Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:24
Static task
static1
Behavioral task
behavioral1
Sample
e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exe
Resource
win10v2004-20241007-en
General
-
Target
e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exe
-
Size
704KB
-
MD5
a0f2812b3d31e1b5f188d0e9d21d3ab2
-
SHA1
9bbd00ba7e557d8c3c3915f2b4f16276695a4843
-
SHA256
e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93
-
SHA512
89e51ae6c9f253294bab26accbfb4fa58eb3437ee5d921d7d4dd2a6dd92a89fcd345015ba4a56296c4d9a85a0e0dbbdb0d22dc6a45f828cdd114a35d17a3b37e
-
SSDEEP
12288:hy90miH8tFHcsXxXICFk085EfCymad0ipLFSObixbJqbCWi+LlATBge:hy2H8TjzJTfYKFtbixbJqm+LeBge
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3676-18-0x00000000048C0000-0x00000000048DA000-memory.dmp healer behavioral1/memory/3676-20-0x0000000007290000-0x00000000072A8000-memory.dmp healer behavioral1/memory/3676-24-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-46-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-45-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-42-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-40-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-38-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-36-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-34-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-32-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-30-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-26-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-22-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-48-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-21-0x0000000007290000-0x00000000072A2000-memory.dmp healer behavioral1/memory/3676-28-0x0000000007290000-0x00000000072A2000-memory.dmp healer -
Healer family
-
Processes:
pr120979.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr120979.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr120979.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr120979.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr120979.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr120979.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr120979.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2328-60-0x0000000007130000-0x000000000716C000-memory.dmp family_redline behavioral1/memory/2328-61-0x0000000007760000-0x000000000779A000-memory.dmp family_redline behavioral1/memory/2328-65-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-63-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-62-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-83-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-95-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-93-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-91-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-89-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-87-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-81-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-79-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-77-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-76-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-73-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-72-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-69-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-67-0x0000000007760000-0x0000000007795000-memory.dmp family_redline behavioral1/memory/2328-85-0x0000000007760000-0x0000000007795000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
un711587.exepr120979.exequ399564.exepid process 1416 un711587.exe 3676 pr120979.exe 2328 qu399564.exe -
Processes:
pr120979.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr120979.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr120979.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exeun711587.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un711587.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1160 3676 WerFault.exe pr120979.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exeun711587.exepr120979.exequ399564.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un711587.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pr120979.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu399564.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pr120979.exepid process 3676 pr120979.exe 3676 pr120979.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pr120979.exequ399564.exedescription pid process Token: SeDebugPrivilege 3676 pr120979.exe Token: SeDebugPrivilege 2328 qu399564.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exeun711587.exedescription pid process target process PID 4460 wrote to memory of 1416 4460 e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exe un711587.exe PID 4460 wrote to memory of 1416 4460 e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exe un711587.exe PID 4460 wrote to memory of 1416 4460 e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exe un711587.exe PID 1416 wrote to memory of 3676 1416 un711587.exe pr120979.exe PID 1416 wrote to memory of 3676 1416 un711587.exe pr120979.exe PID 1416 wrote to memory of 3676 1416 un711587.exe pr120979.exe PID 1416 wrote to memory of 2328 1416 un711587.exe qu399564.exe PID 1416 wrote to memory of 2328 1416 un711587.exe qu399564.exe PID 1416 wrote to memory of 2328 1416 un711587.exe qu399564.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exe"C:\Users\Admin\AppData\Local\Temp\e179dfadfd9157da384378be5dc3bf01d74a911d61c58a40236fa52b6224cc93.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un711587.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un711587.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr120979.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr120979.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 10764⤵
- Program crash
PID:1160
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu399564.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu399564.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3676 -ip 36761⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550KB
MD5206738f7486eeb1bcf4b07caa87bc19f
SHA1d02b88c5c3fcc6f22b50b76027b081295f7a94bf
SHA2569b9ca4039695995f9e330825598c7889901e058a40d91129d2388d130a387bfc
SHA5120f7c273aaf6ee9d817bd4b949bd59139298c5f3423fa068fdd99a04042dae30116f9d833647555bb5a2536842394c99ea0259a7550bbedacd5bf3d229a17cdbe
-
Filesize
286KB
MD5df30b4b215f77404bbe78e4b3bd4479b
SHA1b3c1ba6c8697a5f846a1f991b9c532cf41d8192f
SHA256547b13fd8f846b6991444738b47d8a7c1b6ae03fefa5b996a432b6ad083a487c
SHA512093915921253b9deeacc2114cf6fc57ec05c1167ff18cabb77375c4d49b4bd4737adffd765ae7af5f6c96c73843ae47d58e93f3e825c52b3d86e4d440e3e8cc8
-
Filesize
368KB
MD52a9e2c4b220ad8e9c633d4be2241da97
SHA121aaca0e70e6417c03cd377e3f253c97751280f8
SHA2560b345ad50dd443a48c65401ad3ffd27660b77060571198a4f3f9f0ae37f81428
SHA51227ec38edd07d5a113fca25292c2f1315663df2e0799ee9e330b4b03c87554c71733a8dade6eb09d2241c816ed850ae8531fa18e435f8f4403d69df630e173d5d