Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f.exe
Resource
win10v2004-20241007-en
General
-
Target
85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f.exe
-
Size
704KB
-
MD5
fdc221f7aa10f8c25f34af0faa0f833b
-
SHA1
2a0ff7ca50717afaf694cc13b255552577b91622
-
SHA256
85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f
-
SHA512
50e9c1501695993ae28877d30990c07bad26132f03a715bfb92eab647abe1dc73705201616e793f669ca5a02e08eaa382803434300788da0aea2ee630b20333f
-
SSDEEP
12288:Jy904wMcDGTylyuWUeMevT979GTDmBbOG4ErcywlI18zCXqIzVMhn/KFqSHAyWWd:JyXwLSTAzVQB7MTOb+EnoiqIhetRyR
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4532-17-0x0000000004C60000-0x0000000004C7A000-memory.dmp healer behavioral1/memory/4532-19-0x0000000004D10000-0x0000000004D28000-memory.dmp healer behavioral1/memory/4532-26-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-48-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-46-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-44-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-42-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-40-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-38-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-36-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-34-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-32-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-30-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-28-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-24-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-22-0x0000000004D10000-0x0000000004D22000-memory.dmp healer behavioral1/memory/4532-21-0x0000000004D10000-0x0000000004D22000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr883687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr883687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr883687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr883687.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr883687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr883687.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/5024-59-0x0000000004AB0000-0x0000000004AEC000-memory.dmp family_redline behavioral1/memory/5024-60-0x0000000004DB0000-0x0000000004DEA000-memory.dmp family_redline behavioral1/memory/5024-94-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-92-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-90-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-88-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-86-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-84-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-83-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-80-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-78-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-76-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-74-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-72-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-70-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-68-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-66-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-64-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-62-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline behavioral1/memory/5024-61-0x0000000004DB0000-0x0000000004DE5000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 4820 un249754.exe 4532 pr883687.exe 5024 qu217000.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr883687.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr883687.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un249754.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4624 4532 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pr883687.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu217000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un249754.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4532 pr883687.exe 4532 pr883687.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4532 pr883687.exe Token: SeDebugPrivilege 5024 qu217000.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3332 wrote to memory of 4820 3332 85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f.exe 83 PID 3332 wrote to memory of 4820 3332 85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f.exe 83 PID 3332 wrote to memory of 4820 3332 85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f.exe 83 PID 4820 wrote to memory of 4532 4820 un249754.exe 84 PID 4820 wrote to memory of 4532 4820 un249754.exe 84 PID 4820 wrote to memory of 4532 4820 un249754.exe 84 PID 4820 wrote to memory of 5024 4820 un249754.exe 99 PID 4820 wrote to memory of 5024 4820 un249754.exe 99 PID 4820 wrote to memory of 5024 4820 un249754.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f.exe"C:\Users\Admin\AppData\Local\Temp\85d3feccfd30e3ca9e4869222433176c290f660ec27848c2825d6f167ff1aa0f.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un249754.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un249754.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr883687.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr883687.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 10804⤵
- Program crash
PID:4624
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu217000.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu217000.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4532 -ip 45321⤵PID:2284
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550KB
MD58c48c05847bd9dbddaa4ebef48d35a10
SHA18cdfbd6b6c045443dca40db195f96b014093d77b
SHA256e436f2350f6b012a4935a24326881d0583c05002444cc60a11c3ffd1a06f6849
SHA512a5bfcd7b29be3d2a59f499122db682709d2d366598ba1566cae322ee4f66f3cfad89d3f464a74ea21cbeb3bbd164c2c0328b71df189b3aac518480b2afb406bb
-
Filesize
278KB
MD5756d07db535310244ea4d8f29629abe6
SHA1760e467705b6392fe511cebba6876265a4145fc9
SHA256793f0be82ac28894f71c03f1e9221158674a608b1b424309901d45a4da8f6378
SHA5128e24a892c9147b60edf42b9b3cc33e38a3cbe0be7ff7da443b391bec9775521f1a945f037c31259b4008e84fb5712062798dd23e22a7bbf438beb303a16f4958
-
Filesize
361KB
MD579f9f72138971754bde274c56e372510
SHA16f7e38cbdd632a6e69f1e762c1fa6f7e325b3ad2
SHA256b69892fd6e8e05d9c00d73337651a75b6d626ce9d0b456cd37a91fb7e77cf1cd
SHA51236c7503c5f7fa293dd621cc4fab6d72ae016f5471feedba4478cccdd3022dd963c481609856102fe7ffb4afa27ce4e6906bf417528a246593b5b00a2b776bad2