Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:26
Static task
static1
Behavioral task
behavioral1
Sample
3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exe
Resource
win10v2004-20241007-en
General
-
Target
3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exe
-
Size
690KB
-
MD5
b7e0f215efae4921857afd8bfeddb797
-
SHA1
0d27b0c1358676e28b09fdfc62abd52ae8bd676e
-
SHA256
3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2
-
SHA512
7ba2597c31e69f1a38ca3c3b88842b89907a907ddd56bc92eed12d73c53df3b8f8fd153163245e78f242766386a2c4ddea48be42e5f82c9c6678a9f67428822e
-
SSDEEP
12288:Py90rN+EA34KXcBjc1L9vf1WwSHK2bG7ZJeBU0ArH2/mc+5alwJnF:Pyzp3sKzcwiK2bGdJegz2/x+5alwJnF
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4120-19-0x0000000002240000-0x000000000225A000-memory.dmp healer behavioral1/memory/4120-21-0x00000000024C0000-0x00000000024D8000-memory.dmp healer behavioral1/memory/4120-31-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-49-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-47-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-45-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-43-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-41-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-39-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-37-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-35-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-33-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-29-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-25-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-22-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-27-0x00000000024C0000-0x00000000024D3000-memory.dmp healer behavioral1/memory/4120-23-0x00000000024C0000-0x00000000024D3000-memory.dmp healer -
Healer family
-
Processes:
27595826.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 27595826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 27595826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 27595826.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 27595826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 27595826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 27595826.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2028-61-0x0000000002570000-0x00000000025AC000-memory.dmp family_redline behavioral1/memory/2028-62-0x0000000005010000-0x000000000504A000-memory.dmp family_redline behavioral1/memory/2028-72-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-74-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-96-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-94-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-92-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-90-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-88-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-86-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-84-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-80-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-78-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-77-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-70-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-68-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-82-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-66-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-64-0x0000000005010000-0x0000000005045000-memory.dmp family_redline behavioral1/memory/2028-63-0x0000000005010000-0x0000000005045000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
un030888.exe27595826.exerk120279.exepid process 2964 un030888.exe 4120 27595826.exe 2028 rk120279.exe -
Processes:
27595826.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 27595826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 27595826.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exeun030888.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un030888.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2200 4120 WerFault.exe 27595826.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exeun030888.exe27595826.exerk120279.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un030888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27595826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rk120279.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
27595826.exepid process 4120 27595826.exe 4120 27595826.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
27595826.exerk120279.exedescription pid process Token: SeDebugPrivilege 4120 27595826.exe Token: SeDebugPrivilege 2028 rk120279.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exeun030888.exedescription pid process target process PID 5056 wrote to memory of 2964 5056 3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exe un030888.exe PID 5056 wrote to memory of 2964 5056 3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exe un030888.exe PID 5056 wrote to memory of 2964 5056 3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exe un030888.exe PID 2964 wrote to memory of 4120 2964 un030888.exe 27595826.exe PID 2964 wrote to memory of 4120 2964 un030888.exe 27595826.exe PID 2964 wrote to memory of 4120 2964 un030888.exe 27595826.exe PID 2964 wrote to memory of 2028 2964 un030888.exe rk120279.exe PID 2964 wrote to memory of 2028 2964 un030888.exe rk120279.exe PID 2964 wrote to memory of 2028 2964 un030888.exe rk120279.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exe"C:\Users\Admin\AppData\Local\Temp\3b2a70ab057a89e4fa4c8980396e0937e8f3cc4410bf3502525d1191621e5fd2.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un030888.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un030888.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\27595826.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\27595826.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 10804⤵
- Program crash
PID:2200
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk120279.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk120279.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4120 -ip 41201⤵PID:4180
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD50f4dd48acadf2f2391bd745f8c8dfb14
SHA1d9e89bfe68b28e16761e8d58d95f2a4b4ae78099
SHA2564d1411d5010058c11e8e8946bad50f09c1b6049c5435da37c93dbec9d31e92a1
SHA51221ea49ca69245df1efb51c9dc4469f055c63cc564278813e3bfb64ba7414d0c764b170ed50f47df4959e3ae5cf5989d208cdc680a581518376103ef689badcbf
-
Filesize
259KB
MD53110d4c6bf11dcbeef7a36a88f1cfd3e
SHA1f7251d622325fdc111935b70e8cf1cfd8d205e2d
SHA256e8cbe6567a82a01eb655b67de13c097370d80b914787534cb29aa0cadf7b7e36
SHA512684ed7d3fb7b9c5d9dca3046b53ff30cc0e7b564448701d12999189741d8c6d1e096343348b01e36f4d6b28203104b625ea2bae65297c40e7102d335166105bd
-
Filesize
341KB
MD5c315e62f0d56a768317b910cbbdc2c37
SHA12c065e7e546ec7ab9d694c3b823e66282a45ef02
SHA256d18c53ded34a0926facf855b03260a1e1abe3efe3df9abef7d20f295ed7f1a0e
SHA512a2b1096c6e005bd171ddfa0c0366455ac9a7f8ca9044b28de317712048bfd8f13919832a4a8083fb90b07904ca9f1528ddaf67e0cb77915b040fadc7bde00eda