Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:46
Static task
static1
Behavioral task
behavioral1
Sample
c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe
Resource
win10v2004-20241007-en
General
-
Target
c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe
-
Size
929KB
-
MD5
3bc0b157faca902ad1fd5fa473948212
-
SHA1
ba954952b47c7a2f04a0b5f38b4419a6c8d32590
-
SHA256
c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937
-
SHA512
3e7abe00f14cba2428ec7f39c631c71d7505c00ac48e3ad3d07bfe6e8049eb54ee562b251b402a37629147358b0ce34130e28e85b7073bd5fa470691df2dc04e
-
SSDEEP
24576:By1d8oA0/Zlt7ejxXdBO6HvDVkaaAbBYYIhGmFBHSKRT:01dBvntqjxtTHLVkaaIBXIsmFBHTR
Malware Config
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-2149-0x0000000005430000-0x000000000543A000-memory.dmp healer C:\Windows\Temp\1.exe healer behavioral1/memory/6972-2163-0x0000000000120000-0x000000000012A000-memory.dmp healer -
Healer family
-
Processes:
1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/7024-4317-0x0000000002C10000-0x0000000002C42000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr567898.exe family_redline behavioral1/memory/6804-4324-0x0000000000C60000-0x0000000000C90000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
97574276.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 97574276.exe -
Executes dropped EXE 5 IoCs
Processes:
st548873.exe97574276.exe1.exekp111200.exelr567898.exepid process 3516 st548873.exe 1632 97574276.exe 6972 1.exe 7024 kp111200.exe 6804 lr567898.exe -
Processes:
1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exest548873.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st548873.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 6396 7024 WerFault.exe kp111200.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exest548873.exe97574276.exekp111200.exelr567898.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language st548873.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97574276.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kp111200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lr567898.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
1.exepid process 6972 1.exe 6972 1.exe 6972 1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
97574276.exekp111200.exe1.exedescription pid process Token: SeDebugPrivilege 1632 97574276.exe Token: SeDebugPrivilege 7024 kp111200.exe Token: SeDebugPrivilege 6972 1.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exest548873.exe97574276.exedescription pid process target process PID 4424 wrote to memory of 3516 4424 c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe st548873.exe PID 4424 wrote to memory of 3516 4424 c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe st548873.exe PID 4424 wrote to memory of 3516 4424 c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe st548873.exe PID 3516 wrote to memory of 1632 3516 st548873.exe 97574276.exe PID 3516 wrote to memory of 1632 3516 st548873.exe 97574276.exe PID 3516 wrote to memory of 1632 3516 st548873.exe 97574276.exe PID 1632 wrote to memory of 6972 1632 97574276.exe 1.exe PID 1632 wrote to memory of 6972 1632 97574276.exe 1.exe PID 3516 wrote to memory of 7024 3516 st548873.exe kp111200.exe PID 3516 wrote to memory of 7024 3516 st548873.exe kp111200.exe PID 3516 wrote to memory of 7024 3516 st548873.exe kp111200.exe PID 4424 wrote to memory of 6804 4424 c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe lr567898.exe PID 4424 wrote to memory of 6804 4424 c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe lr567898.exe PID 4424 wrote to memory of 6804 4424 c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe lr567898.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe"C:\Users\Admin\AppData\Local\Temp\c5cc7513c58cf73b02d380c672bf53b0195ac90488a78a72cc3633fc7fb49937.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st548873.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st548873.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\97574276.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\97574276.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6972
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp111200.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp111200.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:7024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 12844⤵
- Program crash
PID:6396
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr567898.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr567898.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 7024 -ip 70241⤵PID:6236
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD516cf18c8ef1d4be89b36e27c8fb88e9d
SHA17811ba84f75a1adc6d995c2c1121ec996d1cc003
SHA256116156cc3af0bf4d81d9b2fba83c569cf9f4c9055b9c9cd5731538de036417e8
SHA5124cb9e29db63d28c802c7c1799fd53e00b5facdc0b63d08b76d619c7a9be6cc06f11c0d435ad035bf3f9c3c96687e03e5157ae2ce7494a621c0762bc8083d9fbd
-
Filesize
776KB
MD55e8be79578e41649b3346f8e33b1f48d
SHA1c100584696cd10052cf52f270a25bfc88d00a52c
SHA256416e9e12bf9b3088e485adba1194386c0df0b6dabf624dfc65f1118939527792
SHA5123365a9dd87ffbbb92f4ca939c11d07ce0475dafc9d3a8dc95becf71dd5c2b3addba86ce75c501df080f9360bd7d263371b770a6b49620da2f5a1d77dbb360cfd
-
Filesize
299KB
MD5d92a53e40015715f91414dfe5283b5fb
SHA1906eb0b4b6ad616e2886bfc7b0ca32fe6985fc79
SHA25661fdaa45518c4904efd4bdfce595622d529fbc9945f51df63d3d6ea15a13ce7f
SHA512fd5deacb38eec724b59b907ec40704a742b2f8ccd800108ef5f38d55e2a0a5c89cf7ff1672f5431bb0fc8e6895fa54d557de336a2642df1ab735b01d7014670d
-
Filesize
569KB
MD56f5085bb5b5e08ac7950f59377262013
SHA1c441e26a52a25db095658823a674e4f3d7f56718
SHA2564799bcf1506abf584708ec22562d086d0044d750207b3b383301eac74162a4cd
SHA51273a6adf688cb7da5d5f54554a9250a155b4780ce150820fa64f6d400a4b7564cfd2826e3a2d42ebed67118023f2528134caa9a4963b000d04541a10f90ce8da3
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91