Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 03:49
Static task
static1
Behavioral task
behavioral1
Sample
3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe
Resource
win10v2004-20241007-en
General
-
Target
3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe
-
Size
653KB
-
MD5
e783473404f549371250a347492d6b36
-
SHA1
c569070938159171abd8b0979d46b0353e3f94fb
-
SHA256
3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc
-
SHA512
87bf25315af8da96bf1c98b65a144df096e8ac4768cb865daa263cc067e22dda004ef3fcb09b21cfdda0502b0957d10095233660d66c20311f1976eab1124c7c
-
SSDEEP
12288:DMrBy90hG1RmblqhiDhas+pG7yU7qhm/ZtlcJWUPG:SyXKcyas+pGTgmBIo
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
diza
77.91.124.145:4125
-
auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023c88-12.dat healer behavioral1/memory/5112-15-0x00000000006C0000-0x00000000006CA000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr979746.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr979746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr979746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr979746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr979746.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr979746.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2380-2105-0x0000000005400000-0x0000000005432000-memory.dmp family_redline behavioral1/files/0x0007000000023c8b-2110.dat family_redline behavioral1/memory/4532-2118-0x0000000000950000-0x0000000000980000-memory.dmp family_redline behavioral1/files/0x0007000000023c86-2127.dat family_redline behavioral1/memory/3188-2129-0x0000000000BD0000-0x0000000000BFE000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation ku659454.exe -
Executes dropped EXE 5 IoCs
pid Process 2756 ziKW8225.exe 5112 jr979746.exe 2380 ku659454.exe 4532 1.exe 3188 lr898577.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr979746.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziKW8225.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2620 2380 WerFault.exe 98 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ziKW8225.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku659454.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lr898577.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5112 jr979746.exe 5112 jr979746.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5112 jr979746.exe Token: SeDebugPrivilege 2380 ku659454.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2756 2424 3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe 83 PID 2424 wrote to memory of 2756 2424 3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe 83 PID 2424 wrote to memory of 2756 2424 3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe 83 PID 2756 wrote to memory of 5112 2756 ziKW8225.exe 84 PID 2756 wrote to memory of 5112 2756 ziKW8225.exe 84 PID 2756 wrote to memory of 2380 2756 ziKW8225.exe 98 PID 2756 wrote to memory of 2380 2756 ziKW8225.exe 98 PID 2756 wrote to memory of 2380 2756 ziKW8225.exe 98 PID 2380 wrote to memory of 4532 2380 ku659454.exe 103 PID 2380 wrote to memory of 4532 2380 ku659454.exe 103 PID 2380 wrote to memory of 4532 2380 ku659454.exe 103 PID 2424 wrote to memory of 3188 2424 3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe 107 PID 2424 wrote to memory of 3188 2424 3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe 107 PID 2424 wrote to memory of 3188 2424 3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe"C:\Users\Admin\AppData\Local\Temp\3d96d97cf6b1c501716fe384a4cc235ea5d790ee05f1cb47a567c5f4112017bc.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKW8225.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKW8225.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr979746.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr979746.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku659454.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku659454.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 13804⤵
- Program crash
PID:2620
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr898577.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr898577.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2380 -ip 23801⤵PID:3396
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5e5ed741c713e85a193469d65a0e88834
SHA1c59fc7c5a60f1d7691e80d20421d6ab10f6880ca
SHA256dd7af6e87912074fe71914f3852cc75ab34da5af1d907b5ba24ce7222921b2b0
SHA51266f5ca484254492274492548dcb5c04bedbb0e84678ba23373d50482052401ad4e913c14571c04865931573590cd410a82519b6eb18ce88a848a72625715db03
-
Filesize
496KB
MD5ea4393938eea54c48fdfee8890a4686c
SHA1a7e8b15acda357deb17f7ed86dad9a4a0ecd293a
SHA2566c4c66e2984c63457fd11d6e961e1be7408f2f3c02faab6f44479aae5a98245a
SHA512e8ca4382665b55472c344421ce47a4a21c990009b5cbff82b38cfee87b1aa3358151227a0138ab03554f200578c8eddbdb32c59542d939a5c1d65dabc3eaa1a8
-
Filesize
11KB
MD50fc0ebfa6765c5123c0fa2dcd3ca86d0
SHA1d568c866efb17982263a1f3475c3818d6a5b0851
SHA25623a5cd311f4e921fca54423bdd7ad345539b4f306b3655b4f532ff03d9b9ae0f
SHA512de119a1185f156e93b2320f565ac6343bfaa4ae92c2906f8c916e7e4284a30cd08b7d03cdbc1d0e394de8dc3fe1d9107405bb771280fdacf325847c0f5b2f4c2
-
Filesize
414KB
MD507860a7d351528b3d1087b45dd2f7508
SHA1bb5e87e1aa62d3a7c04ca44a1e4eb2b0cb7157f3
SHA256a321b14aa60d100aa96e10247ed856b3669421ad56db9f990b6345f11fac48ca
SHA5122f6b90e86ead65b59301ce90427b813717d65dc25d1eed8dd9771861a07e187e8a0ff82b07a27f00b890546705d8aa6a665d2ebc128f181d72a692ee516c78c2
-
Filesize
168KB
MD51073b2e7f778788852d3f7bb79929882
SHA17f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA51290cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0