Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 19:05
Static task
static1
Behavioral task
behavioral1
Sample
c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269.exe
Resource
win10v2004-20241007-en
General
-
Target
c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269.exe
-
Size
531KB
-
MD5
d96b538a2ad1cdd9de02d441c6f922f6
-
SHA1
e683306e3119377a0dc09da6be956beee6ad6d1b
-
SHA256
c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269
-
SHA512
63d4ce561fa051a0d3fa0f1ba77296a34361dc7b484e567ff3f94bf318f1946d7be6ffdd23aee4186efcc741b963a096838bc5b51263695dd093a71c33888405
-
SSDEEP
12288:CMrSy90cKIquLl70O/Qvx96MBpVVCRTX2Q5V:MyVKI3FpodVVCRq0
Malware Config
Extracted
redline
rumfa
193.233.20.24:4123
-
auth_value
749d02a6b4ef1fa2ad908e44ec2296dc
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b93-12.dat healer behavioral1/memory/2076-15-0x0000000000840000-0x000000000084A000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sw05HG42YU25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sw05HG42YU25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sw05HG42YU25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sw05HG42YU25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sw05HG42YU25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sw05HG42YU25.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/1520-22-0x0000000004C90000-0x0000000004CD6000-memory.dmp family_redline behavioral1/memory/1520-24-0x0000000004D10000-0x0000000004D54000-memory.dmp family_redline behavioral1/memory/1520-28-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-26-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-25-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-86-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-74-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-66-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-44-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-30-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-88-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-84-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-83-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-80-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-78-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-76-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-72-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-70-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-68-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-64-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-62-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-60-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-58-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-56-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-54-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-52-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-50-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-48-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-46-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-42-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-40-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-38-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-36-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-34-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline behavioral1/memory/1520-32-0x0000000004D10000-0x0000000004D4E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 4816 vbZ9411qt.exe 2076 sw05HG42YU25.exe 1520 tvo02lI55.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sw05HG42YU25.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vbZ9411qt.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbZ9411qt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvo02lI55.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2076 sw05HG42YU25.exe 2076 sw05HG42YU25.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2076 sw05HG42YU25.exe Token: SeDebugPrivilege 1520 tvo02lI55.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1260 wrote to memory of 4816 1260 c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269.exe 83 PID 1260 wrote to memory of 4816 1260 c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269.exe 83 PID 1260 wrote to memory of 4816 1260 c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269.exe 83 PID 4816 wrote to memory of 2076 4816 vbZ9411qt.exe 84 PID 4816 wrote to memory of 2076 4816 vbZ9411qt.exe 84 PID 4816 wrote to memory of 1520 4816 vbZ9411qt.exe 95 PID 4816 wrote to memory of 1520 4816 vbZ9411qt.exe 95 PID 4816 wrote to memory of 1520 4816 vbZ9411qt.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269.exe"C:\Users\Admin\AppData\Local\Temp\c0761060133e52902705ca31af55127fa72a1f924509893ffbf4cd1823b2e269.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vbZ9411qt.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vbZ9411qt.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw05HG42YU25.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw05HG42YU25.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tvo02lI55.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tvo02lI55.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
387KB
MD5d6785f608ea8aece3184c1c596eb73d2
SHA104f6e45fe1db90f0731b58a08965c1a1789bca01
SHA2560f1df7abef6555bbe8e90c63c5223987228b0aeea6a569782e89a6186d75e372
SHA51229ef48937617e22c560f5971d73479a0e4ed2c65b26e068ae1444dc570dc402b057da32b6d5fd2f953982fa0e96183934cb47b86265dda64386bbadd3cb892a8
-
Filesize
11KB
MD50473840d8e6e3863d9d683977e421cc1
SHA13d1624d2f59e5714109c766750d0969601b26b4b
SHA256973059496ccdd8081095f7ce30715f28124ad5dde9afca7bdf43f5b483696928
SHA512f7d69fbd9e88d4d6ce324c2b639611237ca9b732d55da6305baae8beaeb9678fe7072cb60ce67758db1f581cf63134b390a3052bf13f5b717afd867e037cd1cc
-
Filesize
303KB
MD5a1f3354a99b35edf172a95b90afbc9b1
SHA18b02f77b82ec8b005aacb5bd87f50f6ceee0052f
SHA2562565aca55567f1c548f5135c387bdc75999836cb072d0896c040947bef8e852a
SHA512f189af079f9f9de1861b03a2e15c9dac741929cdb115937973270e9ffbf65e64b2a19ebc277f1f9aa10a42e4f83abed0a5c9bb4bfc86c66102c09575771ef40e