Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exe
Resource
win10v2004-20241007-en
General
-
Target
71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exe
-
Size
658KB
-
MD5
71cea6bd21aa86f786034256d94d8f2a
-
SHA1
2237a2fe54f62179791ddc4a9667df3ca85f8b98
-
SHA256
71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8
-
SHA512
ba32a1a099bc2503b07f47aeb45b7363718b6e42a4afe2b719afa1d100a9c2603c1e21fe5b07c97b0f5c4dc2210eb406cd95e9f49ecabb07241902080364cdcc
-
SSDEEP
12288:mMruy90uKSpz1D63JqN2PXB9ohU0f5LpujpH0vdRWg+QTjgn:MyV+3cN2P6/buOTWhQT0
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4828-19-0x00000000008C0000-0x00000000008DA000-memory.dmp healer behavioral1/memory/4828-21-0x0000000002490000-0x00000000024A8000-memory.dmp healer behavioral1/memory/4828-37-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-49-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-47-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-45-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-43-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-41-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-39-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-36-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-33-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-31-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-29-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-27-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-25-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-23-0x0000000002490000-0x00000000024A2000-memory.dmp healer behavioral1/memory/4828-22-0x0000000002490000-0x00000000024A2000-memory.dmp healer -
Healer family
-
Processes:
pro7496.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7496.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7496.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7496.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7496.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7496.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro7496.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2152-61-0x00000000024A0000-0x00000000024E6000-memory.dmp family_redline behavioral1/memory/2152-62-0x0000000002530000-0x0000000002574000-memory.dmp family_redline behavioral1/memory/2152-82-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-86-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-96-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-94-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-92-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-90-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-88-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-84-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-80-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-78-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-76-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-74-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-72-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-70-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-68-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-66-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-64-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/2152-63-0x0000000002530000-0x000000000256F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
un915312.exepro7496.exequ8055.exepid process 4060 un915312.exe 4828 pro7496.exe 2152 qu8055.exe -
Processes:
pro7496.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7496.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7496.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
un915312.exe71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un915312.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 5780 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2680 4828 WerFault.exe pro7496.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exeun915312.exepro7496.exequ8055.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un915312.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro7496.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu8055.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pro7496.exepid process 4828 pro7496.exe 4828 pro7496.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pro7496.exequ8055.exedescription pid process Token: SeDebugPrivilege 4828 pro7496.exe Token: SeDebugPrivilege 2152 qu8055.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exeun915312.exedescription pid process target process PID 4908 wrote to memory of 4060 4908 71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exe un915312.exe PID 4908 wrote to memory of 4060 4908 71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exe un915312.exe PID 4908 wrote to memory of 4060 4908 71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exe un915312.exe PID 4060 wrote to memory of 4828 4060 un915312.exe pro7496.exe PID 4060 wrote to memory of 4828 4060 un915312.exe pro7496.exe PID 4060 wrote to memory of 4828 4060 un915312.exe pro7496.exe PID 4060 wrote to memory of 2152 4060 un915312.exe qu8055.exe PID 4060 wrote to memory of 2152 4060 un915312.exe qu8055.exe PID 4060 wrote to memory of 2152 4060 un915312.exe qu8055.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exe"C:\Users\Admin\AppData\Local\Temp\71294c524a6f5c269e446cd89b2910839380f4641226fca455282d5ccfa099a8.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un915312.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un915312.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7496.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7496.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 10164⤵
- Program crash
PID:2680
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8055.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8055.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4828 -ip 48281⤵PID:1416
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:5780
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516KB
MD50ba28ea74be5bdd858287e8e0fb31806
SHA18c9846f3609cdf1f55e02d31fc50cf2305d56dbf
SHA2566454b0324f0a6786e7b2dbcd55ec8d3813aea4d9b14d20606687d1c6e7edecbe
SHA51228cfba4243cd61ab71584e822792f6031fb7153c1c6ad7e77f00a162c38a6bd0ae26968542c1ff0d7b01f486ee554f6e0aebf7c1018260b944b225a82d512ef5
-
Filesize
236KB
MD5368bc9256008425b1541cab8dde80625
SHA1ad7706be7fdf8c6c1252af85062a43eabcce2248
SHA25692b16bb52f011d4a166fdda6e59dd4e09ee6cbe4dcb356151a160ca4c3605c31
SHA5128929274f38d551736a4a3c44094972fcc1ec4ad0fd0c17eca2821b47c8b874733f0b21d333788d3adadc2ed7f06f217978a6aef45e44dd1c3f203483cecab46a
-
Filesize
294KB
MD5abb724867edbe5091b1064d668f9ea10
SHA1d22130f5fcb78d4d81b840a7d3551b71a405ed29
SHA2569cd6ce225fe93e203755f653676e3f41b9be70b898d1899d7fc61478682b2e63
SHA512fde431f0acd6881173a70d59f5827a056ead7a4bfe9173558a9a241bd7cdb3f86f850f5ac3183fbd7517a28b678c528ddfc6e9dacc67e88c139e092b9220f554