Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exe
Resource
win10v2004-20241007-en
General
-
Target
0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exe
-
Size
562KB
-
MD5
6461965a4cf476078b1f0e645b08df10
-
SHA1
ed665d9d0b4d9175ae88d321788ca5424e5f2d24
-
SHA256
0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1
-
SHA512
3f816ccfe324da4a28e7079e9081143cc17336b55a2fa63ca30ccc865be46c57c7a311d0f7ba2d0543ab21924d1147a6c98b3525c0f219565f5e02919d7eefde
-
SSDEEP
12288:RMr+y90H2D56be7jyeAM1HE9OoFYi/bS83T7SsTlDs2B:byf6yPLHToFYq/Ttae
Malware Config
Extracted
redline
fud
193.233.20.27:4123
-
auth_value
cddc991efd6918ad5321d80dac884b40
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf69Bz34Jo45.exe healer behavioral1/memory/3016-15-0x0000000000530000-0x000000000053A000-memory.dmp healer -
Healer family
-
Processes:
sf69Bz34Jo45.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sf69Bz34Jo45.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sf69Bz34Jo45.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sf69Bz34Jo45.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sf69Bz34Jo45.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sf69Bz34Jo45.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sf69Bz34Jo45.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/4040-22-0x0000000004F30000-0x0000000004F76000-memory.dmp family_redline behavioral1/memory/4040-24-0x0000000007300000-0x0000000007344000-memory.dmp family_redline behavioral1/memory/4040-26-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-25-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-74-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-88-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-86-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-84-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-82-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-80-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-78-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-76-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-72-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-70-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-68-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-66-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-64-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-62-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-60-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-58-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-54-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-52-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-50-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-48-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-46-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-45-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-43-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-40-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-38-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-36-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-34-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-32-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-30-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-56-0x0000000007300000-0x000000000733E000-memory.dmp family_redline behavioral1/memory/4040-28-0x0000000007300000-0x000000000733E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
vhnj1431bx.exesf69Bz34Jo45.exetf11ja61Jj45.exepid process 3660 vhnj1431bx.exe 3016 sf69Bz34Jo45.exe 4040 tf11ja61Jj45.exe -
Processes:
sf69Bz34Jo45.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sf69Bz34Jo45.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exevhnj1431bx.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vhnj1431bx.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exevhnj1431bx.exetf11ja61Jj45.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhnj1431bx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tf11ja61Jj45.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
sf69Bz34Jo45.exepid process 3016 sf69Bz34Jo45.exe 3016 sf69Bz34Jo45.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
sf69Bz34Jo45.exetf11ja61Jj45.exedescription pid process Token: SeDebugPrivilege 3016 sf69Bz34Jo45.exe Token: SeDebugPrivilege 4040 tf11ja61Jj45.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exevhnj1431bx.exedescription pid process target process PID 1544 wrote to memory of 3660 1544 0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exe vhnj1431bx.exe PID 1544 wrote to memory of 3660 1544 0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exe vhnj1431bx.exe PID 1544 wrote to memory of 3660 1544 0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exe vhnj1431bx.exe PID 3660 wrote to memory of 3016 3660 vhnj1431bx.exe sf69Bz34Jo45.exe PID 3660 wrote to memory of 3016 3660 vhnj1431bx.exe sf69Bz34Jo45.exe PID 3660 wrote to memory of 4040 3660 vhnj1431bx.exe tf11ja61Jj45.exe PID 3660 wrote to memory of 4040 3660 vhnj1431bx.exe tf11ja61Jj45.exe PID 3660 wrote to memory of 4040 3660 vhnj1431bx.exe tf11ja61Jj45.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exe"C:\Users\Admin\AppData\Local\Temp\0ece66e785f8a335553d681563dc2cff6e17126fcd2609bb72a8d5a2cb3f79c1.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhnj1431bx.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhnj1431bx.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf69Bz34Jo45.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf69Bz34Jo45.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf11ja61Jj45.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf11ja61Jj45.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418KB
MD5ceee9a9dff2a69c787e10c6eba3894a2
SHA1ff5236df9143aaf4c60583241a0df620a8286f1c
SHA256c8d6e267ee3e231c567220ee828a649054de1b6a2e9c3caee6049f9fc91ed2c2
SHA51286963514d6bbf0fe97ddf2849abb87b0ed6550d55023239922d52d9ccd4211ece080043fa70372dba923af780c0b50a7155603ef97d27ea856d82d3d2f74a8c0
-
Filesize
12KB
MD582b8f09804fb00c9ee2e0b21ec98db13
SHA1940ba73feeafb6ee961ed065de17dbd43f9d8177
SHA2565c18c250f6fb2a1cb9e35ab203a130c2e0b2d72db0150c43698d348558eca81e
SHA512569fd977b772df2f93b926fd6c04c60ea30e58e06717cb88144ded1ed711952506916a1b7b62a5892b9018b78ab7ed1dc42a308ddba1fd8d2371a5231c1f8fbb
-
Filesize
419KB
MD56b48a9a5ca542b20633aff65ae0e882a
SHA1c5e08fe68b82b937492e9686347567a37d606a48
SHA256763b078fafe64dce994f8843a962741a00784eb2adcd8de0a1865f459e454355
SHA51205e452f2b6540bc566b8d3b956c1e1ca8b645be991583374a559bd84fcd13c1ec79526a5b7dfb01369b0120793d1ac6aa4b5b956a5311ac504ed79cd0ea9e2e5