Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe
Resource
win10v2004-20241007-en
General
-
Target
57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe
-
Size
657KB
-
MD5
0ed9b4081c938784d0d47f5a05b2cb1d
-
SHA1
9bc8a9217b2054181a76c62131c462f9bde94c69
-
SHA256
57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850
-
SHA512
3356495c406f7f442bd1c0de248c6704791ad2ade1b11322891ecf5e6dedcc7fd0d8497f1f4240816dce670e17d6aaa0325a36dbdc6f820e69ebc4d3f05357a9
-
SSDEEP
12288:nMr8y90AkRJ0dxt+ZZ1N8aomr+0W9yx9OdAto8nEDG0JHxNcG2bB:3yLkRwxCNlqvUx8dA3EDbvN/c
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4472-18-0x00000000048F0000-0x000000000490A000-memory.dmp healer behavioral1/memory/4472-20-0x0000000007110000-0x0000000007128000-memory.dmp healer behavioral1/memory/4472-22-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-48-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-47-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-45-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-43-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-40-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-38-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-36-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-34-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-32-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-30-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-28-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-26-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-24-0x0000000007110000-0x0000000007122000-memory.dmp healer behavioral1/memory/4472-21-0x0000000007110000-0x0000000007122000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7735.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro7735.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/2084-60-0x0000000004940000-0x0000000004986000-memory.dmp family_redline behavioral1/memory/2084-61-0x0000000004D10000-0x0000000004D54000-memory.dmp family_redline behavioral1/memory/2084-73-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-75-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-95-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-93-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-91-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-89-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-87-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-85-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-83-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-81-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-79-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-77-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-71-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-69-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-67-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-65-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-63-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2084-62-0x0000000004D10000-0x0000000004D4F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 1708 un933947.exe 4472 pro7735.exe 2084 qu2754.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7735.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un933947.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4488 4472 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un933947.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro7735.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu2754.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4472 pro7735.exe 4472 pro7735.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4472 pro7735.exe Token: SeDebugPrivilege 2084 qu2754.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2140 wrote to memory of 1708 2140 57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe 83 PID 2140 wrote to memory of 1708 2140 57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe 83 PID 2140 wrote to memory of 1708 2140 57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe 83 PID 1708 wrote to memory of 4472 1708 un933947.exe 84 PID 1708 wrote to memory of 4472 1708 un933947.exe 84 PID 1708 wrote to memory of 4472 1708 un933947.exe 84 PID 1708 wrote to memory of 2084 1708 un933947.exe 102 PID 1708 wrote to memory of 2084 1708 un933947.exe 102 PID 1708 wrote to memory of 2084 1708 un933947.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe"C:\Users\Admin\AppData\Local\Temp\57234c5897304e9dcc727ac7ffc433319ae1ca7aa8444201b2e08dde0b15f850.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un933947.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un933947.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7735.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7735.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 10964⤵
- Program crash
PID:4488
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2754.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2754.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4472 -ip 44721⤵PID:4120
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
514KB
MD5ccb9bfd38aeb1e89f68d9fbb2abfe42d
SHA1a3e98a07e89306d26f1357b979bc3279464376b0
SHA256f7a153fc1c642aaab51a7dd53f53ea835cb6840a5dd5db9736f8dc429800b32e
SHA512e689c8b09199191696e37d96847a644cd08b49d05a0df9ce364de391a1909e960ef49d791d5c8bb0df091a98dc64bb4fc4088c7311311ab1e8f6c1186a74fe25
-
Filesize
276KB
MD50e7f7401e6a73bcfa58b2287a7b3041b
SHA1535cf8df2ea46a4887c344dfb3a2bcf94efde910
SHA256368693b085819bcd1b56b0ac547f80b8561eba0fbb7589a89d792668939c3925
SHA5123bf2c223e6018cc8d7fa47239d9e0a1fa9e5c764469ae4453c82a7bb354457d6cb947430dd1c46c3f6fa21b1ff9f82dabf67b4bbc6ab8ff35dd576f3199ea437
-
Filesize
334KB
MD5f36705d286f271759ee0f788a0a28505
SHA1fd8a39ad060102ba9322cea9cf8967614c7a2f8a
SHA25603b790a795904e7fff1a781a8c46602be8ec6cc61f5daeed591e167d7d0b6721
SHA512eda4e43405af62fbd6ea7a425d9a2ebd9cb92d28fb096edffa684b17c242c2728b075bd69402dbe7ab0537739c2b7257c3e384e2636d90ff1c161fcadff54773