Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 03:22
Static task
static1
Behavioral task
behavioral1
Sample
73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e.exe
Resource
win10v2004-20241007-en
General
-
Target
73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e.exe
-
Size
1.3MB
-
MD5
77b8d4b2ad2132f931603309fbd05046
-
SHA1
e087d27fc21ca3c0401d5a25909fe36b17c04968
-
SHA256
73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e
-
SHA512
1fcc484e5f76a1a159936b9a5aeed639976f23540803e5d508504dc3ea7b05d7f217f2ac89ac22bb16a51c88350e3be9e7ba33c09d92c03d76d556fa24c05026
-
SSDEEP
24576:dysLz2xXztwAta5L2gW7mChvIXpdFiBhqSbEqEsWBliK1v4:4nxpPta5SgWKJXpv3SbEqEsWBkK1v
Malware Config
Extracted
redline
rodik
193.233.20.23:4124
-
auth_value
59b6e22e7cfd9b5fa0c99d1942f7c85d
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b76-34.dat healer behavioral1/memory/1700-35-0x00000000005A0000-0x00000000005AA000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bFM81DT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bFM81DT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bFM81DT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bFM81DT.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bFM81DT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection bFM81DT.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/4792-41-0x00000000024E0000-0x0000000002526000-memory.dmp family_redline behavioral1/memory/4792-43-0x0000000002680000-0x00000000026C4000-memory.dmp family_redline behavioral1/memory/4792-44-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-55-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-107-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-105-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-103-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-101-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-99-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-97-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-95-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-93-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-91-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-87-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-85-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-83-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-82-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-77-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-75-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-73-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-71-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-69-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-67-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-65-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-63-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-61-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-59-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-57-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-53-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-51-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-49-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-47-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-45-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-89-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline behavioral1/memory/4792-79-0x0000000002680000-0x00000000026BF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 6 IoCs
pid Process 1168 nOk14vH.exe 3192 nkw05Qk.exe 3900 nce65MI.exe 4388 nbP91uE.exe 1700 bFM81DT.exe 4792 bPA81DV81.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" bFM81DT.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nOk14vH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" nkw05Qk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" nce65MI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" nbP91uE.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bPA81DV81.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nOk14vH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nkw05Qk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nce65MI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbP91uE.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1700 bFM81DT.exe 1700 bFM81DT.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1700 bFM81DT.exe Token: SeDebugPrivilege 4792 bPA81DV81.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2620 wrote to memory of 1168 2620 73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e.exe 84 PID 2620 wrote to memory of 1168 2620 73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e.exe 84 PID 2620 wrote to memory of 1168 2620 73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e.exe 84 PID 1168 wrote to memory of 3192 1168 nOk14vH.exe 85 PID 1168 wrote to memory of 3192 1168 nOk14vH.exe 85 PID 1168 wrote to memory of 3192 1168 nOk14vH.exe 85 PID 3192 wrote to memory of 3900 3192 nkw05Qk.exe 87 PID 3192 wrote to memory of 3900 3192 nkw05Qk.exe 87 PID 3192 wrote to memory of 3900 3192 nkw05Qk.exe 87 PID 3900 wrote to memory of 4388 3900 nce65MI.exe 89 PID 3900 wrote to memory of 4388 3900 nce65MI.exe 89 PID 3900 wrote to memory of 4388 3900 nce65MI.exe 89 PID 4388 wrote to memory of 1700 4388 nbP91uE.exe 90 PID 4388 wrote to memory of 1700 4388 nbP91uE.exe 90 PID 4388 wrote to memory of 4792 4388 nbP91uE.exe 95 PID 4388 wrote to memory of 4792 4388 nbP91uE.exe 95 PID 4388 wrote to memory of 4792 4388 nbP91uE.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e.exe"C:\Users\Admin\AppData\Local\Temp\73ff1293ad80816df1c0c838e593162b0b7561e0939331ce6a86f56dbd50ed7e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nOk14vH.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nOk14vH.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nkw05Qk.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nkw05Qk.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nce65MI.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nce65MI.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nbP91uE.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nbP91uE.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bFM81DT.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bFM81DT.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bPA81DV81.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bPA81DV81.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5537bf12311237f65d2540f3483fa7d7a
SHA1a25ec1679ca512b6b0a873a56a6f55f9f939314f
SHA2564a10c62c5b38a8184c7d4ba1abdc3d13a76039377db6c100a4f90ae8fbf71932
SHA51203ce334796f5ffe3b52670997081f90b5e88e562073df7a8e1222e063c49e3fc4e1b4f2a96a07b9f2b6a3dc41394b29ee2c1e717c509162ee4b66fe123ba74cc
-
Filesize
964KB
MD5c64e469f947c797f946d44f6476706ed
SHA1c7766cc39c079676ac065130d244aa6f37706450
SHA256df8012e49077ea9e940b190c1f87bbe3f98341ab1854c37dcd4f1807a1105619
SHA5120b1baa67971c80615527e85f78e858af9940685689430c0b68d04a35ac4c06e62d4304c2ffe764040e8428eb65892e2a9add21512dc93ba39068e8ddd154bb75
-
Filesize
687KB
MD5cdce2abe933b8fa165349679815509b6
SHA1af6b59895766dd496b795f2e772e7ba54e480c8a
SHA256eaed1607f414546067dcf75da4fd28a335ae9d28a5be65f61bfdc202e6933d14
SHA512726808333f0c931badb113365bc9d40c1a571add7df66c94f0f47c831b0c2fe9bd41212e1e69a0c406d9be84654b1ea9a3715a27873a4a90b4cae9330b25c30e
-
Filesize
399KB
MD5818a1155e4d616c61123c501d827da54
SHA10272f91476a0447cb53fafa2562968840b71916d
SHA256fad794516a42608d52e8414dfddae7d343e3041324b1d1d37e2251d9554f87b6
SHA512ef3326c8c949e4f08ba5268cdbea7e28a9f9e3b902003c7dd4b591a3a61d534106fc0f63233fa4a30f8b57bd302b175d2f57e001306f0418dab1a96908422584
-
Filesize
11KB
MD555824acf42fb4154a328b5480f94240b
SHA1f01fb86dc0de0c4242a6b97c550785ef65d5cddb
SHA256696a8dc95be85b1f1cd62a6381bdfc1e1b1d39a165aeb63ed42131e6ff8243fc
SHA51299c7fa217b10f9cec883752cfe7f482e91e135af5bfcbd4754044054d8516e4e746b1d9874092224aa82f3be7fcf4f2258ae9b82e607d7199e4af1c51b81e787
-
Filesize
322KB
MD5231430e854c098688aa6848702c5018e
SHA146a9be0ad282ff66b7de6586c6cf86ff5057651d
SHA256c2c7ced4db7b7a5eb5960c2d518179b7798494fe893b5bb22c756a811460cdf9
SHA512202a0ec01cdd18613c8fb423418ec0abf3382f2ea8d957c287324c23d083a7ab61fb5207c0e9c3bfb421a58f821daf81506e2ecb4d08fa2cfa993587e1e44217