Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 01:42
Static task
static1
Behavioral task
behavioral1
Sample
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe
Resource
win10v2004-20241007-en
General
-
Target
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe
-
Size
1.2MB
-
MD5
e17df373234ce97c9e074acbac058795
-
SHA1
54ee6053bd686cde7a12438f86a0c57c7e33f896
-
SHA256
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190
-
SHA512
4f711d3048f3c8276a861627c473ae8786fd2b39f8254905396f5eebdbf331ec361412a30d8cc43f310c5e897b322dc3e0742c400e7b02b95b807033dc2733b4
-
SSDEEP
24576:CO/ma41pNBrquMHuDpKqJUd5xYsLo11YdH/tFrQhldU8HJVYx+dblqaWSLO:COXedEODpKqJGYsLMutFEIx257
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2280-38-0x0000000000890000-0x00000000008AA000-memory.dmp healer behavioral1/memory/2280-39-0x0000000000BE0000-0x0000000000BF8000-memory.dmp healer behavioral1/memory/2280-45-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-49-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-67-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-65-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-63-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-61-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-59-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-57-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-55-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-51-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-47-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-43-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-41-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-53-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer behavioral1/memory/2280-40-0x0000000000BE0000-0x0000000000BF2000-memory.dmp healer -
Healer family
-
Processes:
122174453.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 122174453.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 122174453.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3012-84-0x0000000004D10000-0x0000000004D4C000-memory.dmp family_redline behavioral1/memory/3012-85-0x0000000004D50000-0x0000000004D8A000-memory.dmp family_redline behavioral1/memory/3012-86-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-87-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-89-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-91-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-93-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-95-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-97-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-101-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-99-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-103-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-105-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-107-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-109-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-111-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-113-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-115-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline behavioral1/memory/3012-117-0x0000000004D50000-0x0000000004D85000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
Processes:
zB017841.exeTM820372.exe122174453.exe200793949.exepid process 2928 zB017841.exe 2496 TM820372.exe 2280 122174453.exe 3012 200793949.exe -
Loads dropped DLL 10 IoCs
Processes:
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exezB017841.exeTM820372.exe122174453.exe200793949.exepid process 2772 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe 2928 zB017841.exe 2928 zB017841.exe 2496 TM820372.exe 2496 TM820372.exe 2496 TM820372.exe 2280 122174453.exe 2496 TM820372.exe 2496 TM820372.exe 3012 200793949.exe -
Processes:
122174453.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 122174453.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exezB017841.exeTM820372.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zB017841.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" TM820372.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exezB017841.exeTM820372.exe122174453.exe200793949.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zB017841.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TM820372.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 122174453.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200793949.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
122174453.exepid process 2280 122174453.exe 2280 122174453.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
122174453.exe200793949.exedescription pid process Token: SeDebugPrivilege 2280 122174453.exe Token: SeDebugPrivilege 3012 200793949.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exezB017841.exeTM820372.exedescription pid process target process PID 2772 wrote to memory of 2928 2772 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 2772 wrote to memory of 2928 2772 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 2772 wrote to memory of 2928 2772 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 2772 wrote to memory of 2928 2772 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 2772 wrote to memory of 2928 2772 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 2772 wrote to memory of 2928 2772 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 2772 wrote to memory of 2928 2772 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 2928 wrote to memory of 2496 2928 zB017841.exe TM820372.exe PID 2928 wrote to memory of 2496 2928 zB017841.exe TM820372.exe PID 2928 wrote to memory of 2496 2928 zB017841.exe TM820372.exe PID 2928 wrote to memory of 2496 2928 zB017841.exe TM820372.exe PID 2928 wrote to memory of 2496 2928 zB017841.exe TM820372.exe PID 2928 wrote to memory of 2496 2928 zB017841.exe TM820372.exe PID 2928 wrote to memory of 2496 2928 zB017841.exe TM820372.exe PID 2496 wrote to memory of 2280 2496 TM820372.exe 122174453.exe PID 2496 wrote to memory of 2280 2496 TM820372.exe 122174453.exe PID 2496 wrote to memory of 2280 2496 TM820372.exe 122174453.exe PID 2496 wrote to memory of 2280 2496 TM820372.exe 122174453.exe PID 2496 wrote to memory of 2280 2496 TM820372.exe 122174453.exe PID 2496 wrote to memory of 2280 2496 TM820372.exe 122174453.exe PID 2496 wrote to memory of 2280 2496 TM820372.exe 122174453.exe PID 2496 wrote to memory of 3012 2496 TM820372.exe 200793949.exe PID 2496 wrote to memory of 3012 2496 TM820372.exe 200793949.exe PID 2496 wrote to memory of 3012 2496 TM820372.exe 200793949.exe PID 2496 wrote to memory of 3012 2496 TM820372.exe 200793949.exe PID 2496 wrote to memory of 3012 2496 TM820372.exe 200793949.exe PID 2496 wrote to memory of 3012 2496 TM820372.exe 200793949.exe PID 2496 wrote to memory of 3012 2496 TM820372.exe 200793949.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe"C:\Users\Admin\AppData\Local\Temp\485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3012
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
763KB
MD5f29d111c772c23c3f519a3a2fc3f08b6
SHA1268dc2b2e4f513d4413fad9368bc4e5d373e81eb
SHA2568051db68eba1bfc0d5b55749ddf5280b7070568597253ac8ea0e733184e0847e
SHA512f8a8524eb76e1a8e59c3d88b47f958c9f18b352cab81964bf899daff2bf363f56d14e87f3fde0e93a59ce721f3308cb036cac6b482a97227d5811f35f4818c8b
-
Filesize
592KB
MD50334faee3c8f458beda101583d670322
SHA1431c0120f423c32af37a40b2b03bf4ff2831efcd
SHA25666fbb89f1429d0fd5bb215cd30a3181c59dcc6553558b79367fc6d217f1f4ddb
SHA51280a4f2944ceb2962587b30aa258c257ce5fb5347d7e69ae6dfa0921a11086f1064b2421e9d46802852b596b412785935c7ad7639701ba8a0b94f7c27a8be0506
-
Filesize
377KB
MD583f564c1ed3c578458a63a80a09e3133
SHA1f85f3afbdf8ef9240e9d62d663202e52649742de
SHA256c42d6dfe8ce27758b60ffab1d4111283fa33d0d0616b47ceacb9008470011ed0
SHA51217ca918909711c5d6c0b82844e9f34c2d1f174463ad6dd570e4fb86726917872f513fe8b19dc5e36adbbb0fe4fb911c6e22d3d7459a91a5e5befa10eeb4f12ef
-
Filesize
459KB
MD5573ebefdb8312b08d981837af4379aa5
SHA1c4c2f5b56ed38c2bff5d35546fd9f269825f9e78
SHA256d499c5d2fbdc354790c269b27ab6c1be31368c93f386053415cb5877e47694e4
SHA51252d3014f63ad1b3c571a9df6a61a66f107c4dfc96d13c34d129907527dc29b03854a7dcf41295aad696692f430348b0109035026f24f25dfc3c03ecc41f0236a