Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b.exe
Resource
win10v2004-20241007-en
General
-
Target
efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b.exe
-
Size
706KB
-
MD5
842ff338f9e1dc398ab2e02f7bb41d58
-
SHA1
abdf1651dd1e29f34b059f2ecfcd6866eb8aadb6
-
SHA256
efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b
-
SHA512
b4b4b1f4ef59cad8eb3132529d2965f50901e1a112d9e4ee53346a4232e156affc77975508421702350a479d327bec14683d9e27c70fd85018979ec9ba3348af
-
SSDEEP
12288:sMrSy90rS+AsSZ+EjYQobeeMQoQjJvjaMH/oBUgfhMC7j9m51FvoX1eb:2yJ+L6bYjMQnjBjT/oagWCE5vvoX1C
Malware Config
Extracted
redline
ronam
193.233.20.17:4139
-
auth_value
125421d19d14dd7fd211bc7f6d4aea6c
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023cb4-19.dat healer behavioral1/memory/1768-22-0x0000000000B60000-0x0000000000B6A000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rUX3422.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rUX3422.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rUX3422.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rUX3422.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rUX3422.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rUX3422.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/4048-29-0x0000000002270000-0x00000000022B6000-memory.dmp family_redline behavioral1/memory/4048-31-0x0000000002640000-0x0000000002684000-memory.dmp family_redline behavioral1/memory/4048-39-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-47-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-95-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-93-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-92-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-89-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-87-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-83-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-81-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-79-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-77-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-75-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-73-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-71-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-69-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-67-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-65-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-61-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-59-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-57-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-55-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-53-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-51-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-49-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-45-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-43-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-41-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-37-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-35-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-85-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-63-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-33-0x0000000002640000-0x000000000267E000-memory.dmp family_redline behavioral1/memory/4048-32-0x0000000002640000-0x000000000267E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
pid Process 2156 viR4563.exe 244 vXa0891.exe 1768 rUX3422.exe 4048 sxQ93Ci.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rUX3422.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" viR4563.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" vXa0891.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language viR4563.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vXa0891.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sxQ93Ci.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1768 rUX3422.exe 1768 rUX3422.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1768 rUX3422.exe Token: SeDebugPrivilege 4048 sxQ93Ci.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4844 wrote to memory of 2156 4844 efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b.exe 83 PID 4844 wrote to memory of 2156 4844 efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b.exe 83 PID 4844 wrote to memory of 2156 4844 efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b.exe 83 PID 2156 wrote to memory of 244 2156 viR4563.exe 84 PID 2156 wrote to memory of 244 2156 viR4563.exe 84 PID 2156 wrote to memory of 244 2156 viR4563.exe 84 PID 244 wrote to memory of 1768 244 vXa0891.exe 86 PID 244 wrote to memory of 1768 244 vXa0891.exe 86 PID 244 wrote to memory of 4048 244 vXa0891.exe 97 PID 244 wrote to memory of 4048 244 vXa0891.exe 97 PID 244 wrote to memory of 4048 244 vXa0891.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b.exe"C:\Users\Admin\AppData\Local\Temp\efadfecc609247dc365b006d0d00f01852aec06a25d775936fcd36f51542e90b.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\viR4563.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\viR4563.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vXa0891.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vXa0891.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rUX3422.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rUX3422.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sxQ93Ci.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sxQ93Ci.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
561KB
MD50fa48ffa5ff597a088058c0f8d18d814
SHA1de825693680a2091ec04d9d4728f55de52740e16
SHA2564d7d9dc981bfd8f5242f5deb0ce73616227259d53f7434f1d382945a99472cb8
SHA51242a153f6cb93fbd53d3654b7ccf0b3a7d2db13cd6086e7931795a92eec9cd1569cbeaf99a61e42b13e0bb42f15c8101f079873ff0a8726560d72342ec488e72c
-
Filesize
416KB
MD5b443d2900c6b416173e69fcf38bbc30a
SHA1703fabf0d50a3d538e800bfb96687bb00e2a06c3
SHA2564f5245e788788a9cd7b0174e03de89b8867067ea9536804f5aa5725af2b49318
SHA512d44bd475ece7202bf621d766aeffea08a039c56a43f51130fad7f38e42b3a26667b9b23d26c3e37a5b0c88590518b7b83da9d2aa68fd981e076179f5780d3ccd
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
346KB
MD52308b8c0bdb8cc5dca5fe768f4ec7108
SHA172b71bbcbf832df3ffa1d56ce055357327528386
SHA2560492aa7e24d7821266b8381a7d89177d74909f0880872f29d5f892a3bbd122ca
SHA512ae3e51cd1d8bc09bcb1f76e2044517abe0b6b4596245ccff84f6a4dd28c35d018055a9bfca695f8b989016406e84527417ecb37242c4e2aa5aa092e49ddac153