Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c.exe
Resource
win10v2004-20241007-en
General
-
Target
3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c.exe
-
Size
539KB
-
MD5
7cae8f63653e6fa63e0a202a16e26705
-
SHA1
ca873367f2eed57c3a90478583b9b5a572bfbcc1
-
SHA256
3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c
-
SHA512
a5a46aef077bbc636cf6759726777e3702f208c876834fce150c5e049ea63ca7cc6e23fefa2541e9db60a732c5f0b065760141893b81f7de7ca0bfc0c5c8b427
-
SSDEEP
12288:EMrYy90y3Eb5Gv7Ic2B689YdxiI4+b90HAP1KNL:0yVPvh2BD9YPbR0gPoNL
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0032000000023b76-12.dat healer behavioral1/memory/4476-15-0x00000000000B0000-0x00000000000BA000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1980.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1980.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1980.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1980.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1980.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro1980.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/4300-22-0x0000000004830000-0x0000000004876000-memory.dmp family_redline behavioral1/memory/4300-24-0x0000000004D80000-0x0000000004DC4000-memory.dmp family_redline behavioral1/memory/4300-30-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-38-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-88-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-86-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-82-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-80-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-78-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-76-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-74-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-72-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-70-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-66-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-64-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-63-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-58-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-56-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-54-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-52-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-50-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-48-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-46-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-42-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-40-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-36-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-34-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-32-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-84-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-68-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-60-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-44-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-28-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-26-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline behavioral1/memory/4300-25-0x0000000004D80000-0x0000000004DBE000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 3924 unio5373.exe 4476 pro1980.exe 4300 qu1104.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1980.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio5373.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unio5373.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu1104.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4476 pro1980.exe 4476 pro1980.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4476 pro1980.exe Token: SeDebugPrivilege 4300 qu1104.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4856 wrote to memory of 3924 4856 3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c.exe 83 PID 4856 wrote to memory of 3924 4856 3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c.exe 83 PID 4856 wrote to memory of 3924 4856 3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c.exe 83 PID 3924 wrote to memory of 4476 3924 unio5373.exe 84 PID 3924 wrote to memory of 4476 3924 unio5373.exe 84 PID 3924 wrote to memory of 4300 3924 unio5373.exe 93 PID 3924 wrote to memory of 4300 3924 unio5373.exe 93 PID 3924 wrote to memory of 4300 3924 unio5373.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c.exe"C:\Users\Admin\AppData\Local\Temp\3aa6e90ff2f690deca63a865cd19c14903c8ef60d1b42e55d85dd617038fc32c.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5373.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio5373.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1980.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1980.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1104.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1104.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
397KB
MD54fc7d14b1f44153176e491ae8ec949bc
SHA1f08ef3195a7c0bbee13ed3b5c9b097b26476bde7
SHA256fd450ae21bef1d4cb60e16b469242ee6b8a8bbbe27118873e6848e7a98db1cab
SHA51254a250a97956027c182f3b73e698c4236adddbb37f1a85cfa8b569445826aba670480798801c5e036c20a8f2ad3022ce74c1b9ca693660931d85994ba8b7b2f6
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
355KB
MD5a2d11700f67c3989874eadfdc5591074
SHA1d49ad0c329545b2d4fbe3f5b869e62973f49cacd
SHA256be661bcd116cd8ed65a3e2023353fe6a772e1b13012b911552793d08adc68212
SHA512fcdc2ee5b0af84f803e034e41e60494d59891b350e81675dd6e231a6bb3562a4860ba302cfa7bc6214c83fe02d68da0cda7a701553f6150823711cc3e41ec743