Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:29
Static task
static1
Behavioral task
behavioral1
Sample
da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe
Resource
win10v2004-20241007-en
General
-
Target
da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe
-
Size
673KB
-
MD5
c97ce15e9e6f3f119f0303bfcec9cbcf
-
SHA1
d6eec48a2755d4201d529e22c282161a93bfa7bd
-
SHA256
da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15
-
SHA512
3fada44c908e5bdf5f0e5f9b113e7c76213a55870422fae4bb3aaac2a0c3fc229b62b6f8518ef4c520fc9665a9b7dd5679169a78cc2669e4bb86c8757ebb667f
-
SSDEEP
12288:iMrMy90ic5xKyTUZhiPqVlRPruMFpDMuFR40Dc4R7uWp3SWIm26+qf:ayZbmYuMFpDvc4BuSIm26+S
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3244-19-0x00000000022A0000-0x00000000022BA000-memory.dmp healer behavioral1/memory/3244-21-0x0000000004B80000-0x0000000004B98000-memory.dmp healer behavioral1/memory/3244-27-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-49-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-47-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-45-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-43-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-41-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-39-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-37-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-35-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-33-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-31-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-25-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-23-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-22-0x0000000004B80000-0x0000000004B92000-memory.dmp healer behavioral1/memory/3244-29-0x0000000004B80000-0x0000000004B92000-memory.dmp healer -
Healer family
-
Processes:
pro3039.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3039.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro3039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3039.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2664-61-0x00000000023F0000-0x0000000002436000-memory.dmp family_redline behavioral1/memory/2664-62-0x0000000004AC0000-0x0000000004B04000-memory.dmp family_redline behavioral1/memory/2664-80-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-78-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-96-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-94-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-92-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-90-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-86-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-84-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-83-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-76-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-74-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-72-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-70-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-88-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-68-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-66-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-64-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline behavioral1/memory/2664-63-0x0000000004AC0000-0x0000000004AFF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
un860737.exepro3039.exequ3035.exepid process 3744 un860737.exe 3244 pro3039.exe 2664 qu3035.exe -
Processes:
pro3039.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro3039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3039.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exeun860737.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un860737.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1784 3244 WerFault.exe pro3039.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exeun860737.exepro3039.exequ3035.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un860737.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro3039.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu3035.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pro3039.exepid process 3244 pro3039.exe 3244 pro3039.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pro3039.exequ3035.exedescription pid process Token: SeDebugPrivilege 3244 pro3039.exe Token: SeDebugPrivilege 2664 qu3035.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exeun860737.exedescription pid process target process PID 2588 wrote to memory of 3744 2588 da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe un860737.exe PID 2588 wrote to memory of 3744 2588 da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe un860737.exe PID 2588 wrote to memory of 3744 2588 da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe un860737.exe PID 3744 wrote to memory of 3244 3744 un860737.exe pro3039.exe PID 3744 wrote to memory of 3244 3744 un860737.exe pro3039.exe PID 3744 wrote to memory of 3244 3744 un860737.exe pro3039.exe PID 3744 wrote to memory of 2664 3744 un860737.exe qu3035.exe PID 3744 wrote to memory of 2664 3744 un860737.exe qu3035.exe PID 3744 wrote to memory of 2664 3744 un860737.exe qu3035.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe"C:\Users\Admin\AppData\Local\Temp\da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un860737.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un860737.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3039.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3039.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 10844⤵
- Program crash
PID:1784
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3035.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3035.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3244 -ip 32441⤵PID:4752
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
531KB
MD5c232832bd3a8640499653b2b689723c8
SHA10171603a1cca562094647bfc62b7b077d223704d
SHA256b2e1345982ba45fc0efe77bfe99b82b03cb4b3cf35ce7c3d9e3f1b95a31d5540
SHA5120cf65f4c837b41323d1785eb606f1e80d78cf7c43d2c9a5b4ecb37361cfc77d1bdeadafe874b6e15cea40b5103a719f3e99754a9a9a68e9f3b28b08c503216a9
-
Filesize
260KB
MD54ba208653a620138e853a75d30d8b5b6
SHA190bf9102493f7e3cf0aa03f08d23ab206d113f5c
SHA256c1ada67016abbe91565564c08dd6abfadf973f54fe3a7c55776d7ba9b474b8bb
SHA512f0c145f9dd16195af0c7093e28b7c8b723ef14214427b19e684949368ce5ae63e0bb930ba7adb976fc8d20e423e8b5b4d92a691b61c09da2797f4a88b82c86d3
-
Filesize
319KB
MD59fc6d691ba4e2c88a679b644c40d16a1
SHA16cc205f74dfdee76b100d9d448f6a8689b32ab68
SHA256cbfe961446dbd3791d98e000ac75d2e90c1ba356c1e23099d096dbaf63da286a
SHA51221a52bebcae59e53fa063e1bbe3daade06a29ab1976d0d675f494705d55d9dba3018a3bbe1bfd06c75036df2a4853041223b10334729afdf3ec7e65cf1d22b5e