Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 00:36
Static task
static1
Behavioral task
behavioral1
Sample
96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exe
Resource
win10v2004-20241007-en
General
-
Target
96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exe
-
Size
966KB
-
MD5
b6644b7d65b9d34cdb55a5e5ed3b44ef
-
SHA1
89c9b43ae56dbbeb264fecd685a8a344ce97ff5b
-
SHA256
96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d
-
SHA512
1ba5c7c419d1141fbe121cc018a7b257aed06cc72c1e1866827974a10e9ae351f9756bae4c8c6d59090a1d4c7a79cc112f2b70c67acde352c91409cedcc3872e
-
SSDEEP
12288:Fy90798jjdSDkgTpPD6l1hma9C1wGbH5B6uo+3N4jxgmLzLcI5qoxF:FyC98jjdSDrPDUhvC1waBRotxgmLRpF
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3028-22-0x00000000047F0000-0x000000000480A000-memory.dmp healer behavioral1/memory/3028-24-0x0000000004A00000-0x0000000004A18000-memory.dmp healer behavioral1/memory/3028-26-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-52-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-50-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-48-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-46-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-44-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-42-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-40-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-38-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-36-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-34-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-32-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-30-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-28-0x0000000004A00000-0x0000000004A12000-memory.dmp healer behavioral1/memory/3028-25-0x0000000004A00000-0x0000000004A12000-memory.dmp healer -
Healer family
-
Processes:
pr340612.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr340612.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr340612.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr340612.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr340612.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr340612.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr340612.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4988-60-0x0000000004BA0000-0x0000000004BDC000-memory.dmp family_redline behavioral1/memory/4988-61-0x00000000071E0000-0x000000000721A000-memory.dmp family_redline behavioral1/memory/4988-67-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-75-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-73-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-71-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-69-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-87-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-65-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-63-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-62-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-79-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-95-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-93-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-91-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-89-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-85-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-83-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-82-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline behavioral1/memory/4988-77-0x00000000071E0000-0x0000000007215000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
Processes:
un772821.exeun029751.exepr340612.exequ441119.exepid Process 1032 un772821.exe 3376 un029751.exe 3028 pr340612.exe 4988 qu441119.exe -
Processes:
pr340612.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr340612.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr340612.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exeun772821.exeun029751.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un772821.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un029751.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exeun772821.exeun029751.exepr340612.exequ441119.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un772821.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un029751.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pr340612.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu441119.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pr340612.exepid Process 3028 pr340612.exe 3028 pr340612.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pr340612.exequ441119.exedescription pid Process Token: SeDebugPrivilege 3028 pr340612.exe Token: SeDebugPrivilege 4988 qu441119.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exeun772821.exeun029751.exedescription pid Process procid_target PID 220 wrote to memory of 1032 220 96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exe 85 PID 220 wrote to memory of 1032 220 96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exe 85 PID 220 wrote to memory of 1032 220 96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exe 85 PID 1032 wrote to memory of 3376 1032 un772821.exe 86 PID 1032 wrote to memory of 3376 1032 un772821.exe 86 PID 1032 wrote to memory of 3376 1032 un772821.exe 86 PID 3376 wrote to memory of 3028 3376 un029751.exe 87 PID 3376 wrote to memory of 3028 3376 un029751.exe 87 PID 3376 wrote to memory of 3028 3376 un029751.exe 87 PID 3376 wrote to memory of 4988 3376 un029751.exe 94 PID 3376 wrote to memory of 4988 3376 un029751.exe 94 PID 3376 wrote to memory of 4988 3376 un029751.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exe"C:\Users\Admin\AppData\Local\Temp\96ab490a6915c568999669ee3eacd0568c2e8152a56f9fb3e0305104ad8f553d.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un772821.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un772821.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un029751.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un029751.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr340612.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr340612.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu441119.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu441119.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
707KB
MD5a41c37c56bd282da8d108a85552cfd11
SHA13d1d5a838fecfd9ec7b0af37c07f783bb5debf9c
SHA256518900486ca5e9a3eb2b68b3df559dd3dfec5f73a2394e1cc84b0377a5938504
SHA5129967a4682d7ce1b2419eb2d3ec6d5cdbc1c098660ba0255af2ca27cd35d0cf789bb58335d4e7b93415a29e5506a383b002bba2e963887201121a6e9d362ca4d0
-
Filesize
553KB
MD5f3cf892202f58c8b177f6b0a5b45848b
SHA1cea90c4ad8b1ea9268eefd7630e2900328816839
SHA2562fd29187fa80aa3f3b2e52f867630d3bfb2bd7a47b6de783cfbddaf1b23bd6b1
SHA5120999438379365b6d1173f7c96d96128a676edd39081731b6f8e7a17f483e756718bec62cf24770bfbd74b18a9244fca6f3aed5f30cf021234d7e9f51f2bdcda3
-
Filesize
278KB
MD5482f9a5a5c6f9f2b76371fcf44c11c54
SHA16e8fb9cebb884ab6aed31a87ca1dca29259e7e38
SHA25610ec01cc9bd044da76c5ede924f9ec4f03f3f02a78de5d2875604ec1e0d2d68f
SHA51289cef9525b27bba8c7e410d4fff7ef3222600a366bf926065c8abf230657546191b86b6372df4bf6f449d88e7156e81dc3c24ab05962cff65ccf989a96e91519
-
Filesize
360KB
MD564a477ec3cc2039defeb2076dc4bb159
SHA130edce6b5b48786c56d298674bf21d346b4201d2
SHA256e5eef83041278dbf3fcfed0e45ce4bcff815519dc95201b69084893214e4969d
SHA512f51561f8b3fd05f1ec206a6ba55730fefbc0c01654ba2598e03815ac924ae7de2b556e0d6e34bec821ec4ad802b5584b074b1a2dbdb46c720b8ac260f468aa26