Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603.exe
Resource
win10v2004-20241007-en
General
-
Target
38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603.exe
-
Size
682KB
-
MD5
9e4f865bd4d18f5618fdea189d90218b
-
SHA1
4bb1d2b7765763fcdab1f607e89fa701b2167f19
-
SHA256
38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603
-
SHA512
bd3b52ba629c1000caaaa84b683ae6d20f6335b077e5961aed28c1f6110ba9aeb3f3adf15221140dd9c74ea58a44c29fb5643c82213b4822afc14a03e2a70031
-
SSDEEP
12288:aMrgy90GmtqC5UmF8YAsIbn6JWQZ2xk3BNZceU0CjoN33qaaMtJYvOg+O0:my2PAsrTZ2xedCUN33qaaMtJcOgX0
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4916-18-0x0000000004A60000-0x0000000004A7A000-memory.dmp healer behavioral1/memory/4916-20-0x0000000004D60000-0x0000000004D78000-memory.dmp healer behavioral1/memory/4916-21-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-48-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-44-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-42-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-40-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-38-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-34-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-32-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-30-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-28-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-26-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-24-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-46-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-36-0x0000000004D60000-0x0000000004D72000-memory.dmp healer behavioral1/memory/4916-22-0x0000000004D60000-0x0000000004D72000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5290.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro5290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5290.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/1992-60-0x00000000049B0000-0x00000000049F6000-memory.dmp family_redline behavioral1/memory/1992-61-0x00000000071D0000-0x0000000007214000-memory.dmp family_redline behavioral1/memory/1992-62-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-75-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-95-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-93-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-91-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-89-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-87-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-85-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-83-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-81-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-79-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-77-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-73-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-71-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-69-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-67-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-65-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline behavioral1/memory/1992-63-0x00000000071D0000-0x000000000720E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 4508 un343565.exe 4916 pro5290.exe 1992 qu5081.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5290.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un343565.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3968 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un343565.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro5290.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu5081.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4916 pro5290.exe 4916 pro5290.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4916 pro5290.exe Token: SeDebugPrivilege 1992 qu5081.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2556 wrote to memory of 4508 2556 38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603.exe 83 PID 2556 wrote to memory of 4508 2556 38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603.exe 83 PID 2556 wrote to memory of 4508 2556 38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603.exe 83 PID 4508 wrote to memory of 4916 4508 un343565.exe 84 PID 4508 wrote to memory of 4916 4508 un343565.exe 84 PID 4508 wrote to memory of 4916 4508 un343565.exe 84 PID 4508 wrote to memory of 1992 4508 un343565.exe 96 PID 4508 wrote to memory of 1992 4508 un343565.exe 96 PID 4508 wrote to memory of 1992 4508 un343565.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603.exe"C:\Users\Admin\AppData\Local\Temp\38fc37d74d59a9a1872a16354fedcb639a6fcc10eed4283d2f153fba9c97e603.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un343565.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un343565.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5290.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5290.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5081.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5081.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3968
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
540KB
MD52cdee295bf09137fafdcf768a610c08e
SHA1a030b3c4ed544f741af4f2ec93f064cb5af6fe28
SHA256f1221a4d7a3a18518654012c1e60d410037a8e5e6c1c4599aa42d9f400d95986
SHA512ae0ccb544d70211820dfa864746e152a1dc36c6fd62edfb0c5691845c0930fecb5b97b1428a9f6d4fdef317db1484bdaa8179635ce394bf033ff163b11cf2d58
-
Filesize
322KB
MD522c511bf258f5b73f13bc83d9b40d9b0
SHA133e63312d8660b6b819579e80af9e2751355e72b
SHA256b663b01d9fb25d64eadde4ade02763f8c91765caae7322c5501ff3062ae310fc
SHA5120cda3124fbff8aab567b81b489ab2f73e76d1472f5b1c4891452ce40212fb44491add3f5ed7f498478a5112945c13616838d9222f50c9f4430516713392f4c7b
-
Filesize
379KB
MD5a8dc0d5389d3566c7365bc0247fdfd95
SHA191c7b4e8480f97064b11852b4744970a4ad9c6cb
SHA2567c0f71776439259917195da9152b39710db1be7d993fdb60f7807ab5e6e4136c
SHA5123a1c4460ccbc457a128c0cea71db9eef25bdd0544c886612f11d188a2de57f968a2b3dbbb538440c78d0b058c52c874388e6858246a3193a1ef82c5d998774a0