Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 00:42
Static task
static1
Behavioral task
behavioral1
Sample
1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe
Resource
win10v2004-20241007-en
General
-
Target
1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe
-
Size
814KB
-
MD5
bf7f94e1f00b7b1347c75cc41801f12e
-
SHA1
a576ee3c58757b45bf08917fd242caa02a443c32
-
SHA256
1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36
-
SHA512
8077d1d8a51aa270ee978dd562f0a80de7c78f7eb2cd603002c5d563ba58887a5e2306548221bfacf930b94cff49e7018c05e9e6a0c974c8f0d8f462d991cbc4
-
SSDEEP
12288:ZMrMy90hnGwjyypZ6j7t4v66l/yu6MZc2JaASbcvDrS9jLQEvwX:lyYjRo54i6lqu6p2DwEunQKs
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
diza
77.91.124.145:4125
-
auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3492-19-0x00000000026E0000-0x00000000026FA000-memory.dmp healer behavioral1/memory/3492-21-0x0000000005370000-0x0000000005388000-memory.dmp healer behavioral1/memory/3492-45-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-49-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-47-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-43-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-41-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-40-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-37-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-35-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-33-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-31-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-29-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-27-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-25-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-23-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/3492-22-0x0000000005370000-0x0000000005382000-memory.dmp healer -
Healer family
-
Processes:
pro4425.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4425.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1232-2142-0x0000000005750000-0x0000000005782000-memory.dmp family_redline behavioral1/files/0x000b000000023cb3-2147.dat family_redline behavioral1/memory/1100-2155-0x0000000000AD0000-0x0000000000B00000-memory.dmp family_redline behavioral1/files/0x0007000000023cae-2164.dat family_redline behavioral1/memory/5928-2165-0x0000000000E30000-0x0000000000E5E000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
qu3376.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation qu3376.exe -
Executes dropped EXE 5 IoCs
Processes:
un113432.exepro4425.exequ3376.exe1.exesi025034.exepid Process 1008 un113432.exe 3492 pro4425.exe 1232 qu3376.exe 1100 1.exe 5928 si025034.exe -
Processes:
pro4425.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4425.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exeun113432.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un113432.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 3436 3492 WerFault.exe 84 5704 1232 WerFault.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exeun113432.exepro4425.exequ3376.exe1.exesi025034.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un113432.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro4425.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu3376.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language si025034.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pro4425.exepid Process 3492 pro4425.exe 3492 pro4425.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pro4425.exequ3376.exedescription pid Process Token: SeDebugPrivilege 3492 pro4425.exe Token: SeDebugPrivilege 1232 qu3376.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exeun113432.exequ3376.exedescription pid Process procid_target PID 4560 wrote to memory of 1008 4560 1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe 83 PID 4560 wrote to memory of 1008 4560 1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe 83 PID 4560 wrote to memory of 1008 4560 1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe 83 PID 1008 wrote to memory of 3492 1008 un113432.exe 84 PID 1008 wrote to memory of 3492 1008 un113432.exe 84 PID 1008 wrote to memory of 3492 1008 un113432.exe 84 PID 1008 wrote to memory of 1232 1008 un113432.exe 99 PID 1008 wrote to memory of 1232 1008 un113432.exe 99 PID 1008 wrote to memory of 1232 1008 un113432.exe 99 PID 1232 wrote to memory of 1100 1232 qu3376.exe 100 PID 1232 wrote to memory of 1100 1232 qu3376.exe 100 PID 1232 wrote to memory of 1100 1232 qu3376.exe 100 PID 4560 wrote to memory of 5928 4560 1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe 103 PID 4560 wrote to memory of 5928 4560 1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe 103 PID 4560 wrote to memory of 5928 4560 1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe"C:\Users\Admin\AppData\Local\Temp\1f397ac92b8c1068d6388844acb277dd8f05f1b4221975e7bb28114268e60f36.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113432.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un113432.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4425.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4425.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 9844⤵
- Program crash
PID:3436
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3376.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3376.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 13804⤵
- Program crash
PID:5704
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si025034.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si025034.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3492 -ip 34921⤵PID:2856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1232 -ip 12321⤵PID:5436
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5c52031f68f4ec64c9e5855b0a4a738cc
SHA1e1955ea131a5add88e921233b0a7a41b9997b5f6
SHA25699efda255790fdd3a835fdfca230162cd7e471d89ce5a1799787fa1b98a0e2e0
SHA5129d94d097c427d6e24354b866d919930cd24e0da1423d063aaf4872acf05e8fc6367d9ff79b3932c121f2e6b00bd441cb36ef68f2b011ff610d7f852cb094b206
-
Filesize
661KB
MD5b1586db9c72ee4e7642b42615f43a068
SHA12351bdbae51fddb67a1d16d85e8dbae511a47461
SHA25610a9bef4d59840be94cd90fdabea3f7e1cd1557f7e35fad73ba76a7e415f0ce3
SHA5122bd7599ca757b739edfef75e6acba3be96ec84ffb435163912c54d7ba6dd1f5b53a550425c52162d87ba2de12f84284abbe8e92d40fe4b2ea94c7f802f4d4c9d
-
Filesize
332KB
MD5cfb2932c592cd74098a77c8882ff1e77
SHA1d260880cfc63dbdd7dd6076f6c24f3f11ed2756f
SHA2568bcccd7f0e9fcd9d131d8a732aca51181cd0cfaf89e189c7c55bd1370b8f21a8
SHA51243e7cf2d914d78ccc21135c201f5158c8e9475c8ace98f811fd8b4e34331a65da5daa21a75f6d9cc33e285e2b07ba993c822d9a6189d60a00861a56135064482
-
Filesize
495KB
MD591f1840d8b1303e08248a6ff8cebe892
SHA1047e4946fe8c659cb77d7e82f401840bfa32a2d4
SHA2568f2520f45fadecb18ebd085aa6636d25fad72dd2c82f825822229128612feb37
SHA5121f85b99d633ce526d2d897e04fed27a2c17bdc9506be79609f6a1d4ec25a74b9ef54acefcb7e09deee5e3c033e7ab3816c1f41d12e4231b1c1a3a08db11056f9
-
Filesize
168KB
MD51073b2e7f778788852d3f7bb79929882
SHA17f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA51290cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0