Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 01:27
Static task
static1
Behavioral task
behavioral1
Sample
e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe
Resource
win10v2004-20241007-en
General
-
Target
e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe
-
Size
1.2MB
-
MD5
3283fa97b5dad7dd0c6b309fc9acb153
-
SHA1
c3773d0b2051f141bede8947467d54c04625ba49
-
SHA256
e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16
-
SHA512
9f95bac67b231177783c8975eed6ae5b1ca630f3377905f2a92546b0b2f649dfcf25f6fa515f9de7ceaa487f84326f713c15a1567cbfb9a316c11853c590ad4a
-
SSDEEP
24576:NDTWYG5l2s+JcVCjiT/r0PTcuGzPP5lMcvBxenYLi1OuheoxY7qYV2GSBm:NDpG5wcVCjiTDbb35G0BjiUuh7xXw2L
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2740-38-0x0000000000850000-0x000000000086A000-memory.dmp healer behavioral1/memory/2740-39-0x0000000000E00000-0x0000000000E18000-memory.dmp healer behavioral1/memory/2740-49-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-43-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-65-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-63-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-61-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-59-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-57-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-55-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-53-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-51-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-47-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-45-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-67-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-41-0x0000000000E00000-0x0000000000E12000-memory.dmp healer behavioral1/memory/2740-40-0x0000000000E00000-0x0000000000E12000-memory.dmp healer -
Healer family
-
Processes:
190709580.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 190709580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 190709580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 190709580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 190709580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 190709580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 190709580.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2716-83-0x00000000025B0000-0x00000000025EC000-memory.dmp family_redline behavioral1/memory/2716-84-0x00000000025F0000-0x000000000262A000-memory.dmp family_redline behavioral1/memory/2716-85-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-86-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-88-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-116-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-115-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-112-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-110-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-108-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-107-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-104-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-102-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-100-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-98-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-96-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-94-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-92-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline behavioral1/memory/2716-90-0x00000000025F0000-0x0000000002625000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
Processes:
VZ957923.exeHG058549.exe190709580.exe297062213.exepid process 1560 VZ957923.exe 2056 HG058549.exe 2740 190709580.exe 2716 297062213.exe -
Loads dropped DLL 10 IoCs
Processes:
e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exeVZ957923.exeHG058549.exe190709580.exe297062213.exepid process 1728 e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe 1560 VZ957923.exe 1560 VZ957923.exe 2056 HG058549.exe 2056 HG058549.exe 2056 HG058549.exe 2740 190709580.exe 2056 HG058549.exe 2056 HG058549.exe 2716 297062213.exe -
Processes:
190709580.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 190709580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 190709580.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exeVZ957923.exeHG058549.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" VZ957923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" HG058549.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
