Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 05:18
Static task
static1
Behavioral task
behavioral1
Sample
39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f.exe
Resource
win10v2004-20241007-en
General
-
Target
39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f.exe
-
Size
555KB
-
MD5
9ec68aa37916e06d6a5e3f640ac56341
-
SHA1
03a000717aae84720ce9954eaf29a97c10962e62
-
SHA256
39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f
-
SHA512
c8289f368ba95a4f537392156dc73928d53dd9cef9c114f58c3d440f93b18545f6b8aa030382468f8b38df20ca37228721cce35929e5154bf92a32a9a12f24e6
-
SSDEEP
12288:GMrTy90QVaKyVDFU+9QwCzy5ddcwaH7GcXeHDmqW00DU:tyPV6VG+9Qwe+k72j/W0aU
Malware Config
Extracted
redline
ruzhpe
pepunn.com:4162
-
auth_value
f735ced96ae8d01d0bd1d514240e54e0
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b96-12.dat healer behavioral1/memory/3160-15-0x0000000000050000-0x000000000005A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sw35BL83Lw48.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sw35BL83Lw48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sw35BL83Lw48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sw35BL83Lw48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sw35BL83Lw48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sw35BL83Lw48.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/4148-22-0x0000000004910000-0x0000000004956000-memory.dmp family_redline behavioral1/memory/4148-24-0x0000000004D90000-0x0000000004DD4000-memory.dmp family_redline behavioral1/memory/4148-38-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-88-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-86-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-84-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-82-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-80-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-78-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-76-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-74-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-72-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-70-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-68-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-66-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-64-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-62-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-60-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-58-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-56-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-54-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-52-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-50-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-48-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-46-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-44-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-42-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-40-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-36-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-34-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-32-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-30-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-28-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-26-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline behavioral1/memory/4148-25-0x0000000004D90000-0x0000000004DCE000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 1368 vksJ8759nL.exe 3160 sw35BL83Lw48.exe 4148 tkEX66pG09Fz.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sw35BL83Lw48.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vksJ8759nL.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tkEX66pG09Fz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vksJ8759nL.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3160 sw35BL83Lw48.exe 3160 sw35BL83Lw48.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3160 sw35BL83Lw48.exe Token: SeDebugPrivilege 4148 tkEX66pG09Fz.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3316 wrote to memory of 1368 3316 39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f.exe 83 PID 3316 wrote to memory of 1368 3316 39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f.exe 83 PID 3316 wrote to memory of 1368 3316 39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f.exe 83 PID 1368 wrote to memory of 3160 1368 vksJ8759nL.exe 85 PID 1368 wrote to memory of 3160 1368 vksJ8759nL.exe 85 PID 1368 wrote to memory of 4148 1368 vksJ8759nL.exe 92 PID 1368 wrote to memory of 4148 1368 vksJ8759nL.exe 92 PID 1368 wrote to memory of 4148 1368 vksJ8759nL.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f.exe"C:\Users\Admin\AppData\Local\Temp\39da8093e2fe705edaebed4a88337c7772b993ba9a1d605facf112309e58f54f.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vksJ8759nL.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vksJ8759nL.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw35BL83Lw48.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw35BL83Lw48.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkEX66pG09Fz.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkEX66pG09Fz.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
411KB
MD5b613a44fe3110db50bd7006dbf785a10
SHA17f6f853ecea4a40305389e3b901c48665a65be0e
SHA2564f4734f2e85e0fd2e0896c97a379fe20c06dcd08e2db15b89b2ed82ebd0c8294
SHA512f003700c780a040f350e30653754a4725ff155fecc8f1b31222e3450c6e0138cf3b69bd06c8353d264a7566f400fafeee7cbeec7b98cd5360cbbb362429a72b9
-
Filesize
17KB
MD51d66902683bc3c462d751d2f92fc8db4
SHA199c2113bb5e4f2ea1e67c8cffd0559031168e30d
SHA2564de7b107b7c204bbc427342e0429eb00fa979ee0953348c760dec84714821473
SHA5123eda76452090da5803e821d75773bb17ba488a90bc80d6d785ca21a4b1d0cad96709c5bd8839191865b73fd59757e76a1fae360f91fab7e7feb0e9ae056547bb
-
Filesize
409KB
MD567530ca401a21e9021983dd91b37c971
SHA1059cc53f7d897b6e0b9072274cb964ab547489a9
SHA2563b8cd7237a32fdb861ebd4c8243729f969a0355e4554832f73d8ab0ee3871b9a
SHA5120b8f93e0d38b8bf6fab4adb7c1ecd05da3c354acd94e9f02c48ef8f822be328d6e2c558806e732a840178ec2d0c32daf718f372a6040403353565196ce231b78