Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 03:41
Static task
static1
Behavioral task
behavioral1
Sample
23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe
Resource
win10v2004-20241007-en
General
-
Target
23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe
-
Size
531KB
-
MD5
258ab01a0943c02d66c4469aa129d0e0
-
SHA1
e884bf0bd9de77dbbe44674879a2c5e809e08062
-
SHA256
23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48
-
SHA512
e61786f2b3f4eb6a61c9084a37c9d386960c959d270d2bd06208c6a942d125dad03cc2ae7f511de1a8538d4b45ac401d0f0b2da6c8993f95b20124032ffd2a01
-
SSDEEP
6144:Kiy+bnr+yp0yN90QEjjyQ986jwYc4kJbaAShvOI2RrIs+PUEHNgigTDIZtvTqcSo:mMryy90T8w3kbUp2b61SHc77rSo
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000c000000023b84-5.dat healer behavioral1/memory/3144-8-0x0000000000780000-0x000000000078A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr419939.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr419939.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr419939.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr419939.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr419939.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr419939.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral1/memory/2168-2101-0x0000000005780000-0x00000000057B2000-memory.dmp family_redline behavioral1/files/0x0002000000022a9d-2106.dat family_redline behavioral1/memory/2428-2114-0x0000000000BC0000-0x0000000000BF0000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation ku102071.exe -
Executes dropped EXE 3 IoCs
pid Process 3144 jr419939.exe 2168 ku102071.exe 2428 1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr419939.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4172 2168 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku102071.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3144 jr419939.exe 3144 jr419939.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3144 jr419939.exe Token: SeDebugPrivilege 2168 ku102071.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3424 wrote to memory of 3144 3424 23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe 85 PID 3424 wrote to memory of 3144 3424 23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe 85 PID 3424 wrote to memory of 2168 3424 23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe 95 PID 3424 wrote to memory of 2168 3424 23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe 95 PID 3424 wrote to memory of 2168 3424 23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe 95 PID 2168 wrote to memory of 2428 2168 ku102071.exe 96 PID 2168 wrote to memory of 2428 2168 ku102071.exe 96 PID 2168 wrote to memory of 2428 2168 ku102071.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe"C:\Users\Admin\AppData\Local\Temp\23128c93e3506bd0053c95f93399999bde8aba6be964a1fb6f1434d6bebcba48N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr419939.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr419939.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku102071.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku102071.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 11963⤵
- Program crash
PID:4172
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2168 -ip 21681⤵PID:4920
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD527b8b77ef0d35ed23e0b0916dd6bb8c0
SHA10f00f82858490fd39c53539e41e74386fb1546b3
SHA2566273ec5d01023846395dcab0bd7f1a520a47b90c4244dcc3467a1718a26a024e
SHA51296f512d179336d884d76b0d9bb74ba4922a6a397fbcd3cdb393f92eed7ab5fbaadc92f97c69bde0a6b0a306c7e59af98a406bfe416382dfe28ae70fee948f4a2
-
Filesize
495KB
MD557ad332d77be3d6548b01ed088eb2602
SHA12bc4d89d787e7a635c57a3bbde3168b23a2ba1b1
SHA256376e02df9717669d64b3191176488a2b4d63dfe3d8762416032ed6793d37c1ef
SHA512d5ed37389df0d65ab74ddd9f55d68c5f860dfcd9ded3477f507a4d2447b548b1e673cf65b0b853a42eb43cbcbcdecd4fb8a699bde6b3e2ae68784e84876a7500
-
Filesize
168KB
MD51073b2e7f778788852d3f7bb79929882
SHA17f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA51290cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0