Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:42
Static task
static1
Behavioral task
behavioral1
Sample
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe
Resource
win10v2004-20241007-en
General
-
Target
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe
-
Size
1.2MB
-
MD5
e17df373234ce97c9e074acbac058795
-
SHA1
54ee6053bd686cde7a12438f86a0c57c7e33f896
-
SHA256
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190
-
SHA512
4f711d3048f3c8276a861627c473ae8786fd2b39f8254905396f5eebdbf331ec361412a30d8cc43f310c5e897b322dc3e0742c400e7b02b95b807033dc2733b4
-
SSDEEP
24576:CO/ma41pNBrquMHuDpKqJUd5xYsLo11YdH/tFrQhldU8HJVYx+dblqaWSLO:COXedEODpKqJGYsLMutFEIx257
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral2/memory/5028-28-0x0000000002630000-0x000000000264A000-memory.dmp healer behavioral2/memory/5028-30-0x0000000004DB0000-0x0000000004DC8000-memory.dmp healer behavioral2/memory/5028-31-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-56-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-54-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-52-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-50-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-48-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-46-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-44-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-42-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-58-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-40-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-38-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-36-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-34-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer behavioral2/memory/5028-32-0x0000000004DB0000-0x0000000004DC2000-memory.dmp healer -
Healer family
-
Processes:
122174453.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 122174453.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 122174453.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral2/memory/2028-71-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral2/memory/2028-72-0x0000000005450000-0x000000000548A000-memory.dmp family_redline behavioral2/memory/2028-88-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-78-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-76-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-74-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-73-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-102-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-106-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-104-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-100-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-98-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-96-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-94-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-92-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-90-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-86-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-84-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-82-0x0000000005450000-0x0000000005485000-memory.dmp family_redline behavioral2/memory/2028-80-0x0000000005450000-0x0000000005485000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
Processes:
zB017841.exeTM820372.exe122174453.exe200793949.exepid process 2608 zB017841.exe 4332 TM820372.exe 5028 122174453.exe 2028 200793949.exe -
Processes:
122174453.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 122174453.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 122174453.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exezB017841.exeTM820372.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zB017841.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" TM820372.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3288 5028 WerFault.exe 122174453.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
122174453.exe200793949.exe485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exezB017841.exeTM820372.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 122174453.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200793949.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zB017841.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TM820372.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
122174453.exepid process 5028 122174453.exe 5028 122174453.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
122174453.exe200793949.exedescription pid process Token: SeDebugPrivilege 5028 122174453.exe Token: SeDebugPrivilege 2028 200793949.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exezB017841.exeTM820372.exedescription pid process target process PID 1996 wrote to memory of 2608 1996 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 1996 wrote to memory of 2608 1996 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 1996 wrote to memory of 2608 1996 485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe zB017841.exe PID 2608 wrote to memory of 4332 2608 zB017841.exe TM820372.exe PID 2608 wrote to memory of 4332 2608 zB017841.exe TM820372.exe PID 2608 wrote to memory of 4332 2608 zB017841.exe TM820372.exe PID 4332 wrote to memory of 5028 4332 TM820372.exe 122174453.exe PID 4332 wrote to memory of 5028 4332 TM820372.exe 122174453.exe PID 4332 wrote to memory of 5028 4332 TM820372.exe 122174453.exe PID 4332 wrote to memory of 2028 4332 TM820372.exe 200793949.exe PID 4332 wrote to memory of 2028 4332 TM820372.exe 200793949.exe PID 4332 wrote to memory of 2028 4332 TM820372.exe 200793949.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe"C:\Users\Admin\AppData\Local\Temp\485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 10805⤵
- Program crash
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5028 -ip 50281⤵PID:2832
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
763KB
MD5f29d111c772c23c3f519a3a2fc3f08b6
SHA1268dc2b2e4f513d4413fad9368bc4e5d373e81eb
SHA2568051db68eba1bfc0d5b55749ddf5280b7070568597253ac8ea0e733184e0847e
SHA512f8a8524eb76e1a8e59c3d88b47f958c9f18b352cab81964bf899daff2bf363f56d14e87f3fde0e93a59ce721f3308cb036cac6b482a97227d5811f35f4818c8b
-
Filesize
592KB
MD50334faee3c8f458beda101583d670322
SHA1431c0120f423c32af37a40b2b03bf4ff2831efcd
SHA25666fbb89f1429d0fd5bb215cd30a3181c59dcc6553558b79367fc6d217f1f4ddb
SHA51280a4f2944ceb2962587b30aa258c257ce5fb5347d7e69ae6dfa0921a11086f1064b2421e9d46802852b596b412785935c7ad7639701ba8a0b94f7c27a8be0506
-
Filesize
377KB
MD583f564c1ed3c578458a63a80a09e3133
SHA1f85f3afbdf8ef9240e9d62d663202e52649742de
SHA256c42d6dfe8ce27758b60ffab1d4111283fa33d0d0616b47ceacb9008470011ed0
SHA51217ca918909711c5d6c0b82844e9f34c2d1f174463ad6dd570e4fb86726917872f513fe8b19dc5e36adbbb0fe4fb911c6e22d3d7459a91a5e5befa10eeb4f12ef
-
Filesize
459KB
MD5573ebefdb8312b08d981837af4379aa5
SHA1c4c2f5b56ed38c2bff5d35546fd9f269825f9e78
SHA256d499c5d2fbdc354790c269b27ab6c1be31368c93f386053415cb5877e47694e4
SHA51252d3014f63ad1b3c571a9df6a61a66f107c4dfc96d13c34d129907527dc29b03854a7dcf41295aad696692f430348b0109035026f24f25dfc3c03ecc41f0236a