Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe
Resource
win10v2004-20241007-en
General
-
Target
681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe
-
Size
787KB
-
MD5
d4234be88660b5c6acb53b22f070caa1
-
SHA1
4cf464bab92c9c4324645dc571537a3f94b8da0b
-
SHA256
681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a
-
SHA512
5dc9a92c5acd2d2c689a756c1e7e88f7adb4aef37e4d920f8e00fcc6a272fe82dc4ea9657306bb8d127be5ff53aa59840e7b4ea4d8cc4297325f5a3363c2bd54
-
SSDEEP
12288:6MrIy90RIN78tEmh1N9XyoYtJRMRVDciPEpnU3k61jdgokXrjOV:2yN8t/lXQtJiHPEhU3kelk7ju
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
diza
77.91.124.145:4125
-
auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/1908-19-0x0000000002080000-0x000000000209A000-memory.dmp healer behavioral1/memory/1908-21-0x00000000024A0000-0x00000000024B8000-memory.dmp healer behavioral1/memory/1908-27-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-49-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-47-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-45-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-43-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-41-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-39-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-37-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-35-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-33-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-31-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-29-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-25-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-23-0x00000000024A0000-0x00000000024B2000-memory.dmp healer behavioral1/memory/1908-22-0x00000000024A0000-0x00000000024B2000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2250.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2250.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2716-2143-0x0000000005410000-0x0000000005442000-memory.dmp family_redline behavioral1/files/0x000b000000023c8b-2148.dat family_redline behavioral1/memory/1220-2156-0x0000000000530000-0x0000000000560000-memory.dmp family_redline behavioral1/files/0x0007000000023c86-2166.dat family_redline behavioral1/memory/5860-2167-0x0000000000830000-0x000000000085E000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation qu6228.exe -
Executes dropped EXE 5 IoCs
pid Process 2376 un387081.exe 1908 pro2250.exe 2716 qu6228.exe 1220 1.exe 5860 si911341.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2250.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un387081.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4688 1908 WerFault.exe 84 5804 2716 WerFault.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un387081.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro2250.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu6228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language si911341.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1908 pro2250.exe 1908 pro2250.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1908 pro2250.exe Token: SeDebugPrivilege 2716 qu6228.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2376 2844 681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe 83 PID 2844 wrote to memory of 2376 2844 681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe 83 PID 2844 wrote to memory of 2376 2844 681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe 83 PID 2376 wrote to memory of 1908 2376 un387081.exe 84 PID 2376 wrote to memory of 1908 2376 un387081.exe 84 PID 2376 wrote to memory of 1908 2376 un387081.exe 84 PID 2376 wrote to memory of 2716 2376 un387081.exe 99 PID 2376 wrote to memory of 2716 2376 un387081.exe 99 PID 2376 wrote to memory of 2716 2376 un387081.exe 99 PID 2716 wrote to memory of 1220 2716 qu6228.exe 100 PID 2716 wrote to memory of 1220 2716 qu6228.exe 100 PID 2716 wrote to memory of 1220 2716 qu6228.exe 100 PID 2844 wrote to memory of 5860 2844 681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe 103 PID 2844 wrote to memory of 5860 2844 681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe 103 PID 2844 wrote to memory of 5860 2844 681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe"C:\Users\Admin\AppData\Local\Temp\681bdddbc813707f27535eeb58c3bbed7c25ebcb4dc3466064d4d8f155239a8a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387081.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un387081.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2250.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2250.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 10804⤵
- Program crash
PID:4688
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6228.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6228.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 13844⤵
- Program crash
PID:5804
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si911341.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si911341.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1908 -ip 19081⤵PID:976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2716 -ip 27161⤵PID:5684
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5d0e4a53a3b8ebf080b1ec8f4296b61ac
SHA126bd78f013cdd1ad4b890e3b4247606152cc84c3
SHA256f21c5547e251fd012a2d5879d61253a84c33d74bac3d2ccfb2c48920f72d4532
SHA5129f6e0d44a26df770bc7bee39dfbb59b7bb567b90a41ee742abf69ee5fd6918245bed9a053f5c8e2adfe4dee706a683c2321901a044519fa626ae5aac9dcf6902
-
Filesize
633KB
MD5a83390771661b778c5264ddff063612f
SHA1e44033bc16beab8c7ea85bf74b3d1b13de2c19ef
SHA25676ed9156c8834ceb8021ae2e13deb5fc837c51ce033c9d8e79770715e5bbc592
SHA512712ca828ec3f3ed2e6a91c2470f61cd1747da7d2e8aa82525473fb5b06e98f87634d76d77295b3a1ad4bf73cb6de793de1a9aff1891a134bb0bac6550b0658b7
-
Filesize
230KB
MD51f353e917212ab5817881bb30467d069
SHA102bb0a1a712d7e4a51153e9de30a5213ba29c479
SHA256164bfbc72b0d102c62c7968bd3dae8e76c09175b42165a2a2d8edcde5b2b03d1
SHA512d6be32a19dab45b25b64e6d0a151e19d3eeea59bbf23b2d6a7cf82495cad286681672603e5a882f10ba19f287b6dd20f8f3025e19b212d9297490f2219be3eb3
-
Filesize
414KB
MD516f6534102f9362240780ba38edf0506
SHA1478165acf371d34e2e8fd29bbac99678eb40bdd7
SHA2567db3ecfabc6a6ddb45ea6af69fdcfb19ac3552a5fd30295e7e08e600ce581519
SHA51248720278dfa1f8f6e94517f41f649ae00989eecc7ded60a8c84e04e1cd621d6ae5de605fb8b32fbc889ceeb149062bc1b9716ab1bc96fa56f7e5a934eb674cd1
-
Filesize
168KB
MD51073b2e7f778788852d3f7bb79929882
SHA17f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA51290cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0