Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 19:17
Static task
static1
Behavioral task
behavioral1
Sample
8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe
Resource
win10v2004-20241007-en
General
-
Target
8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe
-
Size
1.2MB
-
MD5
a06fdea4fcfd2eb457fbbf1c029683ec
-
SHA1
d84955cd83e4ae1cd0035f29d6550d9a01639e7f
-
SHA256
8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e
-
SHA512
fd8d4f53986d19db603acff5d5a1f82434f0834992f025cc8a66143683eabdcb7a1dbd21ea483057a5d401fdeb902452129538bc4dfda86e796059df86915af7
-
SSDEEP
24576:8+6rGcx+SsQL1Biudmjpq5SEJ4+YLMSItf++HGKt1fTX/ySV8w:87GcVL1LaMSEJ6gr9++HG4x
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
resource yara_rule behavioral1/files/0x00060000000194ef-38.dat healer behavioral1/memory/2876-42-0x0000000000110000-0x000000000011A000-memory.dmp healer behavioral1/memory/2824-57-0x00000000003E0000-0x00000000003FA000-memory.dmp healer behavioral1/memory/2824-58-0x0000000002B80000-0x0000000002B98000-memory.dmp healer behavioral1/memory/2824-70-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-86-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-82-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-80-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-79-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-76-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-74-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-73-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-69-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-66-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-65-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-62-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-84-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-60-0x0000000002B80000-0x0000000002B92000-memory.dmp healer behavioral1/memory/2824-59-0x0000000002B80000-0x0000000002B92000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" con5008.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection bus3936.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bus3936.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bus3936.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" con5008.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" con5008.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" con5008.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" con5008.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bus3936.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bus3936.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bus3936.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
resource yara_rule behavioral1/memory/2800-101-0x0000000003330000-0x0000000003374000-memory.dmp family_redline behavioral1/memory/2800-100-0x00000000032F0000-0x0000000003336000-memory.dmp family_redline behavioral1/memory/2800-131-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-129-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-127-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-125-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-123-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-121-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-119-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-117-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-115-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-113-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-111-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-109-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-107-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-105-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-103-0x0000000003330000-0x000000000336E000-memory.dmp family_redline behavioral1/memory/2800-102-0x0000000003330000-0x000000000336E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 6 IoCs
pid Process 2000 kino1763.exe 2388 kino4301.exe 2724 kino1679.exe 2876 bus3936.exe 2824 con5008.exe 2800 dSU88s21.exe -
Loads dropped DLL 13 IoCs
pid Process 524 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe 2000 kino1763.exe 2000 kino1763.exe 2388 kino4301.exe 2388 kino4301.exe 2724 kino1679.exe 2724 kino1679.exe 2724 kino1679.exe 2724 kino1679.exe 2824 con5008.exe 2388 kino4301.exe 2388 kino4301.exe 2800 dSU88s21.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" bus3936.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features con5008.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" con5008.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features bus3936.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kino1763.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kino4301.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kino1679.