Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 03:54
Static task
static1
Behavioral task
behavioral1
Sample
92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd.exe
Resource
win10v2004-20241007-en
General
-
Target
92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd.exe
-
Size
690KB
-
MD5
e6c077fa3ff235a94ff006ab186dc714
-
SHA1
e4e3147f321a749f634e9cc211f07b8571530dd9
-
SHA256
92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd
-
SHA512
1699ace331a9418220fe137b38b13f217d49cf05f16aedb6439500e5073e762cf4f709efeed00f5ffb52e89158b9b58abe02781625379e99b4f5c3f9e8568f9e
-
SSDEEP
12288:5y904At1vNOdDoH3Mul6kP5RW3kfRkFw1ke3WGhniN9mcGRWafsL:5yPAt1v0dDic46cRW3GRfiNscH
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/468-19-0x0000000002300000-0x000000000231A000-memory.dmp healer behavioral1/memory/468-21-0x00000000025B0000-0x00000000025C8000-memory.dmp healer behavioral1/memory/468-23-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-49-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-47-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-45-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-43-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-42-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-39-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-38-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-35-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-33-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-31-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-29-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-27-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-25-0x00000000025B0000-0x00000000025C3000-memory.dmp healer behavioral1/memory/468-22-0x00000000025B0000-0x00000000025C3000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 37412964.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 37412964.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 37412964.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 37412964.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 37412964.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 37412964.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/3248-60-0x0000000002570000-0x00000000025AC000-memory.dmp family_redline behavioral1/memory/3248-61-0x0000000004AA0000-0x0000000004ADA000-memory.dmp family_redline behavioral1/memory/3248-69-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-73-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-95-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-93-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-89-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-87-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-85-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-84-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-79-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-77-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-75-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-71-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-91-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-81-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-67-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-65-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-63-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline behavioral1/memory/3248-62-0x0000000004AA0000-0x0000000004AD5000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 3604 un357743.exe 468 37412964.exe 3248 rk360877.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 37412964.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 37412964.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un357743.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 392 468 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un357743.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37412964.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rk360877.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 468 37412964.exe 468 37412964.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 468 37412964.exe Token: SeDebugPrivilege 3248 rk360877.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4576 wrote to memory of 3604 4576 92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd.exe 85 PID 4576 wrote to memory of 3604 4576 92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd.exe 85 PID 4576 wrote to memory of 3604 4576 92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd.exe 85 PID 3604 wrote to memory of 468 3604 un357743.exe 86 PID 3604 wrote to memory of 468 3604 un357743.exe 86 PID 3604 wrote to memory of 468 3604 un357743.exe 86 PID 3604 wrote to memory of 3248 3604 un357743.exe 96 PID 3604 wrote to memory of 3248 3604 un357743.exe 96 PID 3604 wrote to memory of 3248 3604 un357743.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd.exe"C:\Users\Admin\AppData\Local\Temp\92f58ce16c5dc76860c08560cd2073f270d81680f7dc735ce320beae3c374bbd.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un357743.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un357743.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\37412964.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\37412964.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 10924⤵
- Program crash
PID:392
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk360877.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk360877.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 468 -ip 4681⤵PID:792
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD5fa44093c98fa2066e5fb2bad588328ee
SHA1b5d093fc6beb21c422d21fc267dbe78f0caf6d63
SHA2560a960fdd9ce4577490decb743a7260757f377da4e8398c5600e95ad89b633284
SHA512793084e7ca8b07dfe5572369f5d6db877dc2cfad86fa338fd50fe3b29d95b7db91a51479cb67c781c9c630f5bc26867978fcfcc0da90bdda07de58d00e06f321
-
Filesize
258KB
MD5e415738e28d7ca2693a92478f52eefcc
SHA1a74e2e9fb25a6a66d206a176ef8bff6e3da33e21
SHA2568e32171bfce77de6de525adae190f7fbf223d5eb4dcb0a05fd37df09813af561
SHA5129addfc8cfb416869356a83de9cef42513a8ecc675f8ce5d03a92cb12defef5585cfce953d8c232dbd00dca4df196d19e88149551a514e1a3d1b3f690caa47c83
-
Filesize
341KB
MD5d35a5667a2e845e0f79ebaf34659f766
SHA1e71eedec8b59e141bcc6cba66f5b606bb6f9cdbc
SHA2563b133c9691fccb63dfa296653874c047cade3868f32ec7aa07d800568171743e
SHA5127946210ed30d9544103f7376b8d662e3c7d727f3959e3fbaaab4080f3fd7e7d51ae127f809c5884a94c543919f310f758c40990a0d8df08c3ef8daaeb4175fad