Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 06:05
Static task
static1
Behavioral task
behavioral1
Sample
aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758.exe
Resource
win10v2004-20241007-en
General
-
Target
aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758.exe
-
Size
691KB
-
MD5
f8f8e6ebb483e67a4bbbf87b7742732a
-
SHA1
0033930a5fe0f95c6819dfd865dd48ae57339613
-
SHA256
aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758
-
SHA512
8a10ed073fdd2a3c307fd1d1af973859f37a4e03f5ca42721aecc7033b344516655157d1c29ebd0865723be5b2b7c5c508e7a3ef8e23c0604241b66f77e6f9f0
-
SSDEEP
12288:Gy90C5W9bltXrkm1KczV+e0VZUgs1RIPOMsBuGD4HSBOs6a:Gyx5W9blJrkm1KcKVugYBuGkHSBl6a
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4840-19-0x0000000002240000-0x000000000225A000-memory.dmp healer behavioral1/memory/4840-21-0x0000000002340000-0x0000000002358000-memory.dmp healer behavioral1/memory/4840-49-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-48-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-45-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-43-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-41-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-39-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-37-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-35-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-33-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-31-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-29-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-27-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-25-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-23-0x0000000002340000-0x0000000002353000-memory.dmp healer behavioral1/memory/4840-22-0x0000000002340000-0x0000000002353000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 82226276.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 82226276.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 82226276.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 82226276.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 82226276.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 82226276.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/3332-61-0x00000000023A0000-0x00000000023DC000-memory.dmp family_redline behavioral1/memory/3332-62-0x0000000002540000-0x000000000257A000-memory.dmp family_redline behavioral1/memory/3332-80-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-90-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-96-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-94-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-88-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-86-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-84-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-82-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-78-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-76-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-74-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-72-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-92-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-70-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-68-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-66-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-64-0x0000000002540000-0x0000000002575000-memory.dmp family_redline behavioral1/memory/3332-63-0x0000000002540000-0x0000000002575000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 436 un950229.exe 4840 82226276.exe 3332 rk760601.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 82226276.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 82226276.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un950229.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2428 4840 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un950229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82226276.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rk760601.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4840 82226276.exe 4840 82226276.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4840 82226276.exe Token: SeDebugPrivilege 3332 rk760601.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4524 wrote to memory of 436 4524 aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758.exe 83 PID 4524 wrote to memory of 436 4524 aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758.exe 83 PID 4524 wrote to memory of 436 4524 aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758.exe 83 PID 436 wrote to memory of 4840 436 un950229.exe 84 PID 436 wrote to memory of 4840 436 un950229.exe 84 PID 436 wrote to memory of 4840 436 un950229.exe 84 PID 436 wrote to memory of 3332 436 un950229.exe 96 PID 436 wrote to memory of 3332 436 un950229.exe 96 PID 436 wrote to memory of 3332 436 un950229.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758.exe"C:\Users\Admin\AppData\Local\Temp\aa287e63e7801f3cfe162fcf59cb82d5ac0a605271e5bcc54397a2b642f5a758.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un950229.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un950229.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\82226276.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\82226276.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 10804⤵
- Program crash
PID:2428
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk760601.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk760601.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4840 -ip 48401⤵PID:2632
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD5ec84a790654d7159bcd7813e253a9ed4
SHA148602aa90aa7e7a9dbd1b2ad7f0b721a6a741b6f
SHA256763f00f2d9afabd7abfa11e7efd41348f8df6819b5b834776aee1a7e6b59360f
SHA512c5ffe66a2ff800b71c985d225bc1d0db520fa637bd9f9debcc8c3911585d1014f5cf3f5e49a4812fe0735960622d5e0799369054a5df01212f73d5902a6758da
-
Filesize
258KB
MD54d7255394a1cda555b3d0b2528f8b739
SHA1242ded6e2781b49f347f562803f05c05d491b5c2
SHA2567147f78aae7a946e8f1b9b3b80b18a83361e87e21b77af29653441efbb3aa607
SHA512adbb0a0ee53bbcb3fc1c4a19a2f9eb5ee6f1f3acd41718c3ef48838240ca92b8fc34162007ab2bdf2413c26e1debe6a3a37ab799a9f56d381809167525d623d4
-
Filesize
342KB
MD574a4f67d35ae518c3373cbf2ba430e29
SHA153614d6bf63e6c8b20b74552f4b4d4b4afbc0e6f
SHA25605c677219aedb7390097654aa74101c73dbd40cc7e0de80684c55eae6f5f2fa0
SHA51272ddc7627fa573ed6ffcd2b68ee9b19c04110fcba4a7f46b94a23391f350673bfe0cbd05ce8f7fe8ffd3005163ec324e8ab4059a76e8622bc64861f747895916