Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 19:19
Static task
static1
Behavioral task
behavioral1
Sample
9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a.exe
Resource
win10v2004-20241007-en
General
-
Target
9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a.exe
-
Size
706KB
-
MD5
fa61344de7fed55adebcc19aa55ad4b8
-
SHA1
d144a2d21ee3e6859c78f28f6e3a516fd12306bd
-
SHA256
9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a
-
SHA512
0e1b766c11c4f1ea1085dabeb482bd39fe851f085011df7fae5687354f40e7a2ad1bfc88fcd060f8b34ed46d12c61f19cdb0c687331667b630ba8ee7e3548ea8
-
SSDEEP
12288:sy90aV3VfhKT5l2Yors2vSSu+js35q0kO8MkVx4HTqAs6vdpy/HMGw5KoUqJjuN:synzfYT5as2vfu+jWI7M8xZgpksGw3Ul
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/2548-18-0x0000000004860000-0x000000000487A000-memory.dmp healer behavioral1/memory/2548-20-0x0000000004D00000-0x0000000004D18000-memory.dmp healer behavioral1/memory/2548-21-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-38-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-48-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-46-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-44-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-42-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-40-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-36-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-34-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-32-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-30-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-28-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-26-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-24-0x0000000004D00000-0x0000000004D12000-memory.dmp healer behavioral1/memory/2548-22-0x0000000004D00000-0x0000000004D12000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr341390.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr341390.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr341390.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr341390.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr341390.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr341390.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/2240-60-0x0000000004AC0000-0x0000000004AFC000-memory.dmp family_redline behavioral1/memory/2240-61-0x0000000004D60000-0x0000000004D9A000-memory.dmp family_redline behavioral1/memory/2240-65-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-69-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-67-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-95-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-75-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-93-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-91-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-89-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-87-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-85-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-83-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-81-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-79-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-77-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-73-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-71-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-63-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline behavioral1/memory/2240-62-0x0000000004D60000-0x0000000004D95000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 4456 un704558.exe 2548 pr341390.exe 2240 qu870288.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr341390.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr341390.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un704558.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4888 2548 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un704558.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pr341390.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu870288.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2548 pr341390.exe 2548 pr341390.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2548 pr341390.exe Token: SeDebugPrivilege 2240 qu870288.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1552 wrote to memory of 4456 1552 9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a.exe 83 PID 1552 wrote to memory of 4456 1552 9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a.exe 83 PID 1552 wrote to memory of 4456 1552 9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a.exe 83 PID 4456 wrote to memory of 2548 4456 un704558.exe 84 PID 4456 wrote to memory of 2548 4456 un704558.exe 84 PID 4456 wrote to memory of 2548 4456 un704558.exe 84 PID 4456 wrote to memory of 2240 4456 un704558.exe 99 PID 4456 wrote to memory of 2240 4456 un704558.exe 99 PID 4456 wrote to memory of 2240 4456 un704558.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a.exe"C:\Users\Admin\AppData\Local\Temp\9ba8d71f78facd44fb8ad23828b69ccf53caa7839300be27745337f05bc3605a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un704558.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un704558.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr341390.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr341390.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 10844⤵
- Program crash
PID:4888
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu870288.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu870288.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2548 -ip 25481⤵PID:4760
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
551KB
MD53a2c4652d4ad08b2f4001c67b22cfbf9
SHA17061e5b4e7d8ede2479314801a90f0082cc8569d
SHA256d5e0bd74edda57b4099ea2a8be960d7b2a2fd111ec6e0d38d0323e6e6a5e4e5a
SHA5129c2f60c3c6e960ccdd39d6feab2315a28fdbe5402b4752790f363727c1a16d2c93ea3f7f83cb264144c29d66bc80a7e882cb215af5ff37577e84f2ac28386fab
-
Filesize
285KB
MD5e42920c7f0f9a11aa3233eb7c7c04478
SHA17ab9cb290461ebabf50fe9985291ca96dba57777
SHA256b5fb760d8cdcc740dc78974a3589e91456637420a017b9473ab98ee6157532eb
SHA51203cff930fb7400f86ad3bcbe0e7d4249dc410ac84cd71c70427ccb59c893258a7d3ad48909a74dd144fbb1929483abcf3eefbeaa7de6a41f765141a8103d42d6
-
Filesize
367KB
MD5802b90b55e58cd52db474937d87eb1c4
SHA1da043802bfb6f5a7f35eda8b5834827bf5935c6c
SHA256c18b8db215149cca48a98fc1ec693fce78ddd0c100fb613346f4e694a752d7f8
SHA512aa6af0d2ed187fc2c94d16e0621528ef7eaa0374a1b8748799d7a97b1de14e188b9a277bbb2211f9036ef8991b25c209d7d8288427c350e6512ecace49a2014b