Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/11/2024, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe
Resource
win10v2004-20241007-en
General
-
Target
1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe
-
Size
990KB
-
MD5
6fc9c81db8cafe63abc75667d5bd494a
-
SHA1
5e12c69579f4a7a64397060998e9bc34d512466e
-
SHA256
1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a
-
SHA512
4065d7dbddda3133bc9fc8140691fb41e01fc5bda86992875309eac4f1cab969282986a74c83ee4955dce8443f1662e6b0fc4b51c923f65e034e8e7a656c166d
-
SSDEEP
24576:OnUoY7pfy8Yg7Q7TsRZcKeD2Mzlnk+IY8Mlf:h7By87STskKefd5
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/2804-38-0x0000000002FA0000-0x0000000002FBA000-memory.dmp healer behavioral1/memory/2804-39-0x0000000003120000-0x0000000003138000-memory.dmp healer behavioral1/memory/2804-49-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-63-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-67-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-66-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-61-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-59-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-57-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-55-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-53-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-51-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-47-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-45-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-41-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-40-0x0000000003120000-0x0000000003132000-memory.dmp healer behavioral1/memory/2804-43-0x0000000003120000-0x0000000003132000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 156413437.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 156413437.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
resource yara_rule behavioral1/memory/2628-83-0x0000000004D90000-0x0000000004DCC000-memory.dmp family_redline behavioral1/memory/2628-84-0x0000000004F10000-0x0000000004F4A000-memory.dmp family_redline behavioral1/memory/2628-100-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-106-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-116-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-114-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-112-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-110-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-108-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-104-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-102-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-98-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-96-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-94-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-92-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-90-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-88-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-86-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline behavioral1/memory/2628-85-0x0000000004F10000-0x0000000004F45000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
pid Process 2404 ws707062.exe 2520 UP235332.exe 2804 156413437.exe 2628 210661960.exe -
Loads dropped DLL 10 IoCs
pid Process 1964 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 2404 ws707062.exe 2404 ws707062.exe 2520 UP235332.exe 2520 UP235332.exe 2520 UP235332.exe 2804 156413437.exe 2520 UP235332.exe 2520 UP235332.exe 2628 210661960.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 156413437.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ws707062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" UP235332.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ws707062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UP235332.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 156413437.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 210661960.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2804 156413437.exe 2804 156413437.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2804 156413437.exe Token: SeDebugPrivilege 2628 210661960.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2404 1964 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 30 PID 1964 wrote to memory of 2404 1964 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 30 PID 1964 wrote to memory of 2404 1964 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 30 PID 1964 wrote to memory of 2404 1964 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 30 PID 1964 wrote to memory of 2404 1964 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 30 PID 1964 wrote to memory of 2404 1964 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 30 PID 1964 wrote to memory of 2404 1964 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 30 PID 2404 wrote to memory of 2520 2404 ws707062.exe 31 PID 2404 wrote to memory of 2520 2404 ws707062.exe 31 PID 2404 wrote to memory of 2520 2404 ws707062.exe 31 PID 2404 wrote to memory of 2520 2404 ws707062.exe 31 PID 2404 wrote to memory of 2520 2404 ws707062.exe 31 PID 2404 wrote to memory of 2520 2404 ws707062.exe 31 PID 2404 wrote to memory of 2520 2404 ws707062.exe 31 PID 2520 wrote to memory of 2804 2520 UP235332.exe 32 PID 2520 wrote to memory of 2804 2520 UP235332.exe 32 PID 2520 wrote to memory of 2804 2520 UP235332.exe 32 PID 2520 wrote to memory of 2804 2520 UP235332.exe 32 PID 2520 wrote to memory of 2804 2520 UP235332.exe 32 PID 2520 wrote to memory of 2804 2520 UP235332.exe 32 PID 2520 wrote to memory of 2804 2520 UP235332.exe 32 PID 2520 wrote to memory of 2628 2520 UP235332.exe 34 PID 2520 wrote to memory of 2628 2520 UP235332.exe 34 PID 2520 wrote to memory of 2628 2520 UP235332.exe 34 PID 2520 wrote to memory of 2628 2520 UP235332.exe 34 PID 2520 wrote to memory of 2628 2520 UP235332.exe 34 PID 2520 wrote to memory of 2628 2520 UP235332.exe 34 PID 2520 wrote to memory of 2628 2520 UP235332.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe"C:\Users\Admin\AppData\Local\Temp\1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ws707062.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ws707062.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UP235332.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UP235332.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\156413437.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\156413437.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\210661960.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\210661960.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD54d86b1f078cf5b393a3c4c1977338041
SHA108ffce6e13ae74e83023e643ea97b0d9960e6e24
SHA256a27c02ac2161eee8c4887a42c42af559a1be457c6b46d368c46eafeb3b878e1b
SHA512f1a4aa45b0a55467d479dc23502556c8766a7551ad3f688fd3092c713f41775373d1a7d3e5c3193ee4d0d8c786bad6dfd0aa20a8702460632612dd992e4e07b0
-
Filesize
353KB
MD5a57403199ddf1fad6096938e90ccc21e
SHA145bcfc93e33259f76bfb8a68b19b4b43dd28678e
SHA256eb0fb8fabb95798d507af3ed1999ab280efb55d61f62222aad3fc59be9551c3e
SHA512eeeba09adb6171e9a56481e4b68b53359a0d94c16716e0783d7cfd69d61c923f627d41c1e47f0164a705445bf182cbf912347577bb45418fbe44c242bdba4bb7
-
Filesize
717KB
MD5fa00be7caa8c76ecf693086a43a6fa72
SHA15a824c7908f9a759b12be9aa2c5d758e003f36eb
SHA25647ad2bf46a37ecfa35b25a2a5e59bda6d82e8768361fc9726e2a84d84a85a4b1
SHA512cd1f0cc4dfa573648f8979cdc448f45b4ab07ae5e760541725d6a0dba1fa398208b534bb224e5fff79c9953a3ac89bcd3e5aca2c518143bce9dc68a55e4c62ea
-
Filesize
545KB
MD5200afa6d30b530e30060f4732a7d7ad8
SHA1cada950005d7c663e2076e0d8a8147e49b9fbdd2
SHA256d4a96660a52626abf454197b499e0c0ab26ed25462b08bbd8b0c14cca16620be
SHA512d91886c594ff70176cd81f319f63092058729fba82789bae3173f711d32eac6ae189d8b930178338dfac441ec2e8b5d28f18e20f3d58e4f1a26ca86fd49eae2d