Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 05:09
Static task
static1
Behavioral task
behavioral1
Sample
9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe
Resource
win10v2004-20241007-en
General
-
Target
9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe
-
Size
544KB
-
MD5
6d85a69cba3d56afb36bbcc8cba9262a
-
SHA1
487d60f813130cf78a02b5a63471ffab1956cafc
-
SHA256
9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89
-
SHA512
70469a719b39284238c7d294f9c115f3136891a61645f4b3e2cb728a4a004f99408e7534f54048f69598ea08a34a49487673e9bdb060a290f88dcf2f4f0c612e
-
SSDEEP
12288:+Mrgy907t0Kyfn11FDvJUUqgUVML5wJ0oLwxvyUP/NPF:KyMkfn/Fzm44MdBXj
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b69-12.dat healer behavioral1/memory/3208-15-0x0000000000F20000-0x0000000000F2A000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h41Pk92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h41Pk92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h41Pk92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h41Pk92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h41Pk92.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h41Pk92.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/2188-22-0x00000000026E0000-0x0000000002726000-memory.dmp family_redline behavioral1/memory/2188-24-0x0000000005340000-0x0000000005384000-memory.dmp family_redline behavioral1/memory/2188-26-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-82-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-88-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-86-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-84-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-80-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-78-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-76-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-74-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-70-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-68-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-66-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-64-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-60-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-58-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-56-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-55-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-50-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-48-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-44-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-42-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-40-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-38-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-73-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-63-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-53-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-46-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-36-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-34-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-32-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-30-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-28-0x0000000005340000-0x000000000537E000-memory.dmp family_redline behavioral1/memory/2188-25-0x0000000005340000-0x000000000537E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 3284 niba8851.exe 3208 h41Pk92.exe 2188 isueZ15.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h41Pk92.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba8851.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language niba8851.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language isueZ15.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3208 h41Pk92.exe 3208 h41Pk92.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3208 h41Pk92.exe Token: SeDebugPrivilege 2188 isueZ15.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3604 wrote to memory of 3284 3604 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe 84 PID 3604 wrote to memory of 3284 3604 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe 84 PID 3604 wrote to memory of 3284 3604 9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe 84 PID 3284 wrote to memory of 3208 3284 niba8851.exe 85 PID 3284 wrote to memory of 3208 3284 niba8851.exe 85 PID 3284 wrote to memory of 2188 3284 niba8851.exe 93 PID 3284 wrote to memory of 2188 3284 niba8851.exe 93 PID 3284 wrote to memory of 2188 3284 niba8851.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe"C:\Users\Admin\AppData\Local\Temp\9f16599b6c536c749d369a5ef0dd9968054b068ee7a8d10a1889e210185cce89.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba8851.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba8851.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h41Pk92.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h41Pk92.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\isueZ15.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\isueZ15.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
402KB
MD5b860c286a60ab2ce32b8ece2bbead9e2
SHA162824ed0b6afee1152d0a6a760ce952892062850
SHA2564edd165dc08fe6fbdff6022fd83ca627be496fafe1a39ae20fc15f8552dad3c9
SHA512cc1603f7d1b52e134912c68ea2a77fc20ed71375a63e073b9d13164636dad6d43579b1aede26b2b51e4ab166f76945fb4cd3c6fc5ca1b81a8cefb8177da5ec6f
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
349KB
MD5c58fea049f83bb1e2727d6aa0af27368
SHA13e260a33e1017b2f2da4836c1e9118e0b0f2a8d0
SHA256a964ce65e882eb3471255e3b6f36319f119f75ee16e8bf8fe52db59083fbfd58
SHA5126211b70809a2f25bb7213e5a60f4c70ca614deac127c069f091a633806061d6c7b12d78d6af758ca9556db1b89f43b288c945b220e2700b1f639af0137fff2a5