Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:41
Static task
static1
Behavioral task
behavioral1
Sample
6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exe
Resource
win10v2004-20241007-en
General
-
Target
6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exe
-
Size
550KB
-
MD5
a3b321d586a03e9ff2ab74e073de8510
-
SHA1
b61c5e3276179fc8cbad16ce5e17cd0875814329
-
SHA256
6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84
-
SHA512
49f30607999aa2fdee087b75300ce7599e7479fdd0f7543e640c6403cbe322d518b634f05527958d83c2407ad840b5c96af2531cf1dcab5f93eeb0e41e0fee54
-
SSDEEP
12288:vMrHy90P2Mc7qRUH/V8qzQu01yrMrtwHcGZQf5z:cyY2MGq64ycwHcGZQRz
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9551Uo.exe healer behavioral1/memory/3188-15-0x0000000000D40000-0x0000000000D4A000-memory.dmp healer -
Healer family
-
Processes:
b9551Uo.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" b9551Uo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b9551Uo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b9551Uo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b9551Uo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection b9551Uo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b9551Uo.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2660-22-0x00000000024F0000-0x0000000002536000-memory.dmp family_redline behavioral1/memory/2660-24-0x0000000004AC0000-0x0000000004B04000-memory.dmp family_redline behavioral1/memory/2660-26-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-36-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-88-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-86-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-85-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-82-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-80-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-79-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-76-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-74-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-72-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-71-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-68-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-66-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-64-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-62-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-60-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-58-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-56-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-54-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-52-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-48-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-46-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-44-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-42-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-40-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-38-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-34-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-32-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-30-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-28-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-50-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline behavioral1/memory/2660-25-0x0000000004AC0000-0x0000000004AFE000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
nice7479.exeb9551Uo.exec74fb54.exepid process 636 nice7479.exe 3188 b9551Uo.exe 2660 c74fb54.exe -
Processes:
b9551Uo.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" b9551Uo.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exenice7479.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nice7479.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exenice7479.exec74fb54.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nice7479.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c74fb54.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b9551Uo.exepid process 3188 b9551Uo.exe 3188 b9551Uo.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b9551Uo.exec74fb54.exedescription pid process Token: SeDebugPrivilege 3188 b9551Uo.exe Token: SeDebugPrivilege 2660 c74fb54.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exenice7479.exedescription pid process target process PID 4728 wrote to memory of 636 4728 6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exe nice7479.exe PID 4728 wrote to memory of 636 4728 6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exe nice7479.exe PID 4728 wrote to memory of 636 4728 6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exe nice7479.exe PID 636 wrote to memory of 3188 636 nice7479.exe b9551Uo.exe PID 636 wrote to memory of 3188 636 nice7479.exe b9551Uo.exe PID 636 wrote to memory of 2660 636 nice7479.exe c74fb54.exe PID 636 wrote to memory of 2660 636 nice7479.exe c74fb54.exe PID 636 wrote to memory of 2660 636 nice7479.exe c74fb54.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exe"C:\Users\Admin\AppData\Local\Temp\6ac4814b4d9ee2cc1b7f58673bb3811386cbea49de1cf897415deb3de283ad84.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice7479.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice7479.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9551Uo.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9551Uo.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c74fb54.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c74fb54.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2660
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
405KB
MD5e6e0303971097a8778b4f297a724df86
SHA1aa18dab96d48b0f0566be1057152dffe5e3d4782
SHA256223e330560701f26b0ac6fdba843675906c1014600780bb7c92a442004c45652
SHA512a5ca3286e99b5d0679c7eb88d854278cf2fd31f6621de9aa0f52d304ab278f264d5360a1e60ebf6db88a12402739483138ecd372faac2591d8da007757c3edcc
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
373KB
MD5daaf03783a48918495bfa8bf8a54e9a1
SHA18134d5b7f9293f034c637dad31c3cce0e9ba97f5
SHA256ac0d29166950289292b6cd17423c60ae3be7b27000ed4754931a4ca4897c2f77
SHA5125c70b79fb9a33342cae3e0776cc43916f26a5076e90cf40eed9519b438b9de03510a55b26bffc5fa98ce3c3c46eb7397220a7bd94cf6d193f8bd05c33c2800a2