Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe
Resource
win10v2004-20241007-en
General
-
Target
5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe
-
Size
794KB
-
MD5
81635c898357209253f926db766e5952
-
SHA1
da672c33da3120be9e702b2a8569617a11b771a2
-
SHA256
5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3
-
SHA512
07a978ec5e850f00dc85405c6daa26b0e3986a4a13392266709e462ef3373c78eedcbd162630527fab382077cdeb47cb91a48adbbfa1ba495e901481a61dd584
-
SSDEEP
24576:oyM5A0pUXYJeUwMkaqAwdPL+IoUQgUe7:vMy+XJeUYPdHQ9e
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
diza
77.91.124.145:4125
-
auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/3068-19-0x0000000002360000-0x000000000237A000-memory.dmp healer behavioral1/memory/3068-21-0x0000000004A40000-0x0000000004A58000-memory.dmp healer behavioral1/memory/3068-49-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-47-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-45-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-43-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-41-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-39-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-38-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-35-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-33-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-31-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-29-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-27-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-25-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-23-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/3068-22-0x0000000004A40000-0x0000000004A52000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0545.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/744-2142-0x0000000005400000-0x0000000005432000-memory.dmp family_redline behavioral1/files/0x0011000000023b69-2146.dat family_redline behavioral1/memory/2300-2155-0x0000000000D80000-0x0000000000DB0000-memory.dmp family_redline behavioral1/files/0x0007000000023c9d-2164.dat family_redline behavioral1/memory/5380-2166-0x0000000000B30000-0x0000000000B5E000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation qu9839.exe -
Executes dropped EXE 5 IoCs
pid Process 4988 un014368.exe 3068 pro0545.exe 744 qu9839.exe 2300 1.exe 5380 si872192.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0545.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0545.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un014368.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2328 3068 WerFault.exe 84 5244 744 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu9839.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language si872192.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un014368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro0545.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3068 pro0545.exe 3068 pro0545.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3068 pro0545.exe Token: SeDebugPrivilege 744 qu9839.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2008 wrote to memory of 4988 2008 5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe 83 PID 2008 wrote to memory of 4988 2008 5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe 83 PID 2008 wrote to memory of 4988 2008 5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe 83 PID 4988 wrote to memory of 3068 4988 un014368.exe 84 PID 4988 wrote to memory of 3068 4988 un014368.exe 84 PID 4988 wrote to memory of 3068 4988 un014368.exe 84 PID 4988 wrote to memory of 744 4988 un014368.exe 96 PID 4988 wrote to memory of 744 4988 un014368.exe 96 PID 4988 wrote to memory of 744 4988 un014368.exe 96 PID 744 wrote to memory of 2300 744 qu9839.exe 97 PID 744 wrote to memory of 2300 744 qu9839.exe 97 PID 744 wrote to memory of 2300 744 qu9839.exe 97 PID 2008 wrote to memory of 5380 2008 5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe 100 PID 2008 wrote to memory of 5380 2008 5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe 100 PID 2008 wrote to memory of 5380 2008 5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe"C:\Users\Admin\AppData\Local\Temp\5ca0cd511e408a071972d134c15e650d7c96e3574ac05b282493efa40b6a95e3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un014368.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un014368.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0545.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0545.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 10644⤵
- Program crash
PID:2328
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9839.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9839.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 13804⤵
- Program crash
PID:5244
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si872192.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si872192.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3068 -ip 30681⤵PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 744 -ip 7441⤵PID:5160
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD51779849e50c857605f4f3c7da771f563
SHA1f2200d647f0b451366dcaceba994a9592e9cdbd9
SHA256bf9b2f74e3eb0c5772901b0d11ae520a355cdd56f9d675bf00f408ed436bfc16
SHA51201ec0d9945be7a7e6b048329dcb863df9bcbb33143cc12c372b9fd9f18eab3675114b77b1352e5a663189689330c5e2fc6138255374ad4793f32000a3682e43f
-
Filesize
641KB
MD5dcb3ff36592e8ca3be9ebb7c17375a19
SHA1e83619d387e78316c3b40972a02916fbd6ff6631
SHA2563ceae599118641e6e967a8f90bec1f9067321ffd431193e5bf9e195dbb426578
SHA51260b393fb06280a70e61b2739a853d53bfe3cd69ae6d47b5bcb94511855ac5f0a9215420db58775e06d0cbbf534d7e9750545f5fc7ed2d937514059fe943a90a2
-
Filesize
241KB
MD5e3171514dec989f0dcd261a9c9d63faf
SHA1848373beb17df6ddc6ab9ce65800038e96dd4a84
SHA2561d7cdd0ac0274e6c558446602ff6170b8a60793c774c53168d163cb7b1496a39
SHA51259b0700acb8a8b8b2cd7be46daa2986b1a0d031ec8738757e5ccee41b1e1a98f718848e8a257fae83ba46538bf7d55d62e5184eb6e182edc35abd5616f4c27a6
-
Filesize
424KB
MD5c6301333ecc83e4213ea075d85498418
SHA1205fc1a1eb505bcc47f6dc6f01dde47d8978ac8b
SHA256d7cadee8d3a219e974bf24300d35058846c69f70bca2e0bfe1b4a12e22c70762
SHA512eb4b278a1fa33b15a06eda1e24293ed62c4fb28bdca58190953d90f958cbabedce1f814fa08a7bba1409ac722ac3db6a1e76b4b16c802d7e373c87961f7c5351
-
Filesize
168KB
MD51073b2e7f778788852d3f7bb79929882
SHA17f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA51290cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0