Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:26
Static task
static1
Behavioral task
behavioral1
Sample
9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exe
Resource
win10v2004-20241007-en
General
-
Target
9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exe
-
Size
530KB
-
MD5
848e24af7754024ea6840b51234e74d4
-
SHA1
e6fa40ac8fe9d34d14926a29b5c56385e9bd0967
-
SHA256
9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e
-
SHA512
acbcbaa93b49360895ac3b254aae4e6353b1f533f2fe4753083181b26c1939f78e0d413ce554913d952c58bca72f5788f7a87c9ff8fce820333a79ec59a75370
-
SSDEEP
12288:dMrAy90E66xI0SLwYh6KWQIh9tY/0Ff5KXa/xWZPzQPzW43S96rN:Rye6xI0/Ylmh9tUsAuWZbIW43++
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr270148.exe healer behavioral1/memory/5080-15-0x0000000000CD0000-0x0000000000CDA000-memory.dmp healer -
Healer family
-
Processes:
jr270148.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr270148.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr270148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr270148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr270148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr270148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr270148.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/640-22-0x0000000004B10000-0x0000000004B56000-memory.dmp family_redline behavioral1/memory/640-24-0x0000000004BD0000-0x0000000004C14000-memory.dmp family_redline behavioral1/memory/640-28-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-44-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-88-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-86-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-84-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-82-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-80-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-78-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-74-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-72-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-71-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-68-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-66-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-64-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-62-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-60-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-56-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-52-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-51-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-46-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-42-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-40-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-38-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-36-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-34-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-32-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-30-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-76-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-58-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-54-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-48-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-26-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline behavioral1/memory/640-25-0x0000000004BD0000-0x0000000004C0F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
ziUd5521.exejr270148.exeku703786.exepid process 5060 ziUd5521.exe 5080 jr270148.exe 640 ku703786.exe -
Processes:
jr270148.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr270148.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ziUd5521.exe9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziUd5521.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exeziUd5521.exeku703786.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ziUd5521.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku703786.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
jr270148.exepid process 5080 jr270148.exe 5080 jr270148.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
jr270148.exeku703786.exedescription pid process Token: SeDebugPrivilege 5080 jr270148.exe Token: SeDebugPrivilege 640 ku703786.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exeziUd5521.exedescription pid process target process PID 3720 wrote to memory of 5060 3720 9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exe ziUd5521.exe PID 3720 wrote to memory of 5060 3720 9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exe ziUd5521.exe PID 3720 wrote to memory of 5060 3720 9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exe ziUd5521.exe PID 5060 wrote to memory of 5080 5060 ziUd5521.exe jr270148.exe PID 5060 wrote to memory of 5080 5060 ziUd5521.exe jr270148.exe PID 5060 wrote to memory of 640 5060 ziUd5521.exe ku703786.exe PID 5060 wrote to memory of 640 5060 ziUd5521.exe ku703786.exe PID 5060 wrote to memory of 640 5060 ziUd5521.exe ku703786.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exe"C:\Users\Admin\AppData\Local\Temp\9a42908fff683de3919233096542b31bb002aecbf4a42ef4939ef477a3c29d8e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziUd5521.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziUd5521.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr270148.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr270148.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku703786.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku703786.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
388KB
MD56ac5a0e21372c25b3dee6abbf5c46056
SHA1972591f8bb78386dc8b518bac94404dfcdf0b527
SHA256fa740639463c20454ce6168d75506f0d4cfca242350e4aae852dc4008a3be335
SHA512e2b84c53574632924704eebc69516717603dea3b39b369d5d43dfe2e304107e2318c139fa19a77c687100da7afe3ebe66bd5aab687ea04660f1ec51682b363f2
-
Filesize
11KB
MD5f2e7267272c769e092fa3924106cf5b5
SHA11bfb156d37b8c421473b29c11f1f128d9a83f346
SHA256be42098d105c15aaf5c810bd86dec4b86b05b88d86c0cdd01e29d5946a6ad3d3
SHA51299ba3b63afbf01a63d0fba7c0bc70e80e728de2874c4eaf2d7429ea9339df24883385a604ea65e682e1d80d493a8369975b29c4ef1530ea0ed01a4640590e08e
-
Filesize
434KB
MD5ca90328a88eec73c3073a0bc4824763a
SHA19355d2494281fd7e85855a31f9beb1b5feaa658f
SHA25698e1e1e0a3258b33057c732b2102205f35c97078210cd45e93e3fc51774e6cc4
SHA512d96f12b5f0f1da110c9b80446397a2b9b8a0dd5215161797a29c07f27d39cba6632abfa1f7ccced83bac87bd9aa9665be170500d245780f735030cf3bd4d5040