Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exe
Resource
win10v2004-20241007-en
General
-
Target
29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exe
-
Size
657KB
-
MD5
eb9aa7bb8dc3752c7be1d3dda39ccf87
-
SHA1
ab5f2d03cb36fc056d8616348d0893965a8309e1
-
SHA256
29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5
-
SHA512
04dd7bf0ffd95c760d159b64536e603b635f8286ca3db21e3c1dcfd7beec3be7153457eb6b3598b36effa20b135ce63f2c6def30858b7243ac16f1a299cec8e1
-
SSDEEP
12288:UMrEy90Ta6Q/KSY6o06MWAqfjS9tvgfwnl7IAH+EZZx0/WnFx9x3:Ay43kHNcbkL1I2+EZzX9x3
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4544-18-0x0000000004A50000-0x0000000004A6A000-memory.dmp healer behavioral1/memory/4544-20-0x0000000004BF0000-0x0000000004C08000-memory.dmp healer behavioral1/memory/4544-30-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-48-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-46-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-44-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-42-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-40-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-38-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-36-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-34-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-32-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-28-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-26-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-24-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-22-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer behavioral1/memory/4544-21-0x0000000004BF0000-0x0000000004C02000-memory.dmp healer -
Healer family
-
Processes:
pro3040.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3040.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro3040.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1344-60-0x0000000004B00000-0x0000000004B46000-memory.dmp family_redline behavioral1/memory/1344-61-0x0000000004C00000-0x0000000004C44000-memory.dmp family_redline behavioral1/memory/1344-71-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-95-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-93-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-91-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-87-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-85-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-83-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-81-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-79-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-77-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-75-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-69-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-67-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-65-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-89-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-63-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-73-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/1344-62-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
un871346.exepro3040.exequ7430.exepid process 4940 un871346.exe 4544 pro3040.exe 1344 qu7430.exe -
Processes:
pro3040.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3040.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exeun871346.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un871346.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3656 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2196 4544 WerFault.exe pro3040.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exeun871346.exepro3040.exequ7430.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un871346.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro3040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu7430.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pro3040.exepid process 4544 pro3040.exe 4544 pro3040.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pro3040.exequ7430.exedescription pid process Token: SeDebugPrivilege 4544 pro3040.exe Token: SeDebugPrivilege 1344 qu7430.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exeun871346.exedescription pid process target process PID 4044 wrote to memory of 4940 4044 29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exe un871346.exe PID 4044 wrote to memory of 4940 4044 29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exe un871346.exe PID 4044 wrote to memory of 4940 4044 29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exe un871346.exe PID 4940 wrote to memory of 4544 4940 un871346.exe pro3040.exe PID 4940 wrote to memory of 4544 4940 un871346.exe pro3040.exe PID 4940 wrote to memory of 4544 4940 un871346.exe pro3040.exe PID 4940 wrote to memory of 1344 4940 un871346.exe qu7430.exe PID 4940 wrote to memory of 1344 4940 un871346.exe qu7430.exe PID 4940 wrote to memory of 1344 4940 un871346.exe qu7430.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exe"C:\Users\Admin\AppData\Local\Temp\29e8e062e4bcb76e9b722bd3379bb72a725027c8ed8c089a067de92e9b3f10f5.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un871346.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un871346.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3040.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3040.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 10804⤵
- Program crash
PID:2196
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7430.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7430.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4544 -ip 45441⤵PID:2680
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3656
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
515KB
MD5f32ea1cc0f2f513296db5783ae4e124a
SHA1ec60bc1627613d2e22548c09af658e7956e27533
SHA256992970bafb427fdcc8619a365e1557ec5d0753d10f1a26f9400f2fd9abff7715
SHA5127e82d942a0e9e3371567350423c65061b176d2c75380569d07013ec4a0e62991efaf2c65d5c8e1b77a9d78be554b0ac3eaa73ac7ca86aaa36efa86af6ad9d1b6
-
Filesize
295KB
MD5fce8639d13da0de97c36bebdf5600c77
SHA1ab649bc020add81fa249e766b0ed752fd1f6a5c4
SHA2564f9626bd3b7f63b1ca4ce930f5b4942d7e2c0233c641dc3dde225fc1d15b33dc
SHA512774b0b6b5047c33abafe4e2172ffa3ea9d2768a92c4e1d93c93028ade44dd984766f8fd7188d0eda66ab6adceba29a0b5aa04b2b01220f6e7f765c6d4f342da3
-
Filesize
354KB
MD54beb689f4051b90beb9365cde98471a0
SHA158506e27bd313e57fe9f05b62f884a3ba2d18829
SHA25603d5d927eacd9486d699a762e3c8d2d57053e437e014d919acbb57e5d76f0ab9
SHA5127410dbe570b6afa1dceb96f38d6ae175b221b9366f731c6702b85941bb7f3c1e018f0c1f3e4766c1694babcc2f211f33372e8d81d8b44c86c2e1c7039f8cdbe8