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kino1763.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kino4301.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kino1679.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language con5008.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dSU88s21.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2876 bus3936.exe 2876 bus3936.exe 2824 con5008.exe 2824 con5008.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2876 bus3936.exe Token: SeDebugPrivilege 2824 con5008.exe Token: SeDebugPrivilege 2800 dSU88s21.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 524 wrote to memory of 2000 524 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe 31 PID 524 wrote to memory of 2000 524 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe 31 PID 524 wrote to memory of 2000 524 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe 31 PID 524 wrote to memory of 2000 524 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe 31 PID 524 wrote to memory of 2000 524 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe 31 PID 524 wrote to memory of 2000 524 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe 31 PID 524 wrote to memory of 2000 524 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe 31 PID 2000 wrote to memory of 2388 2000 kino1763.exe 32 PID 2000 wrote to memory of 2388 2000 kino1763.exe 32 PID 2000 wrote to memory of 2388 2000 kino1763.exe 32 PID 2000 wrote to memory of 2388 2000 kino1763.exe 32 PID 2000 wrote to memory of 2388 2000 kino1763.exe 32 PID 2000 wrote to memory of 2388 2000 kino1763.exe 32 PID 2000 wrote to memory of 2388 2000 kino1763.exe 32 PID 2388 wrote to memory of 2724 2388 kino4301.exe 33 PID 2388 wrote to memory of 2724 2388 kino4301.exe 33 PID 2388 wrote to memory of 2724 2388 kino4301.exe 33 PID 2388 wrote to memory of 2724 2388 kino4301.exe 33 PID 2388 wrote to memory of 2724 2388 kino4301.exe 33 PID 2388 wrote to memory of 2724 2388 kino4301.exe 33 PID 2388 wrote to memory of 2724 2388 kino4301.exe 33 PID 2724 wrote to memory of 2876 2724 kino1679.exe 34 PID 2724 wrote to memory of 2876 2724 kino1679.exe 34 PID 2724 wrote to memory of 2876 2724 kino1679.exe 34 PID 2724 wrote to memory of 2876 2724 kino1679.exe 34 PID 2724 wrote to memory of 2876 2724 kino1679.exe 34 PID 2724 wrote to memory of 2876 2724 kino1679.exe 34 PID 2724 wrote to memory of 2876 2724 kino1679.exe 34 PID 2724 wrote to memory of 2824 2724 kino1679.exe 35 PID 2724 wrote to memory of 2824 2724 kino1679.exe 35 PID 2724 wrote to memory of 2824 2724 kino1679.exe 35 PID 2724 wrote to memory of 2824 2724 kino1679.exe 35 PID 2724 wrote to memory of 2824 2724 kino1679.exe 35 PID 2724 wrote to memory of 2824 2724 kino1679.exe 35 PID 2724 wrote to memory of 2824 2724 kino1679.exe 35 PID 2388 wrote to memory of 2800 2388 kino4301.exe 36 PID 2388 wrote to memory of 2800 2388 kino4301.exe 36 PID 2388 wrote to memory of 2800 2388 kino4301.exe 36 PID 2388 wrote to memory of 2800 2388 kino4301.exe 36 PID 2388 wrote to memory of 2800 2388 kino4301.exe 36 PID 2388 wrote to memory of 2800 2388 kino4301.exe 36 PID 2388 wrote to memory of 2800 2388 kino4301.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe"C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
446KB
MD5e21a3b428e363320970fbc2cd8769bca
SHA15724113cab6082ac62e44b5ec18ce50f93167dd2
SHA2568a95b924fe8c39a347419f2d7cfd4bc26b53253f839ff0c0beb02c1506e8b0fd
SHA51205e7564ddb3af5b2eaa44330fcc39d547f9bc5ad702c77ac9b3d4cfc81286280d22cbc8a3872fba8f7e27c85ed539d066aa8c817c83f928db00d5ac4e098d91e
-
Filesize
879KB
MD5bfde80bb3e0dbfcc36040496fb310a2f
SHA1e4e25a03f438656e129fddc96515043ea79681e5
SHA256b074d6fb0601c65604189747ee38fa64dc5584e2cd7534965a70f55c5e5b295c
SHA512ba2d820806a1f910ead0dc8e5f1fae019e4d7048e79451f9a366829b715395757cabbbebad62093b177e218f9e87fed7ecc544be9b99bd6c086a72728b203439
-
Filesize
737KB
MD591f230ad73f15ec84b200c192d3c24e2
SHA1f7a35fb6c22d39d5a9ccadbee52d02666204d4b6
SHA256cf0a7d3ed491e460e7ce8448d677e41b74df37a8341ca3326628a8bcabc3fe7d
SHA512a425ff8522756409373a4d9ba5e5876f97c3b1030ad96ab14f321abd6c30561599059747210c6ad0fe50aead49d83182a614951f9d046945e2a09221a582e306
-
Filesize
365KB
MD534c0a04b45d12cd03883deed0bf7358e
SHA135030a4a88c4ed755c51e49ed13aff2fceff38af
SHA256716073224f018762830ff24eb475844a33be3e7ef4b423257343ff6a69e3c125
SHA512c8ea4fd7ab0fa003cd70b9477cdc4e3d8cca5500d4f1aaf9e473a4d0cb93b1ef213079814c9e68aa962e9e8328eecf9a5215e02b546281a1a4f0b59bafabf827
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
388KB
MD5627226e7dda75072d9680bb287a0124e
SHA1ee0e5e152c71be32f30b28ed5cf72335cc23460a
SHA25618e8ebeb9058810066ea27ae8a5b92e4558e48b260c07340076566c47430885c
SHA512737a84a6466cd643b2a6f61fb8bc81db73462859c666f1ba7e1ec147b5e63ba260b2f4140d859bbb32608bd856b31867ad7587416a44b9e5814c99ec8fdf9f8c