Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372.exe
Resource
win10v2004-20241007-en
General
-
Target
86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372.exe
-
Size
690KB
-
MD5
0632473dcf75ed1d9567e851f1e88485
-
SHA1
8da4e1764a114ffd523cf4faf85b7b8ab739e818
-
SHA256
86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372
-
SHA512
259a94fc982b983738c6b9ea08298174284ece2f3cd3915d99fed532fa9e90483ea1601516ff1c88e245c02477a3a59a587cb5411921ec49511588c2264ae5a9
-
SSDEEP
12288:ey903HBsv7dsvWdzqUet9LExQBOzZIJGa66rhpEu+sKmbrLjrEA86O/TmQpzPgEi:eyrv7CuVC9LETzZn8KRmb3jrEA86KTm/
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/1752-19-0x0000000002340000-0x000000000235A000-memory.dmp healer behavioral1/memory/1752-21-0x00000000024F0000-0x0000000002508000-memory.dmp healer behavioral1/memory/1752-49-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-47-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-45-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-43-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-42-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-39-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-37-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-35-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-34-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-31-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-29-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-27-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-25-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-23-0x00000000024F0000-0x0000000002503000-memory.dmp healer behavioral1/memory/1752-22-0x00000000024F0000-0x0000000002503000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 73119702.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 73119702.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 73119702.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 73119702.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 73119702.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 73119702.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/1804-60-0x00000000049B0000-0x00000000049EC000-memory.dmp family_redline behavioral1/memory/1804-61-0x0000000005010000-0x000000000504A000-memory.dmp family_redline behavioral1/memory/1804-78-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-81-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-79-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-75-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-73-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-71-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-85-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-69-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-67-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-65-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-63-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-62-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-83-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-95-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-93-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-91-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-89-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/1804-87-0x0000000005010000-0x0000000005045000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 872 un007939.exe 1752 73119702.exe 1804 rk451472.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 73119702.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 73119702.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un007939.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 936 1752 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rk451472.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un007939.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73119702.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1752 73119702.exe 1752 73119702.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1752 73119702.exe Token: SeDebugPrivilege 1804 rk451472.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1712 wrote to memory of 872 1712 86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372.exe 85 PID 1712 wrote to memory of 872 1712 86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372.exe 85 PID 1712 wrote to memory of 872 1712 86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372.exe 85 PID 872 wrote to memory of 1752 872 un007939.exe 86 PID 872 wrote to memory of 1752 872 un007939.exe 86 PID 872 wrote to memory of 1752 872 un007939.exe 86 PID 872 wrote to memory of 1804 872 un007939.exe 103 PID 872 wrote to memory of 1804 872 un007939.exe 103 PID 872 wrote to memory of 1804 872 un007939.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372.exe"C:\Users\Admin\AppData\Local\Temp\86c85f3cc1ccf5555c492fc8ceee602a577e9aa84f4bc42642b65775028cb372.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un007939.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un007939.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\73119702.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\73119702.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 10724⤵
- Program crash
PID:936
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk451472.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk451472.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1752 -ip 17521⤵PID:1848
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
535KB
MD552fd94b8a07c64513979c78d74ccb68a
SHA1174c2540db4179c3e6396804c95df55a7adf5303
SHA2561d0b3ffc2b147d5c77107c8804cdba431f7d2cf2ace4953d0e871623f14436e6
SHA5124be29827840fddb152ba6e6db691dff5d070cca646aab1c616c15f176123b4dcbe85f5859af003ba686b868d2f7d7134dd20ed5d9ac3b0f8a9b7d565fe00e0da
-
Filesize
259KB
MD57e64d5c2b694d0f78d6b76b8dbd51503
SHA1a637d14dfad39dbcf084ddf405a1d8e71f6250f3
SHA2569baa947a557953ead6f2a8a76a36c26dd801205c6a1eb8ad831f02019eb723c2
SHA512e236c1fe66b30b6df78bb00d4af0ee0e140d114694cfd8d367eb19563ae1e367fea369754b515cdb47b2689aaacbb4878b157f2459fad7f34b21864addb6cf63
-
Filesize
341KB
MD56bc35734d02c20037c486bab56be8264
SHA1805d7de7ebf83f2ce1313849af40d283edb55fb5
SHA25638ec4d64ff9291a54944d2909b00e6ac7df0c988a792d656056507f5c8aaf643
SHA51271218d0fb4387156292bf763edb575eb48aab5ca455c9a559b3009bcdbde9e2bdcbdeff07c1ea199ea94ed934b4bf4daf9165b87f16f79135404f42080585fb5