Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185.exe
Resource
win10v2004-20241007-en
General
-
Target
67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185.exe
-
Size
689KB
-
MD5
9037be579f4c874ebeac9f581f365452
-
SHA1
66a6217c977786d0cac2e40827be5ce58263c2c2
-
SHA256
67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185
-
SHA512
aebe1469db313c24c10cb3c771ab3c5f767c24d39d1d1288ab8bf26d688a414a33a0481629175596d2b75944728b9150d73a38205f3e9dfd1308f9f81d31e645
-
SSDEEP
12288:qMrTy90qQy1qX0KI0+uqqG9iV1IcaVm5b+2ehHG043x6YMKKbLZ5b5847xgcrvf:lypQ/V+uV/qm5bPyG04hpMHTb5jgcLf
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/1132-16-0x0000000004A30000-0x0000000004A4A000-memory.dmp healer behavioral1/memory/1132-18-0x0000000007120000-0x0000000007138000-memory.dmp healer behavioral1/memory/1132-46-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-44-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-42-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-40-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-38-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-36-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-34-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-32-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-30-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-28-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-26-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-24-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-22-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-20-0x0000000007120000-0x0000000007132000-memory.dmp healer behavioral1/memory/1132-19-0x0000000007120000-0x0000000007132000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro1436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1436.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1436.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/4260-56-0x0000000004730000-0x0000000004776000-memory.dmp family_redline behavioral1/memory/4260-57-0x0000000004910000-0x0000000004954000-memory.dmp family_redline behavioral1/memory/4260-67-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-69-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-91-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-89-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-87-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-85-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-83-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-81-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-79-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-77-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-75-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-73-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-71-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-65-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-63-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-61-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-59-0x0000000004910000-0x000000000494F000-memory.dmp family_redline behavioral1/memory/4260-58-0x0000000004910000-0x000000000494F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2088 unio7743.exe 1132 pro1436.exe 4260 qu1261.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1436.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro1436.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio7743.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1472 1132 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unio7743.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro1436.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu1261.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1132 pro1436.exe 1132 pro1436.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1132 pro1436.exe Token: SeDebugPrivilege 4260 qu1261.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1148 wrote to memory of 2088 1148 67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185.exe 83 PID 1148 wrote to memory of 2088 1148 67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185.exe 83 PID 1148 wrote to memory of 2088 1148 67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185.exe 83 PID 2088 wrote to memory of 1132 2088 unio7743.exe 84 PID 2088 wrote to memory of 1132 2088 unio7743.exe 84 PID 2088 wrote to memory of 1132 2088 unio7743.exe 84 PID 2088 wrote to memory of 4260 2088 unio7743.exe 95 PID 2088 wrote to memory of 4260 2088 unio7743.exe 95 PID 2088 wrote to memory of 4260 2088 unio7743.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185.exe"C:\Users\Admin\AppData\Local\Temp\67f9354f057027960f4b11c7b6bb54dd4e8d73e790ff967dd81b86de869c2185.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7743.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7743.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1436.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1436.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 10804⤵
- Program crash
PID:1472
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1261.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1261.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1132 -ip 11321⤵PID:3416
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5c17f0b689e5a6847557baff5131ab1e3
SHA1e95bd6f1ddfb25c1c5d1c5ff5a3012290785c704
SHA256791e011c4216c3baeff868699eb15e4ce71d9c6b87c06ccd490c8d44e7517153
SHA51288f23b8d90666e97de8f9ed6fa64b075038c9035f264c1b9974946eab4f9b8ad152801f9674dec021a4c0232c3f4a3fdec0c654f6e0e6fc1027160d553bb1907
-
Filesize
329KB
MD5ef01f676a485106a7f77c7fcf6ee9e33
SHA10861cf2f53182e1298e169260549dc1bffd2820c
SHA256d51655917545220ba7e8224b0c47b846648e3d84359f78b346903439dd6472fc
SHA5124ff8f779da6abfc0c78cac920536cdd05c41785be93acbcbca287556de94951c87f8e02c79ac71a26d41e0eaf014f384336b7dcfd8cd1ddbb33cfbb82ec6c22c
-
Filesize
386KB
MD5dba714b4696c765e4e0e68d737593bd8
SHA1cb2cc6ddc166180a691123ffeb0e2f64fe4f2a73
SHA256ff1695f7f0c6ef819149db650e7f310ae3e90b20a517bf59ae57b88bbe3528a9
SHA512d3898e44155a7d932d0ee3801f43fee174a0ac558aaf31949e0cee5db9d901b1111e77e209359f17d0131528a4e6385ad642f4b25b45fb05fb2a8243137fa164