Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:24
Static task
static1
Behavioral task
behavioral1
Sample
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe
Resource
win10v2004-20241007-en
General
-
Target
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe
-
Size
1.0MB
-
MD5
a8bb23d16981699d62f05f7fd8e729c6
-
SHA1
0d987d05d1bd728ff18f1d10d12e9fe49dd3caf4
-
SHA256
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce
-
SHA512
995314d91cc35532aaefa408c4cfb6285834ef860420f523c3994f0648914bebc19de813305d2cb24c2fc924690f3ba0e88960089f40e4fd687ea11c5275b23f
-
SSDEEP
24576:DyiC7piXFKHIyBcefvm1cVm84qY8bX+00W:WiCVsF49YH8Q8j
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it163667.exe healer behavioral1/memory/3548-22-0x0000000000480000-0x000000000048A000-memory.dmp healer -
Healer family
-
Processes:
it163667.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it163667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it163667.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it163667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it163667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it163667.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it163667.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/3620-2174-0x0000000005760000-0x0000000005792000-memory.dmp family_redline C:\Windows\Temp\1.exe family_redline behavioral1/memory/5868-2187-0x0000000000AF0000-0x0000000000B1E000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp201344.exe family_redline behavioral1/memory/5524-2198-0x0000000000C80000-0x0000000000CB0000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
jr379718.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation jr379718.exe -
Executes dropped EXE 6 IoCs
Processes:
ziHK7490.exezigy9766.exeit163667.exejr379718.exe1.exekp201344.exepid process 3508 ziHK7490.exe 2248 zigy9766.exe 3548 it163667.exe 3620 jr379718.exe 5868 1.exe 5524 kp201344.exe -
Processes:
it163667.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it163667.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exeziHK7490.exezigy9766.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziHK7490.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zigy9766.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3440 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4136 3620 WerFault.exe jr379718.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1.exekp201344.exe29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exeziHK7490.exezigy9766.exejr379718.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kp201344.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ziHK7490.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zigy9766.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jr379718.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
it163667.exepid process 3548 it163667.exe 3548 it163667.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
it163667.exejr379718.exedescription pid process Token: SeDebugPrivilege 3548 it163667.exe Token: SeDebugPrivilege 3620 jr379718.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exeziHK7490.exezigy9766.exejr379718.exedescription pid process target process PID 2528 wrote to memory of 3508 2528 29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe ziHK7490.exe PID 2528 wrote to memory of 3508 2528 29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe ziHK7490.exe PID 2528 wrote to memory of 3508 2528 29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe ziHK7490.exe PID 3508 wrote to memory of 2248 3508 ziHK7490.exe zigy9766.exe PID 3508 wrote to memory of 2248 3508 ziHK7490.exe zigy9766.exe PID 3508 wrote to memory of 2248 3508 ziHK7490.exe zigy9766.exe PID 2248 wrote to memory of 3548 2248 zigy9766.exe it163667.exe PID 2248 wrote to memory of 3548 2248 zigy9766.exe it163667.exe PID 2248 wrote to memory of 3620 2248 zigy9766.exe jr379718.exe PID 2248 wrote to memory of 3620 2248 zigy9766.exe jr379718.exe PID 2248 wrote to memory of 3620 2248 zigy9766.exe jr379718.exe PID 3620 wrote to memory of 5868 3620 jr379718.exe 1.exe PID 3620 wrote to memory of 5868 3620 jr379718.exe 1.exe PID 3620 wrote to memory of 5868 3620 jr379718.exe 1.exe PID 3508 wrote to memory of 5524 3508 ziHK7490.exe kp201344.exe PID 3508 wrote to memory of 5524 3508 ziHK7490.exe kp201344.exe PID 3508 wrote to memory of 5524 3508 ziHK7490.exe kp201344.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe"C:\Users\Admin\AppData\Local\Temp\29a1bbd0959ace94d0d4070f7b49f5c96091fd408aa9be087de7a6e4f9fe0dce.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHK7490.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHK7490.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zigy9766.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zigy9766.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it163667.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it163667.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr379718.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr379718.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 13885⤵
- Program crash
PID:4136
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp201344.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp201344.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5524
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3620 -ip 36201⤵PID:5212
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3440
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
723KB
MD58bdb62a37f5a2093f6210898ee69585c
SHA1176e003b51e2c3003206513baef0e2bf7b13c94e
SHA2568aca01db3b6c37d3d92a3649662779146d4c3e92e75c998980291ed566833205
SHA5121b9e583932d76cd22046357ddc983494900dc5161402feb6f5a5cd6ca446dcbdb8dde28cbc888fc8047bcaea38007a235431755614347aa0ef0a45c0354156f7
-
Filesize
168KB
MD5c52ebada00a59ec1f651a0e9fbcef2eb
SHA1e1941278df76616f1ca3202ef2a9f99d2592d52f
SHA25635d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e
SHA5126b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2
-
Filesize
569KB
MD5b49219546b78c8b7c3474e967eb67b89
SHA1c508e6f4b429596882e47b5dc71b23e436236a94
SHA256751c83cad3905fcb2f0fcaf4b2a475459536b476b17a1bad0decf8872e81185f
SHA5120858066d5e46efc7982d0d96aa02b56089161867e3f6f27d58e129c249eb3eb627d37ee3c95f26dc3e3e3ff3991f64b4be1bda1fceef3b49019c72bf9c4c6710
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
588KB
MD505fd9a1eeddc8acb66ff5fb750399895
SHA19d73fc50ccc4aa3cd9b7319d78b7e5efe9a6787b
SHA256b789a9bed16f6b2aa46873929b7cce7d0f0cdcc4ae19a0f6919d06d4799860cb
SHA512570ba63d58058819a0ef1ab354970725238a5feffe4bbe6b74c0caf2fad74f3f37f2778ff2f8c8f9f347a1febac2d10cf5c0ec0c55dd2d35c4e4b3a359077fef
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1