Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe
Resource
win10v2004-20241007-en
General
-
Target
8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe
-
Size
842KB
-
MD5
e85fb57cfe32620ddc1f2bb0552c2ff0
-
SHA1
2e27047f6109a1c7c4d98d36f8b5c49a877c056a
-
SHA256
8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3
-
SHA512
b699921777ff4b60d0d01f517853258d6b40289e28f3c3be0c56b6d8406a419359fa2ce8a2e5c8b3e4ac680cbc5b54a5f6cb1023b20f3e8b69b48a289a5533c1
-
SSDEEP
12288:1Mrhy90mgb36nWQPQ3Lc5CIWb9w8kPrVLn73mmipIXSLO7L53NSB7VyODQMGE:0yTgI43aO6PLDmzMrfGqODQMGE
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
diza
77.91.124.145:4125
-
auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4856-19-0x0000000002460000-0x000000000247A000-memory.dmp healer behavioral1/memory/4856-21-0x00000000024F0000-0x0000000002508000-memory.dmp healer behavioral1/memory/4856-35-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-49-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-47-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-45-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-43-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-41-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-39-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-37-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-33-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-32-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-29-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-27-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-25-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-23-0x00000000024F0000-0x0000000002502000-memory.dmp healer behavioral1/memory/4856-22-0x00000000024F0000-0x0000000002502000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4187.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/392-2143-0x0000000005760000-0x0000000005792000-memory.dmp family_redline behavioral1/files/0x000e000000023b5c-2148.dat family_redline behavioral1/memory/2784-2156-0x0000000000C40000-0x0000000000C70000-memory.dmp family_redline behavioral1/files/0x000a000000023b57-2163.dat family_redline behavioral1/memory/2996-2167-0x00000000003E0000-0x000000000040E000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation qu2387.exe -
Executes dropped EXE 5 IoCs
pid Process 2120 un513172.exe 4856 pro4187.exe 392 qu2387.exe 2784 1.exe 2996 si668296.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4187.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un513172.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4440 4856 WerFault.exe 85 4852 392 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language si668296.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un513172.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro4187.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu2387.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4856 pro4187.exe 4856 pro4187.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4856 pro4187.exe Token: SeDebugPrivilege 392 qu2387.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 5088 wrote to memory of 2120 5088 8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe 83 PID 5088 wrote to memory of 2120 5088 8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe 83 PID 5088 wrote to memory of 2120 5088 8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe 83 PID 2120 wrote to memory of 4856 2120 un513172.exe 85 PID 2120 wrote to memory of 4856 2120 un513172.exe 85 PID 2120 wrote to memory of 4856 2120 un513172.exe 85 PID 2120 wrote to memory of 392 2120 un513172.exe 95 PID 2120 wrote to memory of 392 2120 un513172.exe 95 PID 2120 wrote to memory of 392 2120 un513172.exe 95 PID 392 wrote to memory of 2784 392 qu2387.exe 96 PID 392 wrote to memory of 2784 392 qu2387.exe 96 PID 392 wrote to memory of 2784 392 qu2387.exe 96 PID 5088 wrote to memory of 2996 5088 8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe 99 PID 5088 wrote to memory of 2996 5088 8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe 99 PID 5088 wrote to memory of 2996 5088 8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe"C:\Users\Admin\AppData\Local\Temp\8e414c8ae1f662b8e4c5d067b02314f4a551759fb5df0aa9d34405bdb4dabca3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un513172.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un513172.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4187.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4187.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 10884⤵
- Program crash
PID:4440
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2387.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2387.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 15284⤵
- Program crash
PID:4852
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si668296.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si668296.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4856 -ip 48561⤵PID:532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 392 -ip 3921⤵PID:3536
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5223e7a26d6a1982813f2777a9d6f792d
SHA11fb68d09b78c5a6835416ec4281071c1ebbdf375
SHA256400b8d1b0ff668071a7b60e239db0598e5fa0330a47429601c4ad3d3d51034a2
SHA5124a8d3e24de63a51ce7bce383613431e48ad2352a78fe0caa41673e3b68ecf68b9a0517258b9721abc3bd76e8f7ba13931f313e6058cbc64fc8f422dda876c776
-
Filesize
688KB
MD576a67382469897b0c5188c69fc179b9a
SHA135e44fdc46598d40be8cd7b9332bd08bab0daef2
SHA256526c2d99f6e7e33161dfeaf9efa9332c059919924513c0abd2f6926518c121fa
SHA512abfb1a663698b01a3475ba7f51f3da79bdda14094068af82f8379465de3baed1957e0b44c7e4c7f2a68e059ef3f408d9c7eabe9c1dd1393481d9c0e03d14ad26
-
Filesize
233KB
MD51bd7eb267f674669bb010a3236a1616c
SHA1bdd3c13b955627735262eba0d09e927560bcbd2f
SHA256cf76be2a93462c1aa5175b423773194da84b5afb8379c4b0eca46e10473b14eb
SHA5126c10fc5045b38ddb76c1f187f9a354ace711969cb80379f215a8c6b59c7d7c592b9ed23b9840aa35c94360c375b910b7a6937c52719b4236259a9abb2119394c
-
Filesize
495KB
MD51a0ab0a9a1e41f5ea68916969ab18b04
SHA1e174e63d510c70a5b3d523eac9a928c786de2245
SHA256fa32da14a9689ec84aa8ecfe818cea8e742fde70103657506fb79e27cd285131
SHA512eb469d62569899747f16e5a774a53b9aaf6161f77dcf2e7da3d2c7c7bd65f7314d6bb5b966f465bb46d8513b280a6e749d46cc6b3e628e8f88922ef309786cc8
-
Filesize
168KB
MD51073b2e7f778788852d3f7bb79929882
SHA17f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA51290cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0