Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 19:12
Static task
static1
Behavioral task
behavioral1
Sample
ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7.exe
Resource
win10v2004-20241007-en
General
-
Target
ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7.exe
-
Size
965KB
-
MD5
e5f83146fe215a86b8c68260946f804a
-
SHA1
8ef6dce09f2b430d54240eba047cd9584bc74c59
-
SHA256
ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7
-
SHA512
448ec61d3bdc7038663370ce73f1ec29b100d20b8a48cbde148d8acae675ad77553cc8912bcf040a89b7a1f0c28163c11854b9f718ccd8d676ca659b9e5341aa
-
SSDEEP
24576:2yYy2VU1T9kxfXZUowedeX8dKlXU1d2C/JGIh/4Qa0utZ4a:FSVU1T9g/wDmKlEnDci/4V02
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4212-22-0x0000000004980000-0x000000000499A000-memory.dmp healer behavioral1/memory/4212-24-0x0000000004B80000-0x0000000004B98000-memory.dmp healer behavioral1/memory/4212-32-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-30-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-52-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-50-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-49-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-46-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-44-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-43-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-40-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-38-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-36-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-34-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-28-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-26-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/4212-25-0x0000000004B80000-0x0000000004B92000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr127170.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr127170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr127170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr127170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr127170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr127170.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/3164-60-0x0000000007130000-0x000000000716C000-memory.dmp family_redline behavioral1/memory/3164-61-0x0000000007770000-0x00000000077AA000-memory.dmp family_redline behavioral1/memory/3164-69-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-87-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-93-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-91-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-85-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-83-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-81-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-79-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-77-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-75-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-73-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-71-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-95-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-89-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-67-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-65-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-63-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline behavioral1/memory/3164-62-0x0000000007770000-0x00000000077A5000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
pid Process 2692 un201053.exe 2596 un861353.exe 4212 pr127170.exe 3164 qu358692.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr127170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr127170.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un201053.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un861353.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5016 4212 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un201053.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un861353.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pr127170.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu358692.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4212 pr127170.exe 4212 pr127170.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4212 pr127170.exe Token: SeDebugPrivilege 3164 qu358692.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2692 3008 ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7.exe 83 PID 3008 wrote to memory of 2692 3008 ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7.exe 83 PID 3008 wrote to memory of 2692 3008 ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7.exe 83 PID 2692 wrote to memory of 2596 2692 un201053.exe 85 PID 2692 wrote to memory of 2596 2692 un201053.exe 85 PID 2692 wrote to memory of 2596 2692 un201053.exe 85 PID 2596 wrote to memory of 4212 2596 un861353.exe 86 PID 2596 wrote to memory of 4212 2596 un861353.exe 86 PID 2596 wrote to memory of 4212 2596 un861353.exe 86 PID 2596 wrote to memory of 3164 2596 un861353.exe 97 PID 2596 wrote to memory of 3164 2596 un861353.exe 97 PID 2596 wrote to memory of 3164 2596 un861353.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7.exe"C:\Users\Admin\AppData\Local\Temp\ef94e4da71e60df55217da24b27cfdb0115cd9e03b7dbfd1b4763b8cb39a56f7.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un201053.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un201053.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un861353.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un861353.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr127170.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr127170.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 10645⤵
- Program crash
PID:5016
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu358692.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu358692.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4212 -ip 42121⤵PID:2876
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
707KB
MD57242348824e79a580e089f2d4ab9da3b
SHA1d1df21e9a95bf20b06afd97e27ffa0e1caed63b1
SHA256e9e778c3dd1c1ea664c4a6d5dd900be5fe15cb17ec27c2334df114255324d419
SHA512bee43a5f782f3a2256603b15485a25a8e7a99edcccf0ac8cd09f8ea179aebe042e082468d667721a45350c97a9b0d0a6fe6ae051e2a1420211e000594d43974e
-
Filesize
552KB
MD548bfdad201cc146ccd46f8055055a8f2
SHA13fd1db7ae040ff82c1754364a33166bba5a26d56
SHA256e8b137bf3fdb99111ff4f179c887a7108234fb1eaec393c1af46f60f054a0c47
SHA51293b2acc5c4d3f5cf086697d9f8952aa97541f7fecce34f87f163b8d51b2f813550b073711aca89b788418097416e126ca12bed6d537c887ea313c8a19881fe6d
-
Filesize
279KB
MD53497386096d3baab3b75537509396165
SHA13e9e3edadb82dc2693f5863901ef8bf3080e52f2
SHA25648e777b50fae97a88e39555e768eefef95d8b2cb980b40e1c3cd6be645ef4aca
SHA5123c4209132fb3056a278b37d853c3cdf19f3333c06439bde5beb4299f92f240abd877eba9c4acc850cfad8d13f6789da4aaa19ee4cfce3725fd4289b90b7519f4
-
Filesize
362KB
MD5c0c3eac8cfe69601c447db3d7f33b98c
SHA13f2041be41bdf6b3fff4ef95f4929101f57f5191
SHA256f2b393468fef93def4e97eead8b7e2866b49f11df40845040a7658a32d74f326
SHA512f46743adbfaefe0ae8158c4c5c650d5feac0809712a5b36e4996c2f4ac0acedac1d4ca9d0ce8184292f64f71139d84f8296c5fdcb366b0749c28827d8d322918