Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:27
Static task
static1
Behavioral task
behavioral1
Sample
f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exe
Resource
win10v2004-20241007-en
General
-
Target
f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exe
-
Size
612KB
-
MD5
45c3c413e070f38030046a7cd1fd34f7
-
SHA1
f37d180c349f97c6d8bd1817bbedceae35ff5d15
-
SHA256
f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca
-
SHA512
986bc001ee6def5c1352ac65f97450e099563fe81322ac59c056702180acac8cfc9bbcbb1ceff2d553776acb60dd12e849708fc76ec8c12c37f079446a9a3154
-
SSDEEP
12288:Qy906xccvV+/9hZiAjgB4Q3u4Koul8FRDNRzchQUxp0Q:QyHxLvV6fNjgB42uho5xYxuQ
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\49948940.exe healer behavioral1/memory/2888-15-0x0000000000D80000-0x0000000000D8A000-memory.dmp healer -
Healer family
-
Processes:
49948940.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 49948940.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 49948940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 49948940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 49948940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 49948940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 49948940.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/5080-21-0x00000000027F0000-0x000000000282C000-memory.dmp family_redline behavioral1/memory/5080-23-0x0000000002BE0000-0x0000000002C1A000-memory.dmp family_redline behavioral1/memory/5080-24-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-81-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-63-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-47-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-31-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-87-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-85-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-83-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-79-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-77-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-75-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-73-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-71-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-69-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-67-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-65-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-61-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-59-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-57-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-55-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-53-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-51-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-49-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-45-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-43-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-41-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-39-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-37-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-35-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-33-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-29-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-27-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline behavioral1/memory/5080-25-0x0000000002BE0000-0x0000000002C15000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
st600291.exe49948940.exekp943975.exepid process 2184 st600291.exe 2888 49948940.exe 5080 kp943975.exe -
Processes:
49948940.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 49948940.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exest600291.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st600291.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exest600291.exekp943975.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language st600291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kp943975.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
49948940.exepid process 2888 49948940.exe 2888 49948940.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
49948940.exekp943975.exedescription pid process Token: SeDebugPrivilege 2888 49948940.exe Token: SeDebugPrivilege 5080 kp943975.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exest600291.exedescription pid process target process PID 3300 wrote to memory of 2184 3300 f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exe st600291.exe PID 3300 wrote to memory of 2184 3300 f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exe st600291.exe PID 3300 wrote to memory of 2184 3300 f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exe st600291.exe PID 2184 wrote to memory of 2888 2184 st600291.exe 49948940.exe PID 2184 wrote to memory of 2888 2184 st600291.exe 49948940.exe PID 2184 wrote to memory of 5080 2184 st600291.exe kp943975.exe PID 2184 wrote to memory of 5080 2184 st600291.exe kp943975.exe PID 2184 wrote to memory of 5080 2184 st600291.exe kp943975.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exe"C:\Users\Admin\AppData\Local\Temp\f70543950a7ca10c6127f11f6e6554a05145c0443f58501e4155d2988bee9cca.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st600291.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st600291.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\49948940.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\49948940.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp943975.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp943975.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
458KB
MD5e9850064ef711dc2a86d553940c11627
SHA14754556f648f14baa62f297efbf0cf469bd81190
SHA256c7be0e7f2ae45d4f7876efe1645f077bc9c1dc95f9bf427a73010ce35f7aefed
SHA512ce4f74cb4b57d449a8ce77481d5ac0821fd7016799294a4728b8212a9cc263ec4b2a5ffb20cef66445b588011fad6976b65ca360ec97a484e559679856581545
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
460KB
MD5279bc7f7c4068c2507c568a769f0ae22
SHA160a4473f5750d5c5dc7f8e6cd352038ebf16d403
SHA256a1330bbf116b4ce84a98097a031afa3db528e8fc6bc42a2655556fad1e996ad3
SHA512d53dc941a5e7e5ac68d2deab91743ea44d0441f25f4c506796a42c338e417bd4e7e9e68fd83818a43f668294da34a360134333560c8a8e1e3d5ce309aa739543