Analysis
-
max time kernel
127s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:45
Static task
static1
Behavioral task
behavioral1
Sample
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe
Resource
win10v2004-20241007-en
General
-
Target
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe
-
Size
809KB
-
MD5
8cfc23acc4b7244de4787364ea539a8b
-
SHA1
80b06e9196e4a70ec69b4dc49b42b805bcef3144
-
SHA256
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77
-
SHA512
8be27c6b49b94fe588c43f2ff0b00d9a29a7bd7224c24a2591af98cf5e1df091caaf0605d9f2f1471f1b228272a5c9647d3b1ac60b0c916edc7864d228dd745c
-
SSDEEP
24576:DymAvW/b1LCDCY7QDGAGEjcJGuvflKOOMG1:WpvsbpdftjKG8fHP
Malware Config
Extracted
redline
dubka
193.233.20.13:4136
-
auth_value
e5a9421183a033f283b2f23139b471f0
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rvQ8467.exe healer behavioral1/memory/5080-22-0x0000000000590000-0x000000000059A000-memory.dmp healer behavioral1/memory/2196-29-0x00000000026B0000-0x00000000026CA000-memory.dmp healer behavioral1/memory/2196-31-0x0000000002710000-0x0000000002728000-memory.dmp healer behavioral1/memory/2196-32-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-35-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-59-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-58-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-56-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-54-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-51-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-50-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-47-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-45-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-43-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-41-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-39-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-37-0x0000000002710000-0x0000000002722000-memory.dmp healer behavioral1/memory/2196-33-0x0000000002710000-0x0000000002722000-memory.dmp healer -
Healer family
-
Processes:
rvQ8467.exesko9405.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rvQ8467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sko9405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rvQ8467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rvQ8467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rvQ8467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rvQ8467.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rvQ8467.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection sko9405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sko9405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sko9405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sko9405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sko9405.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tVL06kH.exe family_redline behavioral1/memory/2324-66-0x0000000000860000-0x0000000000892000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 5 IoCs
Processes:
vzV6999.exevWb5622.exervQ8467.exesko9405.exetVL06kH.exepid process 4088 vzV6999.exe 4136 vWb5622.exe 5080 rvQ8467.exe 2196 sko9405.exe 2324 tVL06kH.exe -
Processes:
rvQ8467.exesko9405.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rvQ8467.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features sko9405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" sko9405.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exevzV6999.exevWb5622.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vzV6999.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" vWb5622.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1624 2196 WerFault.exe sko9405.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
tVL06kH.exe226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exevzV6999.exevWb5622.exesko9405.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tVL06kH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vzV6999.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vWb5622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sko9405.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rvQ8467.exesko9405.exepid process 5080 rvQ8467.exe 5080 rvQ8467.exe 2196 sko9405.exe 2196 sko9405.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rvQ8467.exesko9405.exedescription pid process Token: SeDebugPrivilege 5080 rvQ8467.exe Token: SeDebugPrivilege 2196 sko9405.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exevzV6999.exevWb5622.exedescription pid process target process PID 2184 wrote to memory of 4088 2184 226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe vzV6999.exe PID 2184 wrote to memory of 4088 2184 226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe vzV6999.exe PID 2184 wrote to memory of 4088 2184 226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe vzV6999.exe PID 4088 wrote to memory of 4136 4088 vzV6999.exe vWb5622.exe PID 4088 wrote to memory of 4136 4088 vzV6999.exe vWb5622.exe PID 4088 wrote to memory of 4136 4088 vzV6999.exe vWb5622.exe PID 4136 wrote to memory of 5080 4136 vWb5622.exe rvQ8467.exe PID 4136 wrote to memory of 5080 4136 vWb5622.exe rvQ8467.exe PID 4136 wrote to memory of 2196 4136 vWb5622.exe sko9405.exe PID 4136 wrote to memory of 2196 4136 vWb5622.exe sko9405.exe PID 4136 wrote to memory of 2196 4136 vWb5622.exe sko9405.exe PID 4088 wrote to memory of 2324 4088 vzV6999.exe tVL06kH.exe PID 4088 wrote to memory of 2324 4088 vzV6999.exe tVL06kH.exe PID 4088 wrote to memory of 2324 4088 vzV6999.exe tVL06kH.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe"C:\Users\Admin\AppData\Local\Temp\226825b8769fb15bdfd0271f9b78a7f4d66392f30f16d1ec5b26153900a84e77.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vzV6999.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vzV6999.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vWb5622.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vWb5622.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rvQ8467.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rvQ8467.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sko9405.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sko9405.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 10845⤵
- Program crash
PID:1624
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tVL06kH.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tVL06kH.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2196 -ip 21961⤵PID:1692
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
478KB
MD51a767e2b8134eb8fd13053db34b0e6d0
SHA120a152700c843ff6227ccf14b8ee3ef99f1f615d
SHA256c3375e5c615bd91261d2abef12e51309c471d6e80f195b958d517141b3d95a47
SHA512de42ae0bfb0afd3d4f0a63dae6349b2f11eac4919541e11de0ccfee4390547509d79a4644130839c2ccf6884a1dee6794a4757845eb33ddfe7fc90f1aab79b2a
-
Filesize
175KB
MD5dd0c9e110c68ce1fa5308979ef718f7b
SHA1473deb8069f0841d47b74b7f414dacc6f96eca78
SHA256dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3
SHA51229bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236
-
Filesize
333KB
MD5c74cde5db229624dc5f85cd9737a6511
SHA147851d28d9f399409ae5f2b60dfc611023092698
SHA2561d044ff4723959027c3ef5a0ed47e6144eeb6008760e70ba83d39a19f5f7cb8b
SHA512373c91664bc127fe429c54f0b2d0620cb3a660ad0de08640973fafd191d442ebcf9da448294c3c6dc74c98d27223962f666a29e21c98332a41dc2b731051c2c2
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
235KB
MD5a83f871ff3ff4702c68b94e0ba9ed0da
SHA16a7ceb6521559ec069e0067036d6d2de3a8294b4
SHA256a7804907253a51461b3a23f3f54f59060707f4672c38f9b09d9cbb16b00e8fe8
SHA51291d7e6c48afc6f334338aff3f0253f4593c03ab3d2657aa659fc67fb6288113e97211a89f58dd1c7906f662af14ca9dcd2d76c205ba5c121baf4e21fecfc8f6f