Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 19:12
Static task
static1
Behavioral task
behavioral1
Sample
988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe
Resource
win10v2004-20241007-en
General
-
Target
988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe
-
Size
787KB
-
MD5
cb30ffa7d995cae4d55d5523e03502fa
-
SHA1
0f3e146dc9d3a9ad86953bdba11b03df4e6bc395
-
SHA256
988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3
-
SHA512
f824daf7aa0c21de8e604ee512528ec84c16cb73af69a9ff0f827ee52d34687e888094d85a7e25e122fd1442e6620d17fb27cb14c69f280150ca04c35a29fe0c
-
SSDEEP
12288:hMriy90CVU9QN6UiyoYAJA0V9cid32ar3tm1HS8XuqZZ4V3zmBViN:zyvu9QN6DQAJtpd3jr3ti/uym3z0q
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
diza
77.91.124.145:4125
-
auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4820-19-0x0000000002220000-0x000000000223A000-memory.dmp healer behavioral1/memory/4820-21-0x0000000004A60000-0x0000000004A78000-memory.dmp healer behavioral1/memory/4820-49-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-47-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-45-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-43-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-41-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-39-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-37-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-22-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-35-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-33-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-31-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-29-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-27-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-25-0x0000000004A60000-0x0000000004A72000-memory.dmp healer behavioral1/memory/4820-23-0x0000000004A60000-0x0000000004A72000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro2480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2480.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/3420-2143-0x0000000005400000-0x0000000005432000-memory.dmp family_redline behavioral1/files/0x0013000000023ad1-2148.dat family_redline behavioral1/memory/5336-2156-0x0000000000470000-0x00000000004A0000-memory.dmp family_redline behavioral1/files/0x000a000000023b88-2166.dat family_redline behavioral1/memory/5648-2167-0x0000000000EA0000-0x0000000000ECE000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation qu5782.exe -
Executes dropped EXE 5 IoCs
pid Process 2472 un634852.exe 4820 pro2480.exe 3420 qu5782.exe 5336 1.exe 5648 si158664.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2480.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un634852.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3832 4820 WerFault.exe 84 5540 3420 WerFault.exe 100 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language si158664.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un634852.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro2480.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu5782.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4820 pro2480.exe 4820 pro2480.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4820 pro2480.exe Token: SeDebugPrivilege 3420 qu5782.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2472 1940 988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe 83 PID 1940 wrote to memory of 2472 1940 988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe 83 PID 1940 wrote to memory of 2472 1940 988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe 83 PID 2472 wrote to memory of 4820 2472 un634852.exe 84 PID 2472 wrote to memory of 4820 2472 un634852.exe 84 PID 2472 wrote to memory of 4820 2472 un634852.exe 84 PID 2472 wrote to memory of 3420 2472 un634852.exe 100 PID 2472 wrote to memory of 3420 2472 un634852.exe 100 PID 2472 wrote to memory of 3420 2472 un634852.exe 100 PID 3420 wrote to memory of 5336 3420 qu5782.exe 101 PID 3420 wrote to memory of 5336 3420 qu5782.exe 101 PID 3420 wrote to memory of 5336 3420 qu5782.exe 101 PID 1940 wrote to memory of 5648 1940 988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe 104 PID 1940 wrote to memory of 5648 1940 988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe 104 PID 1940 wrote to memory of 5648 1940 988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe"C:\Users\Admin\AppData\Local\Temp\988f43f78b5c5f315fb76ccbaeda1114eebf4342cfb6b5147fded09be61c28c3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un634852.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un634852.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2480.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2480.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 10964⤵
- Program crash
PID:3832
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5782.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5782.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 13844⤵
- Program crash
PID:5540
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si158664.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si158664.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4820 -ip 48201⤵PID:3848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3420 -ip 34201⤵PID:5384
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD58586144e0f668701b2862e2df09c8c37
SHA19f082110b22cab0ca2c8d9861fe6aabb9ef556fa
SHA256efa399396b14338ae5317ed759073d2c2afd9fc7fc5ebc8476f22c8e1bc6456d
SHA512df02da816c3f4a593fd0b6359d8e67b744b7f6ad1516bb01e4a9eb542a58e15777d5b63d7eda0babc83de1e8aeb2de00a4efa1fdc64026d505b0e5459645540e
-
Filesize
633KB
MD533c46b527eabb94f53d41e31c600aac9
SHA1a28c4534b01e6d9d5ef33401288497884f0b67d5
SHA25612eafe0ac04bb3093d4fd43fb54a3cc4725bd324d58a01c3de93a603da501155
SHA5129c9572692e31adcd9502076a44bd2571d109ab1f0f63866e7a5059905871e67e5752dccb28058277dff020aa3c754608a4943690615a4210f3f36ebddd2679ee
-
Filesize
230KB
MD5fd7026d420e2a82b04f4f8ded9c38b18
SHA167dfb0927435fa409f0fbdc01501061b8d290a37
SHA256bca8c49215cb952ddde84ac3085fdce5cd2d131d97e6bea7b842ecaa85c80566
SHA512fa94ad5071114d90b96d585ebf7c02c09b8a6b414ba89d6c0f445ae09681a8f6cabcfed93898a3799bb9e6a9b0e39b644e154cba8e385f7c8fcedafe95260c6e
-
Filesize
414KB
MD5d93e19b22c89a7ca1a4bd3bddc4cec86
SHA1b72a0a22f08efb647ae147a13de2a8993a1407b7
SHA256ca7346a1d380a69fca1142900143391d86823cd51893784d85ad6691207e1deb
SHA512c6aa3876679e0bb3baebff2d49f4a1fbadb202663925bdb0330d1ba2644fbf96a8cf24ac351a3e255469cd0a54df30a5e08b217d54f0956da2696f76ab6943a4
-
Filesize
168KB
MD51073b2e7f778788852d3f7bb79929882
SHA17f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA51290cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0