Analysis
-
max time kernel
149s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 00:17
Static task
static1
Behavioral task
behavioral1
Sample
f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa.exe
Resource
win10v2004-20241007-en
General
-
Target
f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa.exe
-
Size
470KB
-
MD5
b8936da6343f807216bdef274c99b93a
-
SHA1
89818cd1eba0cfdd1108973bba99100944230872
-
SHA256
f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa
-
SHA512
fb10f8b233bfab7c38f9f176c445740063c0347c06219baaae5f32bacbe8a54245190918fe08f52d53290e55fc93557ff945055c068d87ca37f5715eeda99f64
-
SSDEEP
6144:Kxy+bnr+Vp0yN90QEW4NT6+z+cJShEMemWj4qTZQ3TFilXh2EHur9mwafiVVvJqE:PMr1y903OiLJS2MeDNZkTq+9FVVvgBU
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4508-19-0x0000000002910000-0x000000000292A000-memory.dmp healer behavioral1/memory/4508-21-0x00000000053F0000-0x0000000005408000-memory.dmp healer behavioral1/memory/4508-47-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-45-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-49-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-44-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-41-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-39-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-37-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-36-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-33-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-31-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-29-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-27-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-25-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-23-0x00000000053F0000-0x0000000005402000-memory.dmp healer behavioral1/memory/4508-22-0x00000000053F0000-0x0000000005402000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bBf11Ml.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection bBf11Ml.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bBf11Ml.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bBf11Ml.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bBf11Ml.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bBf11Ml.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000023cb2-57.dat family_redline behavioral1/memory/4496-59-0x00000000009E0000-0x0000000000A12000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2172 nhI54ON.exe 4508 bBf11Ml.exe 4496 dgP42dI.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bBf11Ml.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bBf11Ml.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nhI54ON.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4572 4508 WerFault.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhI54ON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bBf11Ml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgP42dI.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4508 bBf11Ml.exe 4508 bBf11Ml.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4508 bBf11Ml.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2172 1712 f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa.exe 87 PID 1712 wrote to memory of 2172 1712 f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa.exe 87 PID 1712 wrote to memory of 2172 1712 f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa.exe 87 PID 2172 wrote to memory of 4508 2172 nhI54ON.exe 88 PID 2172 wrote to memory of 4508 2172 nhI54ON.exe 88 PID 2172 wrote to memory of 4508 2172 nhI54ON.exe 88 PID 2172 wrote to memory of 4496 2172 nhI54ON.exe 101 PID 2172 wrote to memory of 4496 2172 nhI54ON.exe 101 PID 2172 wrote to memory of 4496 2172 nhI54ON.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa.exe"C:\Users\Admin\AppData\Local\Temp\f254bb3cdd340abe7fd3edc2b06015749d481f989e6e4c7359cd0e0e71c420aa.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nhI54ON.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nhI54ON.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bBf11Ml.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bBf11Ml.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 10204⤵
- Program crash
PID:4572
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dgP42dI.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dgP42dI.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4508 -ip 45081⤵PID:4588
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
366KB
MD5facdf7903061b2dec29610f1ebadcbf3
SHA10de0bdc0db3196c0ca0df95c3bbfff3137bba41b
SHA2569bc9e762ddf0bc396de592ad41da66cda0a41b6ec0bd4ff56842ea67758b0a02
SHA51218df3da1e4faf82a6b000b6d4af7811deb08e4c4e54b7e69ad8d7074f62f06f09717329e500ba6af74c379401032c2f1e41f75b0253dd2b7a964ca5d0677c069
-
Filesize
220KB
MD5de42ca5e48e76be8fc7fd36752b6eb50
SHA1c594fea49882a1f0c4745c38de903c8f3e963acd
SHA2569be125a22fe4bbedcd63b46faf563f107bb54c1f6c894e45b4794c3e184aa0aa
SHA512b4dbe8b6ed6cf26a7225ef2a8af07629fdcc447920dd8bb5362cefdbbafe439ef92e5011c8c26716dba06646d161eca676470e484995173dd39dc42db454ff7b
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2