Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9.exe
Resource
win10v2004-20241007-en
General
-
Target
0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9.exe
-
Size
1.1MB
-
MD5
77273073219f09693f62c24c7ab5c40c
-
SHA1
61c5c772b782572c2f88e5b871b27bc00bdfd111
-
SHA256
0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9
-
SHA512
59535b95b111c42c6306e31d8ca15c5dda3b1236cf3d04210588a2c95362fce850e620a1b6bbfc7239c9b62c0707239e00513d9f9cc9901a1acfeacb464f91ac
-
SSDEEP
24576:WyaT1cXOFJn61WrRkqwxOdX3lBXQysT7+YccPP:laT1VJ61WlFET315
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4572-23-0x0000000002790000-0x00000000027AA000-memory.dmp healer behavioral1/memory/4572-25-0x00000000027C0000-0x00000000027D8000-memory.dmp healer behavioral1/memory/4572-43-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-53-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-51-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-49-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-47-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-45-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-41-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-39-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-37-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-35-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-33-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-31-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-29-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-27-0x00000000027C0000-0x00000000027D2000-memory.dmp healer behavioral1/memory/4572-26-0x00000000027C0000-0x00000000027D2000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr171508.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr171508.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr171508.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr171508.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr171508.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr171508.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/3816-62-0x0000000002700000-0x000000000273C000-memory.dmp family_redline behavioral1/memory/3816-63-0x0000000004E00000-0x0000000004E3A000-memory.dmp family_redline behavioral1/memory/3816-67-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-89-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-98-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-95-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-93-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-87-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-85-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-84-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-81-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-80-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-77-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-75-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-73-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-71-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-70-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-91-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-65-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline behavioral1/memory/3816-64-0x0000000004E00000-0x0000000004E35000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
pid Process 3176 un919702.exe 4596 un713929.exe 4572 pr171508.exe 3816 qu753783.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr171508.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr171508.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un919702.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un713929.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3192 4572 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un919702.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un713929.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pr171508.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu753783.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4572 pr171508.exe 4572 pr171508.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4572 pr171508.exe Token: SeDebugPrivilege 3816 qu753783.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4888 wrote to memory of 3176 4888 0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9.exe 83 PID 4888 wrote to memory of 3176 4888 0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9.exe 83 PID 4888 wrote to memory of 3176 4888 0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9.exe 83 PID 3176 wrote to memory of 4596 3176 un919702.exe 84 PID 3176 wrote to memory of 4596 3176 un919702.exe 84 PID 3176 wrote to memory of 4596 3176 un919702.exe 84 PID 4596 wrote to memory of 4572 4596 un713929.exe 86 PID 4596 wrote to memory of 4572 4596 un713929.exe 86 PID 4596 wrote to memory of 4572 4596 un713929.exe 86 PID 4596 wrote to memory of 3816 4596 un713929.exe 99 PID 4596 wrote to memory of 3816 4596 un713929.exe 99 PID 4596 wrote to memory of 3816 4596 un713929.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9.exe"C:\Users\Admin\AppData\Local\Temp\0a6c0b19939c08a77506f06a3fd89238e0d0337945cdaf62c30c770d93775cb9.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un919702.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un919702.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un713929.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un713929.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr171508.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr171508.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 10845⤵
- Program crash
PID:3192
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu753783.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu753783.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4572 -ip 45721⤵PID:1408
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
762KB
MD5e19ab3d859c03210992e7e4ad28de8cf
SHA14ae09fc319ffcf197e39902626492007fa1bfe89
SHA256b124ab1cd071c6539dab30fca698b0106e13e6fb7c80c0ac918c414f6502c423
SHA51236fce770b2852648e398ded95c239e9ce25334717bba0072a6c401751b0d6f60bdef78223aa9679ed805f05a53563286146c8537b9e106b6b4b8dbd04c24a086
-
Filesize
608KB
MD51165d0edf3df9f66ea079541f4ac7dc8
SHA1a37fb74ac4526cc4b2f8f80d72a4add2b22db061
SHA256f0be9ddf664d5a0f30a4aae4364917a98a994ad991e651af30a039ae1105988c
SHA5127aceb45c605263e30caae0461dd0e24f8887ca4ba11de9777408018391d8114bf2f16691b7a70b2e657dc5882dea259b9f07ded580a20a123c277876d27b6d05
-
Filesize
405KB
MD5ac3a85bb6628c5e468b68fad7cfe2180
SHA1d94d37a77c746161a5b090ca5abd3fd08aa7839d
SHA256b949878d3fa3adacef41b4bc505366f43ab10a8945ea2a210fa6d015387cd53d
SHA512cabb09eab7e571b2243f7c3cd9f540eabd3684bacbc46b09f62ed04469653a00d782b072801ec513bd390e0f1c7d8701191b4575cf17607bf2b1bcce0126d7ce
-
Filesize
487KB
MD5bc4299d50a4d21b295992e724db3dd74
SHA1a8cbff65b30e51a284824824ce610291611801f3
SHA2561fff1bda44e8f183a36078de3d1226b041c2cc6e89fc374629378d0f2de39ba1
SHA512fe20bc723c8342e15b584984e1119c112236ba88960b1d741e64cddb579889417dfa5fff3b8b0a01e32e6c032bf5b99a211a972921a97a365b7d6bab681251f6