Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe
Resource
win10v2004-20241007-en
General
-
Target
06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe
-
Size
545KB
-
MD5
c85a857d3eb14849db7e2279e9f5c83a
-
SHA1
252b6f13e91aed7e8edf2b98b990a2220b3a2e51
-
SHA256
06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2
-
SHA512
42f8000a0c0d939d1eb28a7473dcd2520e525171c61631d2df29c5b4d6c4ce1145b98c10a8852bc2c4fa344e720333ab0990d92ba261bc1a6af7892827a12971
-
SSDEEP
12288:jMrVy90xVZy72+ztY+0wikc6dWi0ywzcLfqrha10SF7b:Ky56+ztY+okXdWi0lzkiltSh
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/3632-12-0x0000000002350000-0x000000000236A000-memory.dmp healer behavioral1/memory/3632-14-0x0000000004A70000-0x0000000004A88000-memory.dmp healer behavioral1/memory/3632-40-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-42-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-38-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-37-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-34-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-32-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-30-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-29-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-26-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-24-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-22-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-20-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-18-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-16-0x0000000004A70000-0x0000000004A82000-memory.dmp healer behavioral1/memory/3632-15-0x0000000004A70000-0x0000000004A82000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection r5885UT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" r5885UT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" r5885UT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" r5885UT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" r5885UT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" r5885UT.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/3460-55-0x0000000002540000-0x0000000002586000-memory.dmp family_redline behavioral1/memory/3460-57-0x0000000004AE0000-0x0000000004B24000-memory.dmp family_redline behavioral1/memory/3460-63-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-69-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-91-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-89-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-87-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-85-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-81-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-79-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-77-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-75-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-73-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-71-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-67-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-65-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-83-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-61-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-59-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline behavioral1/memory/3460-58-0x0000000004AE0000-0x0000000004B1E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 2 IoCs
pid Process 3632 r5885UT.exe 3460 w23Zm79.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features r5885UT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" r5885UT.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language r5885UT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w23Zm79.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3632 r5885UT.exe 3632 r5885UT.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3632 r5885UT.exe Token: SeDebugPrivilege 3460 w23Zm79.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4172 wrote to memory of 3632 4172 06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe 84 PID 4172 wrote to memory of 3632 4172 06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe 84 PID 4172 wrote to memory of 3632 4172 06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe 84 PID 4172 wrote to memory of 3460 4172 06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe 94 PID 4172 wrote to memory of 3460 4172 06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe 94 PID 4172 wrote to memory of 3460 4172 06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe"C:\Users\Admin\AppData\Local\Temp\06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5885UT.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5885UT.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w23Zm79.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w23Zm79.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
323KB
MD5ee43881ab62092621b2d2e22a0295878
SHA10339221e3f787602fea6a0541817565d751a293c
SHA2562764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d
SHA512df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c
-
Filesize
382KB
MD5084bd8a8fbb93dd4f4fe78b1111bd9e2
SHA16cec443b0c4215de1ce8685f0e58c17a13f08b33
SHA256aff53afbb407c1e40a0ba6585f686576edd4a13540f9d416bf152f94476588c5
SHA512c01f18e421cfc6c9243110d34a5311552b568ccb4c71dd5342e30a8b8b5848860931389f265cc9e3ad57a3ea09519fcb6f7a40d99ff93fe284744b5c881837d2