Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 02:05
Static task
static1
Behavioral task
behavioral1
Sample
6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exe
Resource
win10v2004-20241007-en
General
-
Target
6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exe
-
Size
860KB
-
MD5
3ceddfadfc1fd7061b2352cbbdba5d34
-
SHA1
270bdf45a646f96bb89d3affb95705128ad257e1
-
SHA256
6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1
-
SHA512
d9761c78df456b703c178d5803910bd9e0154122fb76f1afa806bb15b532f237db00dd9e3aed00768ee391091378406aa78de1831f75f963775df06e468e300c
-
SSDEEP
24576:xyO6EPkvUHyokWNnIDeyWwfimUyh3bMlGh4dK299S:k1CQfoPNKvWwfWyh3bqI299
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
Processes:
resource yara_rule behavioral1/files/0x000b000000023ba0-19.dat healer behavioral1/memory/3804-22-0x0000000000630000-0x000000000063A000-memory.dmp healer behavioral1/memory/984-29-0x0000000004C20000-0x0000000004C3A000-memory.dmp healer behavioral1/memory/984-31-0x00000000071F0000-0x0000000007208000-memory.dmp healer behavioral1/memory/984-59-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-57-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-55-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-53-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-51-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-49-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-47-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-46-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-43-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-41-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-39-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-37-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-35-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-33-0x00000000071F0000-0x0000000007202000-memory.dmp healer behavioral1/memory/984-32-0x00000000071F0000-0x0000000007202000-memory.dmp healer -
Healer family
-
Processes:
b9714WV.exec44vK80.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b9714WV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" c44vK80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" c44vK80.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection b9714WV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b9714WV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b9714WV.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection c44vK80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" c44vK80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" c44vK80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" c44vK80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b9714WV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" b9714WV.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4128-67-0x0000000007040000-0x0000000007086000-memory.dmp family_redline behavioral1/memory/4128-68-0x0000000007100000-0x0000000007144000-memory.dmp family_redline behavioral1/memory/4128-74-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-98-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-102-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-100-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-96-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-94-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-92-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-90-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-88-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-86-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-84-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-82-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-80-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-78-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-76-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-72-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-70-0x0000000007100000-0x000000000713E000-memory.dmp family_redline behavioral1/memory/4128-69-0x0000000007100000-0x000000000713E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 5 IoCs
Processes:
tice6288.exetice9036.exeb9714WV.exec44vK80.exedwZmD11.exepid Process 960 tice6288.exe 2584 tice9036.exe 3804 b9714WV.exe 984 c44vK80.exe 4128 dwZmD11.exe -
Processes:
b9714WV.exec44vK80.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" b9714WV.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features c44vK80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" c44vK80.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exetice6288.exetice9036.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" tice6288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" tice9036.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1900 984 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c44vK80.exedwZmD11.exe6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exetice6288.exetice9036.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c44vK80.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwZmD11.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tice6288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tice9036.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b9714WV.exec44vK80.exepid Process 3804 b9714WV.exe 3804 b9714WV.exe 984 c44vK80.exe 984 c44vK80.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
b9714WV.exec44vK80.exedwZmD11.exedescription pid Process Token: SeDebugPrivilege 3804 b9714WV.exe Token: SeDebugPrivilege 984 c44vK80.exe Token: SeDebugPrivilege 4128 dwZmD11.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exetice6288.exetice9036.exedescription pid Process procid_target PID 3204 wrote to memory of 960 3204 6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exe 83 PID 3204 wrote to memory of 960 3204 6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exe 83 PID 3204 wrote to memory of 960 3204 6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exe 83 PID 960 wrote to memory of 2584 960 tice6288.exe 84 PID 960 wrote to memory of 2584 960 tice6288.exe 84 PID 960 wrote to memory of 2584 960 tice6288.exe 84 PID 2584 wrote to memory of 3804 2584 tice9036.exe 87 PID 2584 wrote to memory of 3804 2584 tice9036.exe 87 PID 2584 wrote to memory of 984 2584 tice9036.exe 95 PID 2584 wrote to memory of 984 2584 tice9036.exe 95 PID 2584 wrote to memory of 984 2584 tice9036.exe 95 PID 960 wrote to memory of 4128 960 tice6288.exe 102 PID 960 wrote to memory of 4128 960 tice6288.exe 102 PID 960 wrote to memory of 4128 960 tice6288.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exe"C:\Users\Admin\AppData\Local\Temp\6ca82885f757dbe4b07d6c0f4b3e846813565594a96962c062d8cb0667fbd9e1.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6288.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6288.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice9036.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice9036.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9714WV.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9714WV.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3804
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c44vK80.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c44vK80.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 10925⤵
- Program crash
PID:1900
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dwZmD11.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dwZmD11.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 984 -ip 9841⤵PID:1968
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
715KB
MD55e298e64dcbfa865f76a25ca2112bd43
SHA12db9d95083d12c9d159b68cd0505a8ef92c0a39f
SHA2563fe68fea252d0ad80eb4f0bad7c2e5c476ccdc096da9e820ccb5e0d3ef2831ce
SHA512f490c141da63b6d3dcf91f4af7ce53bb3b72e2359dbc0c303bbefd399fc38f54f117cc31854d238986fa898eedf9977e4a793933ccbdb143d6dc1b211cc1002f
-
Filesize
396KB
MD5f9586a51979f85020ffc0224e2c86693
SHA1899e62a9ffb7d7229a181c80fb5195fd3c70aaaf
SHA25680df621534a15178be225e6d88679b0ef66c11646ce25ff94148aa28d78f20f1
SHA51292989cd5fb403f801e5bb35c9afb84c56c14fb6c891101a698555810b252c15f86e45ae4d0137760fe3fc513e67b80ff576d110a019238b094de7fdeb434743d
-
Filesize
358KB
MD59b85c7f41d6a184fcead946c892a4b67
SHA1e38767534188898ec50a7d54a77d54f1bb38826a
SHA2561e3f3773ea6ed030026bb84ff90d4fa940dfe3a0d49235c8f20d177a75112834
SHA5126da493108fb4ee8cc3df03146abdb7ff8c4cae19ef21945844c23aa460a9b1d0b93b4c260fb3767f972d600bc5fc74c3edcd1af79f83ecd3d9fb1f74904f9956
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
338KB
MD5c6aa222989b8a440a0f6e438df4c8955
SHA1ed0fbc71763cbc226084fc83add0c3ca4783b75c
SHA256eaec55a6038f2bcd5a2539d362ab818eb9ba2ac4482d923b10d696138bf51dd5
SHA5121a58038340f8f19ec32f2b10196810adaf03cc987b6304d5b9d90e21cbec98140b59f62f82fa5fc18c107016f3ffe445b65aadca6f6b7352a747cb7d4cf488ff