Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 00:35
Static task
static1
Behavioral task
behavioral1
Sample
68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exe
Resource
win10v2004-20241007-en
General
-
Target
68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exe
-
Size
479KB
-
MD5
d57dc88419ace940ed107e3ccf1e59f1
-
SHA1
8cdf0e2a4dc8b9f98109bda52e372b644c64b870
-
SHA256
68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4
-
SHA512
736a1fe6efed9b0bc09497af9551ebef02e1223c8c5d10709fa51552f6864a6cb9332132c98f57b460e8f76b5da3568e507fcb2fd0447f5fcf41c7864f95f2a2
-
SSDEEP
12288:MMrfy90DzndtRZiAMbT9pFKQwElE+bvB522vuy2E7P3aPj9vZ:TyQzXr4bT9K+5Rv92Ej3qjr
Malware Config
Extracted
redline
ditro
217.196.96.101:4132
-
auth_value
8f24ed370a9b24aa28d3d634ea57912e
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2476-15-0x00000000023F0000-0x000000000240A000-memory.dmp healer behavioral1/memory/2476-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp healer behavioral1/memory/2476-45-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-47-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-43-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-41-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-39-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-37-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-35-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-33-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-31-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-29-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-27-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-25-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-23-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer behavioral1/memory/2476-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp healer -
Healer family
-
Processes:
k4909170.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k4909170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k4909170.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection k4909170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k4909170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k4909170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k4909170.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x0008000000023c52-54.dat family_redline behavioral1/memory/3232-56-0x0000000000C30000-0x0000000000C60000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
y8018012.exek4909170.exel0897771.exepid Process 3160 y8018012.exe 2476 k4909170.exe 3232 l0897771.exe -
Processes:
k4909170.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k4909170.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k4909170.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exey8018012.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y8018012.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
l0897771.exe68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exey8018012.exek4909170.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language l0897771.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language y8018012.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k4909170.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
k4909170.exepid Process 2476 k4909170.exe 2476 k4909170.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
k4909170.exedescription pid Process Token: SeDebugPrivilege 2476 k4909170.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exey8018012.exedescription pid Process procid_target PID 520 wrote to memory of 3160 520 68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exe 84 PID 520 wrote to memory of 3160 520 68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exe 84 PID 520 wrote to memory of 3160 520 68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exe 84 PID 3160 wrote to memory of 2476 3160 y8018012.exe 85 PID 3160 wrote to memory of 2476 3160 y8018012.exe 85 PID 3160 wrote to memory of 2476 3160 y8018012.exe 85 PID 3160 wrote to memory of 3232 3160 y8018012.exe 95 PID 3160 wrote to memory of 3232 3160 y8018012.exe 95 PID 3160 wrote to memory of 3232 3160 y8018012.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exe"C:\Users\Admin\AppData\Local\Temp\68253453cfba84d330830e5045d068e1c32ed7c8d9bdfb678dfd73ec48a650f4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8018012.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8018012.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4909170.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4909170.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0897771.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0897771.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3232
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307KB
MD5f663e4f44d7332c3cbf71cd80bc93489
SHA1f346fcd6eee02fffb173b5b536073bcb00bf8f01
SHA256c6ace7e682db2fa0f8e8caf7bfbf0b048039d282f44b33898cbd410037c8676f
SHA51290185c6f2832487cedb87bc1e9c52fece583062d06932a8fc1145b52a36fe72421f0217abf78a6ecd8bbe8dad58b76a87e48c6d78b69aeb310f2587cffb273ac
-
Filesize
178KB
MD591b7fe2c3a4ddcdbd294c541f4421219
SHA191cabffbfd6155c1ca0a84dc9aeed1673b8600be
SHA256f91b5c409d1b5a3e9f0e3e32e2a016c482eb360c78f7c49f5928676c6458b9bb
SHA512cc4535654764a79f1fbcf0cb322003ad41f4b6ec4505251d764121d032d770af35f10b6dfc3aa886cc03aeb5dc07cf0edf2de5b2fbacf38e62a12e4825fa7d11
-
Filesize
168KB
MD56d76f2236325b2ed901507602b1dde2a
SHA1a305b43edcde9fb7fe8263ca451e8f90dc4e0198
SHA256bb33501c56f4cd11b0b9f4fbfd36787477d8046e4f32d2198a8f94da0127dfdd
SHA5129b584f9216b20bd23f503ba0eda85b0363f75c09333d32040b39c338ca4fe1f4a23b628df95ec05d862ef8965454caf3d4b97291996077179ac2a7661cf37378