VZ957923.exeHG058549.exe190709580.exe297062213.exee42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZ957923.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HG058549.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 190709580.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 297062213.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
190709580.exepid process 2740 190709580.exe 2740 190709580.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
190709580.exe297062213.exedescription pid process Token: SeDebugPrivilege 2740 190709580.exe Token: SeDebugPrivilege 2716 297062213.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exeVZ957923.exeHG058549.exedescription pid process target process PID 1728 wrote to memory of 1560 1728 e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe VZ957923.exe PID 1728 wrote to memory of 1560 1728 e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe VZ957923.exe PID 1728 wrote to memory of 1560 1728 e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe VZ957923.exe PID 1728 wrote to memory of 1560 1728 e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe VZ957923.exe PID 1728 wrote to memory of 1560 1728 e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe VZ957923.exe PID 1728 wrote to memory of 1560 1728 e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe VZ957923.exe PID 1728 wrote to memory of 1560 1728 e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe VZ957923.exe PID 1560 wrote to memory of 2056 1560 VZ957923.exe HG058549.exe PID 1560 wrote to memory of 2056 1560 VZ957923.exe HG058549.exe PID 1560 wrote to memory of 2056 1560 VZ957923.exe HG058549.exe PID 1560 wrote to memory of 2056 1560 VZ957923.exe HG058549.exe PID 1560 wrote to memory of 2056 1560 VZ957923.exe HG058549.exe PID 1560 wrote to memory of 2056 1560 VZ957923.exe HG058549.exe PID 1560 wrote to memory of 2056 1560 VZ957923.exe HG058549.exe PID 2056 wrote to memory of 2740 2056 HG058549.exe 190709580.exe PID 2056 wrote to memory of 2740 2056 HG058549.exe 190709580.exe PID 2056 wrote to memory of 2740 2056 HG058549.exe 190709580.exe PID 2056 wrote to memory of 2740 2056 HG058549.exe 190709580.exe PID 2056 wrote to memory of 2740 2056 HG058549.exe 190709580.exe PID 2056 wrote to memory of 2740 2056 HG058549.exe 190709580.exe PID 2056 wrote to memory of 2740 2056 HG058549.exe 190709580.exe PID 2056 wrote to memory of 2716 2056 HG058549.exe 297062213.exe PID 2056 wrote to memory of 2716 2056 HG058549.exe 297062213.exe PID 2056 wrote to memory of 2716 2056 HG058549.exe 297062213.exe PID 2056 wrote to memory of 2716 2056 HG058549.exe 297062213.exe PID 2056 wrote to memory of 2716 2056 HG058549.exe 297062213.exe PID 2056 wrote to memory of 2716 2056 HG058549.exe 297062213.exe PID 2056 wrote to memory of 2716 2056 HG058549.exe 297062213.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe"C:\Users\Admin\AppData\Local\Temp\e42245e8bd7a37984b5fedee9b58751298fb69a68fbdb47dde0be20af2caae16.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VZ957923.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VZ957923.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HG058549.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HG058549.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\190709580.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\190709580.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\297062213.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\297062213.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460KB
MD585f72579f89826037f808def050f90cb
SHA1b14075137fc622bd4edf6a5de3e04ff6c39ff9cb
SHA256e4794dce180548fb580a671092b41708f0e6a4af78b545ec9670dd7164164c2d
SHA51228d86e1f8747c3329088d3fd82972e59826d500cf8ed5eccb3fbc045fa6280c877d0ef4ecb84e8f78f3a25fe768396a6a20c1379790f8232c32980144d5cffa4
-
Filesize
764KB
MD5930848f4d972b28d262031b300e6a9fd
SHA1042c87a19d6faa9ac1875df7b0d2b2e6e0e88832
SHA256df2d2033319c4bde307ed96c4ff802f3fad906de8bb0aa2fefec5e8f5b40e726
SHA5126a9ac5f14e41f067807ecac05e3fa151677d0cbf9d51eaef6d953b1cf73dbfea6c6ca7d2aa9299052a3d077338a3bcc79c5af22f2e779a6f23085e1d9b4fe60a
-
Filesize
592KB
MD54411c57112249950167e2fb10f3a5c21
SHA17ad1819dd9d6b34d5b189921ab4c0f9a945f7deb
SHA256581bcb58ddb1cd357ead0f01f7fad35528e2f94752e894d8cb16b52bb6f7cde3
SHA5126f0c00bd7cfbc18e476584458b861ce13ba40b3f771b579c2a55524af102fdfd0dc9bace19749e140041fdf9c225733bff619de2041a18f32f4ed8b01b61bb89
-
Filesize
378KB
MD5aa77ef7b31187dab2126982db6bddf63
SHA160c0c53ca68c8a166472150554d4f7d31a0605db
SHA2563c77f59c2c955bb799e085c3ae2171f7074cc9f54d725555b37fed026b217681
SHA51275fdeda4eb64fd77e5b54c4efc4ca1ef8d21d699f2f3bb40e80714bb72aeddf72172d3d6b65b6d26eb9e9b5b3cb70ecc78d7e7a3a1d3fdbd4771d117887c1622