Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 05:16
Static task
static1
Behavioral task
behavioral1
Sample
eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe
Resource
win10v2004-20241007-en
General
-
Target
eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe
-
Size
934KB
-
MD5
1e1b2decc3b0f8255253d45ffc188d59
-
SHA1
c3b0ab84ecc0fedeb2069e7c1bc92695a3ff03fb
-
SHA256
eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c
-
SHA512
b8246d2e587efde482eeb5c51f2b04878e9e151766192b15216d8eb13144e9855a82398fd7ead99647e3d10cda1bd4aa511dd8a29627dc6bfa96ef792cbc6e97
-
SSDEEP
24576:mynfubRt8a3yVdcri2PCAZfQlsK7It42Qwy:1niRt8vJgwFIy3w
Malware Config
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/memory/4400-2150-0x0000000002A50000-0x0000000002A5A000-memory.dmp healer behavioral1/files/0x0002000000022a9d-2156.dat healer behavioral1/memory/3060-2164-0x0000000000650000-0x000000000065A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral1/memory/4256-4321-0x0000000005760000-0x0000000005792000-memory.dmp family_redline behavioral1/files/0x0007000000023c72-4326.dat family_redline behavioral1/memory/4964-4328-0x00000000004F0000-0x0000000000520000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 89190213.exe -
Executes dropped EXE 5 IoCs
pid Process 3624 un911360.exe 4400 89190213.exe 3060 1.exe 4256 rk869881.exe 4964 si355389.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un911360.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 5888 4400 WerFault.exe 85 2024 4256 WerFault.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un911360.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89190213.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rk869881.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language si355389.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3060 1.exe 3060 1.exe 3060 1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4400 89190213.exe Token: SeDebugPrivilege 4256 rk869881.exe Token: SeDebugPrivilege 3060 1.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 540 wrote to memory of 3624 540 eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe 84 PID 540 wrote to memory of 3624 540 eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe 84 PID 540 wrote to memory of 3624 540 eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe 84 PID 3624 wrote to memory of 4400 3624 un911360.exe 85 PID 3624 wrote to memory of 4400 3624 un911360.exe 85 PID 3624 wrote to memory of 4400 3624 un911360.exe 85 PID 4400 wrote to memory of 3060 4400 89190213.exe 88 PID 4400 wrote to memory of 3060 4400 89190213.exe 88 PID 3624 wrote to memory of 4256 3624 un911360.exe 92 PID 3624 wrote to memory of 4256 3624 un911360.exe 92 PID 3624 wrote to memory of 4256 3624 un911360.exe 92 PID 540 wrote to memory of 4964 540 eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe 105 PID 540 wrote to memory of 4964 540 eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe 105 PID 540 wrote to memory of 4964 540 eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe"C:\Users\Admin\AppData\Local\Temp\eeed18e992402b4c41db5fe3e52ddff8707248ddda866bfa1a098aa136623d2c.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un911360.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un911360.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\89190213.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\89190213.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 13844⤵
- Program crash
PID:5888
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk869881.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk869881.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 12564⤵
- Program crash
PID:2024
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si355389.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si355389.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4400 -ip 44001⤵PID:992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4256 -ip 42561⤵PID:3820
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5ee76cbafd842d963707f852debfab52a
SHA15795cc7ab8a11fb8632bcbe91f2dfd3b0dd1d0a6
SHA25629b155085f5666f4acd365e0ae506012e74e8a13153d7efb854d24023a82130e
SHA512b62a3bcd509827ed4da8ec5aa05dc532190e37cea5d6def2395214b4b47e50b41de26d08014391c7ed7c65eafdb575cea2e2b45e2f772f8c6fb1d091ba2ff062
-
Filesize
782KB
MD549c681d7bc5e2cb326b413091ae47a94
SHA15ccd39ce9e8c9ebf3443307d95172d3550f9cb55
SHA256e22d4480986bc77bd29cd1ab10c2baed7c47055e5e9800f47f5209663bbd8875
SHA51255d0f6b3cb06406f20c5e64054cdff490d67628f6d4b337b6a9ef4cb9a054a5b99c66ebd1e7f21fee26e3b9ad59813e0714d46ec45b4e9398869c60011d2216a
-
Filesize
521KB
MD551726a6bbec539ed7be26a52e7e66626
SHA1a824aeb162421abd483976616bc0f28aec24ac69
SHA256c20e294ab65d1fafc2ee7a9ed31243f9aec516139308ee3d3f53916e26030a4b
SHA51278c78a955674e9a63cb7e341a826cdbaa5e20cd9cbd7bc6e42bfe40b0d3e1ecf93c50eaaf5f0343740c63f32d1066b6a94535900f0105be33f4c8fef15570da2
-
Filesize
582KB
MD57e93c90c6c5443c2f20f69e7a6c6585c
SHA1c663516e87d973415b3b34c831e51d984a5727dc
SHA256dd8eef66a5d149584853ff8974cf068439aa2b64900aa67a8ae1e5a4ab239414
SHA512c5bd00f45e2e3cf45a2425edfb71d9bf06eb007ef52b75bbfb2ba21f7d2c58272212d13814e27cd3cf41ae0fd53a0feb3b85bc8af7e80094f8e35a445a86c953
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91