Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 19:17
Static task
static1
Behavioral task
behavioral1
Sample
696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd.exe
Resource
win10v2004-20241007-en
General
-
Target
696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd.exe
-
Size
836KB
-
MD5
6fdca2a86ad3bfd0c39b09e10295ab00
-
SHA1
75d184ba6d8ebaf7dcaa4fde1143340eb7db7f5a
-
SHA256
696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd
-
SHA512
c6e406808b2d70dd9520ff71b77b29df57613d4ac1868d047369065bb9e4f20cdee26edbc00b8139ffeb4af5146702dc8a5e6157bd78e0bb9d7d62be08e87b68
-
SSDEEP
24576:RykEd8BkJIGZkhFMal8zB41iix6H9hm2:EkAvBVal8zS1T6dhm
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
resource yara_rule behavioral1/files/0x0008000000023c8c-20.dat healer behavioral1/memory/808-22-0x0000000000EB0000-0x0000000000EBA000-memory.dmp healer behavioral1/memory/2212-29-0x0000000004900000-0x000000000491A000-memory.dmp healer behavioral1/memory/2212-31-0x0000000004B40000-0x0000000004B58000-memory.dmp healer behavioral1/memory/2212-32-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-39-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-59-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-57-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-55-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-54-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-52-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-49-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-47-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-45-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-43-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-41-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-37-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-35-0x0000000004B40000-0x0000000004B52000-memory.dmp healer behavioral1/memory/2212-33-0x0000000004B40000-0x0000000004B52000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" qu0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" qu0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" qu0050.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro0135.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0135.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection qu0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" qu0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" qu0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0135.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/1868-68-0x0000000007130000-0x0000000007174000-memory.dmp family_redline behavioral1/memory/1868-67-0x00000000070B0000-0x00000000070F6000-memory.dmp family_redline behavioral1/memory/1868-69-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-74-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-72-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-70-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-98-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-102-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-100-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-96-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-94-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-92-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-90-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-88-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-86-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-84-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-82-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-80-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-78-0x0000000007130000-0x000000000716E000-memory.dmp family_redline behavioral1/memory/1868-76-0x0000000007130000-0x000000000716E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 5 IoCs
pid Process 4860 unio6146.exe 4676 unio4780.exe 808 pro0135.exe 2212 qu0050.exe 1868 rNi33s05.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0135.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features qu0050.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" qu0050.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio6146.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" unio4780.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5776 sc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4324 2212 WerFault.exe 97 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rNi33s05.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unio6146.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unio4780.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu0050.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 808 pro0135.exe 808 pro0135.exe 2212 qu0050.exe 2212 qu0050.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 808 pro0135.exe Token: SeDebugPrivilege 2212 qu0050.exe Token: SeDebugPrivilege 1868 rNi33s05.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2384 wrote to memory of 4860 2384 696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd.exe 83 PID 2384 wrote to memory of 4860 2384 696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd.exe 83 PID 2384 wrote to memory of 4860 2384 696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd.exe 83 PID 4860 wrote to memory of 4676 4860 unio6146.exe 84 PID 4860 wrote to memory of 4676 4860 unio6146.exe 84 PID 4860 wrote to memory of 4676 4860 unio6146.exe 84 PID 4676 wrote to memory of 808 4676 unio4780.exe 85 PID 4676 wrote to memory of 808 4676 unio4780.exe 85 PID 4676 wrote to memory of 2212 4676 unio4780.exe 97 PID 4676 wrote to memory of 2212 4676 unio4780.exe 97 PID 4676 wrote to memory of 2212 4676 unio4780.exe 97 PID 4860 wrote to memory of 1868 4860 unio6146.exe 102 PID 4860 wrote to memory of 1868 4860 unio6146.exe 102 PID 4860 wrote to memory of 1868 4860 unio6146.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd.exe"C:\Users\Admin\AppData\Local\Temp\696ae6972bf7e487efe8e460cd3a854618b403b39eb64c9ab76911abcb2fc6fd.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6146.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6146.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\unio4780.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\unio4780.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pro0135.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pro0135.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu0050.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu0050.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 10805⤵
- Program crash
PID:4324
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rNi33s05.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rNi33s05.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2212 -ip 22121⤵PID:2684
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:5776
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
694KB
MD5a76c1e99d80ec891690fcab1a0f78dd6
SHA154a92b0a5e954fd298580ae6058a31d40954dce0
SHA2560e73e8542a4b90788ff646b178b4e93e30d29bbebe367332386b658bee8a113b
SHA5123c42cfa2c5cc73103b14aedf639f76164e041db5f95c2c507e9149ec30e90b98624ec68e00b9bb9da3dd0cc4933b3f583f27f918c1bb741e593bbb68baf9b520
-
Filesize
391KB
MD5e3ddd2e1d0c4b4ac9ac630bcc7593ff6
SHA1fc89b3f3d9c1f846c45623d3a035b90b55e45bb6
SHA256909f86a3809e2d355699b5cb68e902411b6211f7ae3d2cfbf596a3e1bc161004
SHA512718c990ee39e334b72b837103e00b489c9f2bb1f834d8f993ab6a1c369c3a1a65f9c64b8e1c12d23b03f4dd343456c0d123676ef65fb430e8394ee430185dec5
-
Filesize
344KB
MD56dd02250831223d5348e6e437eed1f33
SHA1b7b4ec55c3f28f7c8151a54f63a35d6e024854ae
SHA2560a4429b98bd76db3dccb7b579176a7cc04c2afe675a04a4b7a2f35f1774606e9
SHA512927a4feef744f2c6af6d7c9a448feb37ce3b79c0474f5f00f80a85ddf599ae80b3f187cfe5595af4a27937ba55340a29a81af3dff95f0f28e4b367958710ef9e
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
334KB
MD5c2c79f1fa2b25d2a5a03d596af6fe477
SHA12f6870269f1eb28246e448e09c27661b2ab8a652
SHA2564025d8579487ce98aa787f9832d15061aaa0d337c7fa3637462420debe1b7a94
SHA5125f97dbb4157205449512510af674e48d516096e57c8092f7bfdba5978303e7edc318202b39e56e7854f2886bb53be36a906c0081e45c52637ccd0199d2eda80e