Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe
Resource
win10v2004-20241007-en
General
-
Target
43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe
-
Size
713KB
-
MD5
fdd495aa140c9585374c84a70a9699ff
-
SHA1
7dc4d87c575d03672e840bb44893c8489dd4d463
-
SHA256
43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c
-
SHA512
c5b8710c922d3633a4d25fe117034418360df8e71177ba3436a53523c59c9cecc29179e942915e30290aa203c60beb8d649e0b5ee54b7338d24e5235288d06a0
-
SSDEEP
12288:38oWJCJY3DCEhwEiaYJVx4rdv1GV5uREe6TFgpEAMSgQ6nC8DEsLRhjKWYIBoFi:32oYGEhGa6VxUdtGrKEcAFQ6RRlBBoM
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x00070000000186dd-18.dat healer behavioral1/memory/2740-22-0x0000000000130000-0x000000000013A000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr155826.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
resource yara_rule behavioral1/memory/2752-36-0x0000000004D30000-0x0000000004D76000-memory.dmp family_redline behavioral1/memory/2752-37-0x0000000004D70000-0x0000000004DB4000-memory.dmp family_redline behavioral1/memory/2752-57-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-55-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-53-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-51-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-49-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-47-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-45-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-99-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-97-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-95-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-94-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-91-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-89-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-87-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-85-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-83-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-81-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-79-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-77-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-75-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-73-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-71-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-69-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-67-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-65-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-63-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-61-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-43-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-41-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-39-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-38-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline behavioral1/memory/2752-59-0x0000000004D70000-0x0000000004DAF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2952 zinW6705.exe 2740 jr155826.exe 2752 ku638698.exe -
Loads dropped DLL 6 IoCs
pid Process 376 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 2952 zinW6705.exe 2952 zinW6705.exe 2952 zinW6705.exe 2952 zinW6705.exe 2752 ku638698.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr155826.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zinW6705.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zinW6705.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku638698.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2740 jr155826.exe 2740 jr155826.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2740 jr155826.exe Token: SeDebugPrivilege 2752 ku638698.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 376 wrote to memory of 2952 376 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 30 PID 376 wrote to memory of 2952 376 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 30 PID 376 wrote to memory of 2952 376 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 30 PID 376 wrote to memory of 2952 376 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 30 PID 376 wrote to memory of 2952 376 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 30 PID 376 wrote to memory of 2952 376 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 30 PID 376 wrote to memory of 2952 376 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 30 PID 2952 wrote to memory of 2740 2952 zinW6705.exe 31 PID 2952 wrote to memory of 2740 2952 zinW6705.exe 31 PID 2952 wrote to memory of 2740 2952 zinW6705.exe 31 PID 2952 wrote to memory of 2740 2952 zinW6705.exe 31 PID 2952 wrote to memory of 2740 2952 zinW6705.exe 31 PID 2952 wrote to memory of 2740 2952 zinW6705.exe 31 PID 2952 wrote to memory of 2740 2952 zinW6705.exe 31 PID 2952 wrote to memory of 2752 2952 zinW6705.exe 32 PID 2952 wrote to memory of 2752 2952 zinW6705.exe 32 PID 2952 wrote to memory of 2752 2952 zinW6705.exe 32 PID 2952 wrote to memory of 2752 2952 zinW6705.exe 32 PID 2952 wrote to memory of 2752 2952 zinW6705.exe 32 PID 2952 wrote to memory of 2752 2952 zinW6705.exe 32 PID 2952 wrote to memory of 2752 2952 zinW6705.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe"C:\Users\Admin\AppData\Local\Temp\43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
407KB
MD5cabb3463f51c332c467c2ff736fe05bb
SHA1aadc455ffed9978efd77f729064bb0d4b178f595
SHA2564fad65b6cabba38e0ec7b35cd8a81c916f5d73b24e5428a2107e115a1daad86d
SHA512b4146c8234fdfcbf3fdceee02951896dc408f98ffc93a255239e1e6943a1a960c8f29ffaffd70e14fcd4d4c18f64b83603efef8e7615f330082880e6c0aff9d4
-
Filesize
11KB
MD55fa07e8ccf055edf11bd2372900432f0
SHA1ddc5d6fc54d06df47d85955411b5036334f194a0
SHA25681e8f55b18c82e85455874813ef9da8e01a50963ee05cf8a8763c05b146037c6
SHA512353b21e2294e81b3b324e9e2ad7157fbe8ad0ad5e51f2020d1ab080783c20c11ee176240f8a06b37bfc70f694a272981c3fea65729415d7bd0ecd00a7ae272ea
-
Filesize
380KB
MD56e32a72abf890a2c9a13c750398cc48d
SHA10e684f0273666a9129c94c15c7426dcf803928f4
SHA2568e26a07ce5e3e1a02b7f5eb9f6c8ef802ebc58fb8b2d9c2dd03b63cedfb76082
SHA512a52d4cb4d29f9c5d7029c168ca693b9b844525866eb6944ff72274ae6ba83a2657bade67028e15d16abc2e62a0b20f4470db769fa501ad34624790c9cc08aa77