Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe
Resource
win10v2004-20241007-en
General
-
Target
43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe
-
Size
713KB
-
MD5
fdd495aa140c9585374c84a70a9699ff
-
SHA1
7dc4d87c575d03672e840bb44893c8489dd4d463
-
SHA256
43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c
-
SHA512
c5b8710c922d3633a4d25fe117034418360df8e71177ba3436a53523c59c9cecc29179e942915e30290aa203c60beb8d649e0b5ee54b7338d24e5235288d06a0
-
SSDEEP
12288:38oWJCJY3DCEhwEiaYJVx4rdv1GV5uREe6TFgpEAMSgQ6nC8DEsLRhjKWYIBoFi:32oYGEhGa6VxUdtGrKEcAFQ6RRlBBoM
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral2/files/0x000a000000023bd3-16.dat healer behavioral2/memory/4056-19-0x0000000000100000-0x000000000010A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr155826.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr155826.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
resource yara_rule behavioral2/memory/640-30-0x00000000070D0000-0x0000000007116000-memory.dmp family_redline behavioral2/memory/640-32-0x0000000007770000-0x00000000077B4000-memory.dmp family_redline behavioral2/memory/640-58-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-94-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-92-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-91-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-88-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-86-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-84-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-80-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-78-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-77-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-74-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-72-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-70-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-66-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-64-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-62-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-60-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-56-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-54-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-52-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-50-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-48-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-46-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-44-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-42-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-40-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-38-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-36-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-82-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-34-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-68-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline behavioral2/memory/640-33-0x0000000007770000-0x00000000077AF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 1876 zinW6705.exe 4056 jr155826.exe 640 ku638698.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr155826.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zinW6705.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku638698.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zinW6705.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4056 jr155826.exe 4056 jr155826.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4056 jr155826.exe Token: SeDebugPrivilege 640 ku638698.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1876 1716 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 86 PID 1716 wrote to memory of 1876 1716 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 86 PID 1716 wrote to memory of 1876 1716 43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe 86 PID 1876 wrote to memory of 4056 1876 zinW6705.exe 87 PID 1876 wrote to memory of 4056 1876 zinW6705.exe 87 PID 1876 wrote to memory of 640 1876 zinW6705.exe 93 PID 1876 wrote to memory of 640 1876 zinW6705.exe 93 PID 1876 wrote to memory of 640 1876 zinW6705.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe"C:\Users\Admin\AppData\Local\Temp\43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
407KB
MD5cabb3463f51c332c467c2ff736fe05bb
SHA1aadc455ffed9978efd77f729064bb0d4b178f595
SHA2564fad65b6cabba38e0ec7b35cd8a81c916f5d73b24e5428a2107e115a1daad86d
SHA512b4146c8234fdfcbf3fdceee02951896dc408f98ffc93a255239e1e6943a1a960c8f29ffaffd70e14fcd4d4c18f64b83603efef8e7615f330082880e6c0aff9d4
-
Filesize
11KB
MD55fa07e8ccf055edf11bd2372900432f0
SHA1ddc5d6fc54d06df47d85955411b5036334f194a0
SHA25681e8f55b18c82e85455874813ef9da8e01a50963ee05cf8a8763c05b146037c6
SHA512353b21e2294e81b3b324e9e2ad7157fbe8ad0ad5e51f2020d1ab080783c20c11ee176240f8a06b37bfc70f694a272981c3fea65729415d7bd0ecd00a7ae272ea
-
Filesize
380KB
MD56e32a72abf890a2c9a13c750398cc48d
SHA10e684f0273666a9129c94c15c7426dcf803928f4
SHA2568e26a07ce5e3e1a02b7f5eb9f6c8ef802ebc58fb8b2d9c2dd03b63cedfb76082
SHA512a52d4cb4d29f9c5d7029c168ca693b9b844525866eb6944ff72274ae6ba83a2657bade67028e15d16abc2e62a0b20f4470db769fa501ad34624790c9cc08aa77