Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e.exe
Resource
win10v2004-20241007-en
General
-
Target
e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e.exe
-
Size
699KB
-
MD5
42dedcf2a0a8c359e05957ec9374e774
-
SHA1
b1e564b7160a0e4b917ec088c5bcb81d42e26a5b
-
SHA256
e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e
-
SHA512
f5a9c0a4b09524fe86f47e558adec88946639ee5d95f37395c3f0ac409cda8583a5c5cee4f47f662772ee5b7641ccd863fa937cb98e81aef39efc652f38cfd68
-
SSDEEP
12288:3Mr7y90rwxy9eTVM6Uyboio/NteMLYpG2kGuoN6PzO/h/1iZBVP:wy9xNa7yboPNqG3GuPPzC/1iZBB
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/1056-18-0x0000000004D40000-0x0000000004D5A000-memory.dmp healer behavioral1/memory/1056-20-0x0000000007260000-0x0000000007278000-memory.dmp healer behavioral1/memory/1056-44-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-48-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-46-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-42-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-40-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-38-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-36-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-34-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-32-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-30-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-28-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-26-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-24-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-22-0x0000000007260000-0x0000000007272000-memory.dmp healer behavioral1/memory/1056-21-0x0000000007260000-0x0000000007272000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9605.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9605.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/2836-60-0x0000000004C80000-0x0000000004CC6000-memory.dmp family_redline behavioral1/memory/2836-61-0x0000000007190000-0x00000000071D4000-memory.dmp family_redline behavioral1/memory/2836-75-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-85-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-95-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-93-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-91-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-89-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-87-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-83-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-81-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-79-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-77-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-73-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-71-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-69-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-67-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-65-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-63-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline behavioral1/memory/2836-62-0x0000000007190000-0x00000000071CF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 220 un599309.exe 1056 pro9605.exe 2836 qu4440.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9605.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un599309.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4424 1056 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro9605.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu4440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un599309.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1056 pro9605.exe 1056 pro9605.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1056 pro9605.exe Token: SeDebugPrivilege 2836 qu4440.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4948 wrote to memory of 220 4948 e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e.exe 84 PID 4948 wrote to memory of 220 4948 e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e.exe 84 PID 4948 wrote to memory of 220 4948 e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e.exe 84 PID 220 wrote to memory of 1056 220 un599309.exe 85 PID 220 wrote to memory of 1056 220 un599309.exe 85 PID 220 wrote to memory of 1056 220 un599309.exe 85 PID 220 wrote to memory of 2836 220 un599309.exe 96 PID 220 wrote to memory of 2836 220 un599309.exe 96 PID 220 wrote to memory of 2836 220 un599309.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e.exe"C:\Users\Admin\AppData\Local\Temp\e4eef19246b37580b9e3cee91138ee354587df3977ae371ba990a86cf3436c4e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un599309.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un599309.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9605.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9605.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 10844⤵
- Program crash
PID:4424
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4440.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4440.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1056 -ip 10561⤵PID:4596
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
557KB
MD58193bc63c5cfb159f28b57c4a2d77904
SHA12ac678ec04c8e26935b0ec85fed1a976df43ba2c
SHA256eddda6633f61d2f7d91d31262f1ed25fdb40458a51e4a6e1a4eb20d7158e44db
SHA512e30834fea0155968f89259e4ade5162731703634d1546706a2a6a9f0b1ab9793cd8802b6d29b19e7d70ad8a254a90043a919cd8ade30c0a0041b20c8e2b893f3
-
Filesize
348KB
MD511776ebb00ce0417c5ca25138603debc
SHA176b9be4392390ee65452d122b08ed33d2b25b5f1
SHA25600e52267def78526ac298d2161f8c50ebe821f6fe33808a155d0ae6319295009
SHA5121917151ee80b61d0e5882138d7f48ed8516d96e5f3be58b5964fdc0786d9ee40261a8d4ecb25bb4cd3ec8099df7a23778c3dfea8fad7a853aea08260573646cf
-
Filesize
406KB
MD5b78adf57ebe721d4756d6db4c85c1c76
SHA138ecd125094bb2f8c9b81666a6c80c42a720c49a
SHA256a847f283dec48c92df51ef26ac55b197e5c1f946f1cc6851d44a3c76802acc8a
SHA512ba56669ba6e25cc7da9e1f1b21243b329a44d44d5d711e6303882c86269f24c1a13edc433c160deb4b7d75f383c382f9ff9be22c8806524ea0808aa63c5f243a