Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 23:19
Static task
static1
Behavioral task
behavioral1
Sample
2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb.exe
Resource
win10v2004-20241007-en
General
-
Target
2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb.exe
-
Size
897KB
-
MD5
56b20b6f83d198e8f911ee38395801e5
-
SHA1
4fbbcaaf381517026046110a5e6c5f54bf78b80b
-
SHA256
2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb
-
SHA512
ad35528024154c5315e3d7711a6a75df5069fd17a5643198dbbc09cc6773c850d415347144849d196ba95980435daee6dc23f1405e4bf1ad5ff27d6338f417fd
-
SSDEEP
12288:tMrjy90tgXiHhiGlO19aLqrErCQqnOj0lzb8D7u4BJf2KWkac3m7Ylol05UBck:uyKyw814+grCQqR6fjr3sYGpL
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023ca8-20.dat healer behavioral1/memory/816-22-0x0000000000B80000-0x0000000000B8A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it498593.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it498593.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it498593.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it498593.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it498593.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it498593.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2924-2174-0x0000000005760000-0x0000000005792000-memory.dmp family_redline behavioral1/files/0x0010000000023b5e-2179.dat family_redline behavioral1/memory/5416-2187-0x0000000000550000-0x000000000057E000-memory.dmp family_redline behavioral1/files/0x0007000000023ca6-2197.dat family_redline behavioral1/memory/1644-2198-0x00000000007F0000-0x0000000000820000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation jr602969.exe -
Executes dropped EXE 6 IoCs
pid Process 1392 zimE9269.exe 3132 zieB7523.exe 816 it498593.exe 2924 jr602969.exe 5416 1.exe 1644 kp178985.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it498593.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zimE9269.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zieB7523.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1460 2924 WerFault.exe 97 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zimE9269.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zieB7523.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jr602969.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kp178985.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 816 it498593.exe 816 it498593.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 816 it498593.exe Token: SeDebugPrivilege 2924 jr602969.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1392 1876 2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb.exe 83 PID 1876 wrote to memory of 1392 1876 2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb.exe 83 PID 1876 wrote to memory of 1392 1876 2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb.exe 83 PID 1392 wrote to memory of 3132 1392 zimE9269.exe 84 PID 1392 wrote to memory of 3132 1392 zimE9269.exe 84 PID 1392 wrote to memory of 3132 1392 zimE9269.exe 84 PID 3132 wrote to memory of 816 3132 zieB7523.exe 85 PID 3132 wrote to memory of 816 3132 zieB7523.exe 85 PID 3132 wrote to memory of 2924 3132 zieB7523.exe 97 PID 3132 wrote to memory of 2924 3132 zieB7523.exe 97 PID 3132 wrote to memory of 2924 3132 zieB7523.exe 97 PID 2924 wrote to memory of 5416 2924 jr602969.exe 98 PID 2924 wrote to memory of 5416 2924 jr602969.exe 98 PID 2924 wrote to memory of 5416 2924 jr602969.exe 98 PID 1392 wrote to memory of 1644 1392 zimE9269.exe 103 PID 1392 wrote to memory of 1644 1392 zimE9269.exe 103 PID 1392 wrote to memory of 1644 1392 zimE9269.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb.exe"C:\Users\Admin\AppData\Local\Temp\2312e391c414b83231d5cc08d2e1554224ff10b77ed929f957167ddd363dfabb.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimE9269.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimE9269.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zieB7523.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zieB7523.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it498593.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it498593.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr602969.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr602969.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 13845⤵
- Program crash
PID:1460
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp178985.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp178985.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2924 -ip 29241⤵PID:2220
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
714KB
MD5ef5ae6ca30138706a81e70c7f4a83013
SHA11f2f26d160c90cea0888891d6d53ffa22a349235
SHA256dea3960b299c2c13e1df82704c25698257459b39a5ce5445898c3a04c944ea36
SHA512ff6d50c514cdd00476312907f4f00c1abf081a71bb60847afce153a576d771c8df30306fbbf02fe7fedf47a1b8e43d9b58c1cb75f94e1c198b07081acf1c44c9
-
Filesize
168KB
MD5c52ebada00a59ec1f651a0e9fbcef2eb
SHA1e1941278df76616f1ca3202ef2a9f99d2592d52f
SHA25635d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e
SHA5126b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2
-
Filesize
560KB
MD50c4c2c5573596b5f450e2ef607f3477f
SHA1d794c21da556a8823bed72399a8c329639fea560
SHA2567493777858bf57656765799194db471328ef03d4f1e6594c5a867ce041a04daf
SHA512d1b4cb4feb791581da5909c0ad61fc0cc00d87b0ca3d9261c4ba033831f74d86f0e4dabaf14ea8c210ac96391386e5d9fc243f434517b855d6441bcb92e49b6b
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
586KB
MD530709b05cee567fe9286234d7444c3a4
SHA1e76ae40adf72144055e252ef2025fefbded625cc
SHA256f46b772c3682afef5bfcd575d5845b854223cc988dd3347b4b9202e9a5f819d6
SHA5120e7de509f593c7a16233d82c6ae3825ff9e47767c98d6ddcad130d2ac2ab832ff6547f91ae0268a4555a9ea0d29b3d4f4bbb64dc73f5fb46a2d06d264ab1d633
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1