Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe
Resource
win10v2004-20241007-en
General
-
Target
05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe
-
Size
814KB
-
MD5
b8b36d2ab6bbfcc97455a0e882a16205
-
SHA1
84cf90a3d08778ee3c1f6e033288a5dd6e074369
-
SHA256
05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4
-
SHA512
931277ff4dff2daf364ea308033a70981d4b2f1943ee84d07a5d2cdd00410b4e97ec49eae32cb029fc2c578aae255dd3db9ab012f890f07da12e6b7513f92a44
-
SSDEEP
12288:uMrCy90HJJ9LCnTo9ueUz15rsHJpNU/q/2cz5hlI1wxy3DQ8nqxlb32zrIe3:oyqJ+9v+q/qwM6D1E92373
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
diza
77.91.124.145:4125
-
auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4472-19-0x00000000026B0000-0x00000000026CA000-memory.dmp healer behavioral1/memory/4472-21-0x0000000005370000-0x0000000005388000-memory.dmp healer behavioral1/memory/4472-49-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-47-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-45-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-43-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-41-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-39-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-37-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-35-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-33-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-31-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-29-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-27-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-25-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-23-0x0000000005370000-0x0000000005382000-memory.dmp healer behavioral1/memory/4472-22-0x0000000005370000-0x0000000005382000-memory.dmp healer -
Healer family
-
Processes:
pro5354.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5354.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5354.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5354.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5354.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro5354.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5354.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2780-2142-0x0000000002910000-0x0000000002942000-memory.dmp family_redline C:\Windows\Temp\1.exe family_redline behavioral1/memory/544-2155-0x0000000000520000-0x0000000000550000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si080649.exe family_redline behavioral1/memory/4308-2166-0x0000000000690000-0x00000000006BE000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
qu7659.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation qu7659.exe -
Executes dropped EXE 5 IoCs
Processes:
un853966.exepro5354.exequ7659.exe1.exesi080649.exepid process 2576 un853966.exe 4472 pro5354.exe 2780 qu7659.exe 544 1.exe 4308 si080649.exe -
Processes:
pro5354.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5354.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5354.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exeun853966.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un853966.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4816 4472 WerFault.exe pro5354.exe 3448 2780 WerFault.exe qu7659.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exeun853966.exepro5354.exequ7659.exe1.exesi080649.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un853966.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro5354.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu7659.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language si080649.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pro5354.exepid process 4472 pro5354.exe 4472 pro5354.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pro5354.exequ7659.exedescription pid process Token: SeDebugPrivilege 4472 pro5354.exe Token: SeDebugPrivilege 2780 qu7659.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exeun853966.exequ7659.exedescription pid process target process PID 3908 wrote to memory of 2576 3908 05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe un853966.exe PID 3908 wrote to memory of 2576 3908 05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe un853966.exe PID 3908 wrote to memory of 2576 3908 05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe un853966.exe PID 2576 wrote to memory of 4472 2576 un853966.exe pro5354.exe PID 2576 wrote to memory of 4472 2576 un853966.exe pro5354.exe PID 2576 wrote to memory of 4472 2576 un853966.exe pro5354.exe PID 2576 wrote to memory of 2780 2576 un853966.exe qu7659.exe PID 2576 wrote to memory of 2780 2576 un853966.exe qu7659.exe PID 2576 wrote to memory of 2780 2576 un853966.exe qu7659.exe PID 2780 wrote to memory of 544 2780 qu7659.exe 1.exe PID 2780 wrote to memory of 544 2780 qu7659.exe 1.exe PID 2780 wrote to memory of 544 2780 qu7659.exe 1.exe PID 3908 wrote to memory of 4308 3908 05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe si080649.exe PID 3908 wrote to memory of 4308 3908 05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe si080649.exe PID 3908 wrote to memory of 4308 3908 05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe si080649.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe"C:\Users\Admin\AppData\Local\Temp\05e66a620e44506d2df5b284b788b5f9e4644e26ae7081bdf9601526e7fa91f4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un853966.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un853966.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5354.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5354.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 10844⤵
- Program crash
PID:4816
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7659.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7659.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 14964⤵
- Program crash
PID:3448
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si080649.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si080649.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4472 -ip 44721⤵PID:4972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2780 -ip 27801⤵PID:2356
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5a0808fea8726f554c08c5e7beba8d717
SHA1ef7a40efbedd5ac7c503f28ae4ce963ce9945299
SHA25647cd665984bb5db807eeeaa079d8e47d54c9ef6f75139470c0c96dd77e1c8f2a
SHA5126427c836d45d3512c7004861e3d6f0d7fd5a4cb076d697e593bcc2484fc505040bc0bdd238d1e574a41d712670a46f710b0ba71ca1fd1ac444f741e8c7cbab5e
-
Filesize
660KB
MD57ffa2e0fcfa8ac5925e99e4fbd69de4c
SHA1b42cf3a8ae69fdeec9950132b501cc1732212f99
SHA25665919825989d15c3dd3b0fc840c54f169403a0888a423a5d3b66be8535245aa0
SHA5127b13287f946ccb51495afac7ff87643379e223383bfff7ecac93c8c9f8fdb4f7ca35800b369d50b9ee064aead651407e5e32569e6c938ab8cf0bf68b831064e2
-
Filesize
312KB
MD52cbf7c2b938fabebf5b8d8014e5ebeae
SHA1b01275ba04820979705ed5a05db1899046abea99
SHA256c384ef495be12dc37ee38da2038f2ee453c6562a579737e761bda0b847d3f638
SHA5120ab43d063315cd782ecdf0719bb23a66ae54faa6bade9a80b99f7687cdf7d90a15c62865fadf2ae425714add7dc79f04a8afb0943b4b9cf3eaa443234f8861ec
-
Filesize
495KB
MD56162427580ba1a43bfec0f4115b06e37
SHA18c4b966aa63a0c58769358317feb9aaf65e834a0
SHA25652957a67f65874ce479f16faa45568bb31fbe627ad293ad45e74dd221b546e92
SHA51201ca11c5cc4e73fa83a77155493ca5a2ea2446577ec6ebd64b230b6f90b4ff418520ceb2fa1b108e17e21168b10ce7d43853fdbbf2ed0a41e3581936ee90339d
-
Filesize
168KB
MD51073b2e7f778788852d3f7bb79929882
SHA17f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA51290cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0