000000004B00000-0x0000000004B18000-memory.dmp healer behavioral1/memory/1340-32-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-33-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-59-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-57-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-55-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-53-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-51-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-49-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-47-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-45-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-43-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-41-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-39-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-37-0x0000000004B00000-0x0000000004B12000-memory.dmp healer behavioral1/memory/1340-35-0x0000000004B00000-0x0000000004B12000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rip9565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rip9565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" swB3952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" swB3952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" swB3952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rip9565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rip9565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rip9565.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" swB3952.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rip9565.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection swB3952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" swB3952.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x000a000000023c99-64.dat family_redline behavioral1/memory/4288-66-0x0000000000BF0000-0x0000000000C22000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 5 IoCs
pid Process 2536 vKZ3703.exe 4904 vEs0106.exe 4320 rip9565.exe 1340 swB3952.exe 4288 toE14Zt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rip9565.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features swB3952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" swB3952.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vKZ3703.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" vEs0106.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1592 1340 WerFault.exe 98 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language swB3952.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language toE14Zt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vKZ3703.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vEs0106.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4320 rip9565.exe 4320 rip9565.exe 1340 swB3952.exe 1340 swB3952.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4320 rip9565.exe Token: SeDebugPrivilege 1340 swB3952.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1336 wrote to memory of 2536 1336 19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235.exe 87 PID 1336 wrote to memory of 2536 1336 19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235.exe 87 PID 1336 wrote to memory of 2536 1336 19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235.exe 87 PID 2536 wrote to memory of 4904 2536 vKZ3703.exe 88 PID 2536 wrote to memory of 4904 2536 vKZ3703.exe 88 PID 2536 wrote to memory of 4904 2536 vKZ3703.exe 88 PID 4904 wrote to memory of 4320 4904 vEs0106.exe 89 PID 4904 wrote to memory of 4320 4904 vEs0106.exe 89 PID 4904 wrote to memory of 1340 4904 vEs0106.exe 98 PID 4904 wrote to memory of 1340 4904 vEs0106.exe 98 PID 4904 wrote to memory of 1340 4904 vEs0106.exe 98 PID 2536 wrote to memory of 4288 2536 vKZ3703.exe 110 PID 2536 wrote to memory of 4288 2536 vKZ3703.exe 110 PID 2536 wrote to memory of 4288 2536 vKZ3703.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235.exe"C:\Users\Admin\AppData\Local\Temp\19b3e06a9f89f5b7567181d89063b407ec7dbb05163ec01041efae5607fcc235.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vKZ3703.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vKZ3703.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vEs0106.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vEs0106.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rip9565.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rip9565.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swB3952.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swB3952.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 10205⤵
- Program crash
PID:1592
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\toE14Zt.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\toE14Zt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1340 -ip 13401⤵PID:508
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
482KB
MD5b564d88bc3dda040e87bab0a128f3b8b
SHA1acf5373ba5457976b42fbb6d9def0ceb35bb9468
SHA2568694c19768c08f3b8dd66b74c2a28d7647dfb2fe3b142c676fb463a9c1158bd2
SHA5128e6d5f99791fb251b6c550b92fce8a397ac7e9f01f537be50edf67edca40ccc53802cdb6ca8adf7c0531588120788d695f5e4aa1bf4e034648395b7970b7c512
-
Filesize
175KB
MD5dd0c9e110c68ce1fa5308979ef718f7b
SHA1473deb8069f0841d47b74b7f414dacc6f96eca78
SHA256dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3
SHA51229bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236
-
Filesize
337KB
MD5c01afe8ea527c0722e8461a6cf1c4230
SHA198c46705580fc6c7c9fb0fbc708c9c6ab176d8f1
SHA2562f00ae3c71afe6ff91f5651c393dc06c891424c71fa3a9153b982a6ab38aa6be
SHA5122ee6a83ca71b4a7b3259ffe64a4d81f2d081de1fcc3dcb7514ead31275895e133f893d64aff4e9ca78bffee3e9efb8f5050d6d6c3123940863ce9dac0959e3f7
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
246KB
MD55689d82e0bb0b6c738220f0e2d50f757
SHA11f1c0b8fceb6cb706866f2e32338a661af642e24
SHA2567cb1ef101075ff5d838a237ac29decc694606f34c102e4ec189b2f47780b60dd
SHA512dc16bef6fc2aee37df075e0db1e278889d6228d6979d2f680a88286fb6f90bf77249871cf9db4746e343f3ae4672d518873732ed04aedb3e5ea9947bbeb6f96b