Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f.exe
Resource
win10v2004-20241007-en
General
-
Target
f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f.exe
-
Size
562KB
-
MD5
d6f47dc7945480708da2fdf5154c1ad6
-
SHA1
68e6f8108e88dd874dc8862da1146a8ddbae2ff3
-
SHA256
f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f
-
SHA512
77cf8f611e83a07778b9a8f7354d3e4b05870cdd7a246bc7f850540cb04083263e95d29e01d7a1e96fcc942f21c1e2f2276dd5bfa6e8581624afdead7412d8fb
-
SSDEEP
12288:gMMrTy907DgHvNfWYK0xssmQH1aBVl11B:g/yODgHvNfWYK0BXs3
Malware Config
Extracted
redline
fud
193.233.20.27:4123
-
auth_value
cddc991efd6918ad5321d80dac884b40
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b70-12.dat healer behavioral1/memory/1964-15-0x0000000000BA0000-0x0000000000BAA000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sf99NN53lt71.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sf99NN53lt71.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sf99NN53lt71.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sf99NN53lt71.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sf99NN53lt71.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sf99NN53lt71.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/4764-22-0x0000000004E00000-0x0000000004E46000-memory.dmp family_redline behavioral1/memory/4764-24-0x0000000004EA0000-0x0000000004EE4000-memory.dmp family_redline behavioral1/memory/4764-60-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-72-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-88-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-84-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-82-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-80-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-79-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-76-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-74-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-70-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-68-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-66-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-64-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-62-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-58-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-56-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-54-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-52-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-50-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-48-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-46-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-44-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-42-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-40-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-38-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-36-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-34-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-30-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-28-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-86-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-33-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-26-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline behavioral1/memory/4764-25-0x0000000004EA0000-0x0000000004EDE000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 4048 vhcH1541bE.exe 1964 sf99NN53lt71.exe 4764 tf91AS06fC07.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sf99NN53lt71.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vhcH1541bE.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhcH1541bE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tf91AS06fC07.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1964 sf99NN53lt71.exe 1964 sf99NN53lt71.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1964 sf99NN53lt71.exe Token: SeDebugPrivilege 4764 tf91AS06fC07.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4048 4864 f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f.exe 84 PID 4864 wrote to memory of 4048 4864 f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f.exe 84 PID 4864 wrote to memory of 4048 4864 f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f.exe 84 PID 4048 wrote to memory of 1964 4048 vhcH1541bE.exe 85 PID 4048 wrote to memory of 1964 4048 vhcH1541bE.exe 85 PID 4048 wrote to memory of 4764 4048 vhcH1541bE.exe 94 PID 4048 wrote to memory of 4764 4048 vhcH1541bE.exe 94 PID 4048 wrote to memory of 4764 4048 vhcH1541bE.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f.exe"C:\Users\Admin\AppData\Local\Temp\f87af8872677c19bddc88ce0752b966ab156c47c5b4d27857cdfc04a83b5fa7f.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhcH1541bE.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhcH1541bE.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf99NN53lt71.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf99NN53lt71.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf91AS06fC07.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf91AS06fC07.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418KB
MD5f362a1ed867348958147cbec7eeeb34e
SHA117424fdf44ee5686525e524c554badb30fdf840e
SHA256f2246f32bc8a624742960611c575b30b052dff88dd64154044a0d06d3c7e4220
SHA512ccf1091263d8333bfbb39d3ad9f6896e61ffd26e92da087afbfd28fd92e3fcb4ea17d079a4fab3f14cde93ff070d04880db5892d2a4bc9c4e6f3eb694c42402d
-
Filesize
11KB
MD5b3eadfd0505b56780c46daf46b45f578
SHA192a72ec1cf2c625b044253a1c170f60193b4d278
SHA256bd3650916b9505b9b1c86e14d73b6f55fec7741636ad520ac13ad9ceb0db1d33
SHA5122d4840723a7c264b27b768e767aa79ee22c6b7a7a7a7fefe7cfe73a71288fdb73f479c3382434b60b23bd76a640feca224451290dd43527bddc7ee8e5472711d
-
Filesize
420KB
MD526c4ff23e7d77f037b4cf034354d85b2
SHA1c6596b283bc440832c9baf35453ebc4d9fb70115
SHA25661a27dc04dc6709f1cd05c3b9bd7bae777e915f524decb5948c8cb8f26ff2b19
SHA512c2befc78aa793989b2838803971cd9675a35c1c657a127a69f4bbbd852b77f79df2d733b934d1411b07fe7f01f75359749382be7e8b0c6c9d2b582a5423fc1f9