Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de.exe
Resource
win10v2004-20241007-en
General
-
Target
8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de.exe
-
Size
555KB
-
MD5
38c98fe2dd8941f16f338c5ad4a393b0
-
SHA1
eaef9f30e09cef4a863a1073c6ea58457e3810e8
-
SHA256
8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de
-
SHA512
402970ff120fbe49eb5ad35af7fcd27a834f68f548b45d5994edd08b4ecf9906894913482091c67aea8079a9a4b59dcbf08448471f8de78ede3770d980c48e8b
-
SSDEEP
12288:1MrCy902v5AkHhG7fo5KHT+5847Mic61JKsJmIGoyJQ2hitZTvWhm:7ybHMmKzRic6bSIGj+GMbWhm
Malware Config
Extracted
redline
dubik
193.233.20.17:4139
-
auth_value
05136deb26ad700ca57d43b1de454f46
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023ca5-12.dat healer behavioral1/memory/1896-15-0x00000000004A0000-0x00000000004AA000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rYZ5444.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rYZ5444.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rYZ5444.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rYZ5444.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rYZ5444.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rYZ5444.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000023ca6-19.dat family_redline behavioral1/memory/396-21-0x00000000002C0000-0x00000000002F2000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2360 vGb2377.exe 1896 rYZ5444.exe 396 tEt08YM.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rYZ5444.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vGb2377.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vGb2377.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tEt08YM.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1896 rYZ5444.exe 1896 rYZ5444.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1896 rYZ5444.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5076 wrote to memory of 2360 5076 8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de.exe 84 PID 5076 wrote to memory of 2360 5076 8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de.exe 84 PID 5076 wrote to memory of 2360 5076 8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de.exe 84 PID 2360 wrote to memory of 1896 2360 vGb2377.exe 85 PID 2360 wrote to memory of 1896 2360 vGb2377.exe 85 PID 2360 wrote to memory of 396 2360 vGb2377.exe 93 PID 2360 wrote to memory of 396 2360 vGb2377.exe 93 PID 2360 wrote to memory of 396 2360 vGb2377.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de.exe"C:\Users\Admin\AppData\Local\Temp\8f5aacba4697188eaf8541728f2b5d795769963059df62a65f5aece82d0395de.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vGb2377.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vGb2377.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rYZ5444.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rYZ5444.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tEt08YM.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tEt08YM.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:396
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD59319f1946d75f2c37f126b72b54e5f7a
SHA1fee92b0b33c0a8783bcf98b2bd1fd245667bc21f
SHA2564fc5e0b74a2a4938df3457080802dee72b12723a48ffdc67d58898b89f321884
SHA512eac4b37cb80fd67dae3193d6929f2e5057b13bee46c6d94b0e4b7e9ec907df9d218977b8b9b31b7bef8227b3b405c081a182a08647c62a0ef98c3f4cbb86dc82
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
175KB
MD5cddbd387c5c8bb5e8a8ad341f7d05475
SHA11ae74b1a19a38a736b5321b41de10a48ab72eddc
SHA256c531095f91211aea5e7ed61228c557ea1718605e8840e9ca61e3e652d4634d2d
SHA512ce5ad725decbc063176ef313413112618506ca5863ced90beb5f59ef844d3c0b77bda05be04d1e0337731d2f2eca58f4ad98070d1aa55315879528f9be0f6a0e