Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06.exe
Resource
win10v2004-20241007-en
General
-
Target
0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06.exe
-
Size
677KB
-
MD5
aa8a325a16a245a8dc757d6f5372a4f7
-
SHA1
996c14d2e43d249fb2c75fa9076fa90ac4e45a0d
-
SHA256
0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06
-
SHA512
84c3e82cb0e3b7bd14371d6e416304d5dafc9e0e830c7566748ee0e99c523918ea2f11685013c595c733a68351c1878b769592e85282d5cde435acde2a7cd530
-
SSDEEP
12288:hMrOy90ZGYlzJ9gGwWjbl5owpq4uviiYejKhQDP8Ew/DZ7FR75T9jHuG:vyxYFoGr15XrAueGhQDP/w7Z7PN5d
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4028-19-0x0000000002370000-0x000000000238A000-memory.dmp healer behavioral1/memory/4028-21-0x0000000004A40000-0x0000000004A58000-memory.dmp healer behavioral1/memory/4028-27-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-29-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-49-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-47-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-45-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-43-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-41-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-39-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-37-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-35-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-33-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-31-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-25-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-23-0x0000000004A40000-0x0000000004A52000-memory.dmp healer behavioral1/memory/4028-22-0x0000000004A40000-0x0000000004A52000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9292.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9292.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/3748-61-0x00000000023D0000-0x0000000002416000-memory.dmp family_redline behavioral1/memory/3748-62-0x00000000025C0000-0x0000000002604000-memory.dmp family_redline behavioral1/memory/3748-64-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-80-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-94-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-92-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-90-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-88-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-86-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-78-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-76-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-74-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-72-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-70-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-68-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-66-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-96-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-84-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-82-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline behavioral1/memory/3748-63-0x00000000025C0000-0x00000000025FF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 4432 un322594.exe 4028 pro9292.exe 3748 qu9003.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9292.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9292.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un322594.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4448 4028 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un322594.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro9292.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu9003.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4028 pro9292.exe 4028 pro9292.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4028 pro9292.exe Token: SeDebugPrivilege 3748 qu9003.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1648 wrote to memory of 4432 1648 0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06.exe 83 PID 1648 wrote to memory of 4432 1648 0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06.exe 83 PID 1648 wrote to memory of 4432 1648 0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06.exe 83 PID 4432 wrote to memory of 4028 4432 un322594.exe 84 PID 4432 wrote to memory of 4028 4432 un322594.exe 84 PID 4432 wrote to memory of 4028 4432 un322594.exe 84 PID 4432 wrote to memory of 3748 4432 un322594.exe 97 PID 4432 wrote to memory of 3748 4432 un322594.exe 97 PID 4432 wrote to memory of 3748 4432 un322594.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06.exe"C:\Users\Admin\AppData\Local\Temp\0acd853d7916a9bf1247cf989b03274fd0334d5a3dfd2a8daa8ff1a348b9ff06.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un322594.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un322594.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9292.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9292.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 10844⤵
- Program crash
PID:4448
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9003.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9003.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4028 -ip 40281⤵PID:1020
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
524KB
MD5527f9b66bb1d8cf7c95b884717a70b33
SHA16a6a9cc481d56afb940904183648fc08fdacd12d
SHA256f60d53a93420e3d492bab69548b2adc815ee1a30291662b61742abf4b2db6531
SHA512c7d96dec08afac57c10fccd2c099dcaae1ba741917af7efc9bdaeb1a079d423bb58b209dc096cdc0a50ed62171d7b2149b2f9cc6c48ea9de295b96a59b52e928
-
Filesize
253KB
MD5ea7f01a70c19d866e42cf673d79ba2d6
SHA131548ebe3b25e0716dc261d7c9cc98c0f930ac8d
SHA2567bff7f29537b10b533132cc25be8ea6926d944d7f0c579c415d4454cd9c17efd
SHA5122bd104d525f865d7038e5a9cb1c772e164b7c458d2dde50fb7c8c31d14395dee482fee41abed1581bd21ca17c97c8741a11c33a005cd6153f1882e4884914821
-
Filesize
311KB
MD5d6f28e4dd940d9bcee47a190e0b4c483
SHA1b5f03769735eb4d9447dd5dbcac60d3860566ebd
SHA2563eb0b0a4cc6990778d7bf34dc7bc69e2395c5939e698dc4be7fe5edee693f273
SHA51244cb204a2c30d54e9e6a377a85c2eea65f5d336e8851df90cc18a163a80018d9f9a019e121afe1c9db09f7e239a3808e8cb9c5c53860d0b143ec1e5a6d0a66b1