Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe
Resource
win10v2004-20241007-en
General
-
Target
2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe
-
Size
707KB
-
MD5
357080a4e729d9e86102759a046157f3
-
SHA1
fe89e9729ae10a27dfe3845fb405e13059f49f8a
-
SHA256
2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed
-
SHA512
726cdd826bc09cb09042abc2f0732d1ca8bf640f134f2c1e5078ba8b1133f5ef2766b00d296e091bcf8e3b7b13a18d599ef11ca94ac032e936512c90b2cd9f07
-
SSDEEP
12288:Yy90T1atUdA10oGbbkYRlFIDOjxDcQi93uumzDJSsdn7Um+EduASlVvGh1EK:Yyea2o+IUAyJcQjlp7m0GlVvM1EK
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4496-18-0x00000000071E0000-0x00000000071FA000-memory.dmp healer behavioral1/memory/4496-20-0x0000000007260000-0x0000000007278000-memory.dmp healer behavioral1/memory/4496-21-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-48-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-46-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-44-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-42-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-40-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-38-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-36-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-34-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-32-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-30-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-28-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-26-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-24-0x0000000007260000-0x0000000007273000-memory.dmp healer behavioral1/memory/4496-22-0x0000000007260000-0x0000000007273000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 23398009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 23398009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 23398009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 23398009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 23398009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 23398009.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/724-60-0x0000000007000000-0x000000000703C000-memory.dmp family_redline behavioral1/memory/724-61-0x0000000007760000-0x000000000779A000-memory.dmp family_redline behavioral1/memory/724-63-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-77-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-75-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-73-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-71-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-69-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-67-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-65-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-87-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-62-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-79-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-95-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-93-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-91-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-89-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-85-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-83-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/724-81-0x0000000007760000-0x0000000007795000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 4892 un821863.exe 4496 23398009.exe 724 rk568967.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 23398009.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 23398009.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un821863.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3432 4496 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rk568967.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un821863.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23398009.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4496 23398009.exe 4496 23398009.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4496 23398009.exe Token: SeDebugPrivilege 724 rk568967.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4892 4940 2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe 85 PID 4940 wrote to memory of 4892 4940 2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe 85 PID 4940 wrote to memory of 4892 4940 2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe 85 PID 4892 wrote to memory of 4496 4892 un821863.exe 86 PID 4892 wrote to memory of 4496 4892 un821863.exe 86 PID 4892 wrote to memory of 4496 4892 un821863.exe 86 PID 4892 wrote to memory of 724 4892 un821863.exe 96 PID 4892 wrote to memory of 724 4892 un821863.exe 96 PID 4892 wrote to memory of 724 4892 un821863.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe"C:\Users\Admin\AppData\Local\Temp\2b9a1786ce2aa0025a6f6253969b95ee106fe966e8e73d8d9b121eb3f19134ed.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un821863.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un821863.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\23398009.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\23398009.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 10844⤵
- Program crash
PID:3432
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk568967.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk568967.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:724
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4496 -ip 44961⤵PID:4048
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
553KB
MD5e53087f3d3173e993408f41e765cada5
SHA1bd35ac314511e6c02d3c307d8c8e4f6e487a4e00
SHA256fc7ba7f42ddc061843321903be9f2b1d236dae765d941e656c0797aed1773115
SHA51237572902956656f603417630a44e0a44c24b26f5f976affaddeb4ec0f0cb37ce5a61e9bb5957e59919d48cef84cd11a1842590d9c0328136e664bf25e0a41f76
-
Filesize
258KB
MD539988ff3c071e37d7419faf4c34848bc
SHA109752dbd0211d7104ee25c05716edf2f806b54fa
SHA25629544694a529565603d30b356d8f9ebe2af86af4618c8587dbf62ac1bbb1b3f5
SHA512a06944c42963e9fa503de758003877e0798f316ec06d792b3f8c657a58db3958498d278b61a6af753dfc39d0291c24d13b4304d5942d6d5cc1f549f3e4292374
-
Filesize
353KB
MD5d01b46e19ec58470019d25a8b1f3b11e
SHA1eb2bef160efb70ab67051ace4ab1ce33e4f73da3
SHA256aeac6da62a63dc09918fd3063c17b2ebd0be4903d26e9a5a2ff22730d7b00982
SHA512b794fdcc8d7424ec72a87a61b4c05a7fe73f8d37fd733789bc47e831a880942fc23848419a2457c2d8c93d5cf254541c9f4e37209d6a29c885b2516545a087d5