Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe
Resource
win10v2004-20241007-en
General
-
Target
1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe
-
Size
990KB
-
MD5
6fc9c81db8cafe63abc75667d5bd494a
-
SHA1
5e12c69579f4a7a64397060998e9bc34d512466e
-
SHA256
1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a
-
SHA512
4065d7dbddda3133bc9fc8140691fb41e01fc5bda86992875309eac4f1cab969282986a74c83ee4955dce8443f1662e6b0fc4b51c923f65e034e8e7a656c166d
-
SSDEEP
24576:OnUoY7pfy8Yg7Q7TsRZcKeD2Mzlnk+IY8Mlf:h7By87STskKefd5
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral2/memory/2952-26-0x0000000004B10000-0x0000000004B2A000-memory.dmp healer behavioral2/memory/2952-28-0x0000000007130000-0x0000000007148000-memory.dmp healer behavioral2/memory/2952-48-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-56-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-54-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-52-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-50-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-36-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-46-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-44-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-42-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-40-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-38-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-34-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-32-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-30-0x0000000007130000-0x0000000007142000-memory.dmp healer behavioral2/memory/2952-29-0x0000000007130000-0x0000000007142000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 156413437.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 156413437.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
resource yara_rule behavioral2/memory/64-68-0x0000000004D10000-0x0000000004D4C000-memory.dmp family_redline behavioral2/memory/64-69-0x0000000007210000-0x000000000724A000-memory.dmp family_redline behavioral2/memory/64-83-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-101-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-99-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-97-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-95-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-93-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-91-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-89-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-87-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-85-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-81-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-79-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-77-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-75-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-73-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-71-0x0000000007210000-0x0000000007245000-memory.dmp family_redline behavioral2/memory/64-70-0x0000000007210000-0x0000000007245000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
pid Process 3724 ws707062.exe 2156 UP235332.exe 2952 156413437.exe 64 210661960.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 156413437.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 156413437.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ws707062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" UP235332.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1088 2952 WerFault.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UP235332.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 156413437.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 210661960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ws707062.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2952 156413437.exe 2952 156413437.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2952 156413437.exe Token: SeDebugPrivilege 64 210661960.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1636 wrote to memory of 3724 1636 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 86 PID 1636 wrote to memory of 3724 1636 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 86 PID 1636 wrote to memory of 3724 1636 1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe 86 PID 3724 wrote to memory of 2156 3724 ws707062.exe 87 PID 3724 wrote to memory of 2156 3724 ws707062.exe 87 PID 3724 wrote to memory of 2156 3724 ws707062.exe 87 PID 2156 wrote to memory of 2952 2156 UP235332.exe 88 PID 2156 wrote to memory of 2952 2156 UP235332.exe 88 PID 2156 wrote to memory of 2952 2156 UP235332.exe 88 PID 2156 wrote to memory of 64 2156 UP235332.exe 100 PID 2156 wrote to memory of 64 2156 UP235332.exe 100 PID 2156 wrote to memory of 64 2156 UP235332.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe"C:\Users\Admin\AppData\Local\Temp\1da7b6807c55e7942da399ac4eb9b8c1a2fbef954f5eac082607801c54de1a2a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ws707062.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ws707062.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UP235332.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UP235332.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\156413437.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\156413437.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 10885⤵
- Program crash
PID:1088
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\210661960.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\210661960.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:64
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2952 -ip 29521⤵PID:3760
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717KB
MD5fa00be7caa8c76ecf693086a43a6fa72
SHA15a824c7908f9a759b12be9aa2c5d758e003f36eb
SHA25647ad2bf46a37ecfa35b25a2a5e59bda6d82e8768361fc9726e2a84d84a85a4b1
SHA512cd1f0cc4dfa573648f8979cdc448f45b4ab07ae5e760541725d6a0dba1fa398208b534bb224e5fff79c9953a3ac89bcd3e5aca2c518143bce9dc68a55e4c62ea
-
Filesize
545KB
MD5200afa6d30b530e30060f4732a7d7ad8
SHA1cada950005d7c663e2076e0d8a8147e49b9fbdd2
SHA256d4a96660a52626abf454197b499e0c0ab26ed25462b08bbd8b0c14cca16620be
SHA512d91886c594ff70176cd81f319f63092058729fba82789bae3173f711d32eac6ae189d8b930178338dfac441ec2e8b5d28f18e20f3d58e4f1a26ca86fd49eae2d
-
Filesize
269KB
MD54d86b1f078cf5b393a3c4c1977338041
SHA108ffce6e13ae74e83023e643ea97b0d9960e6e24
SHA256a27c02ac2161eee8c4887a42c42af559a1be457c6b46d368c46eafeb3b878e1b
SHA512f1a4aa45b0a55467d479dc23502556c8766a7551ad3f688fd3092c713f41775373d1a7d3e5c3193ee4d0d8c786bad6dfd0aa20a8702460632612dd992e4e07b0
-
Filesize
353KB
MD5a57403199ddf1fad6096938e90ccc21e
SHA145bcfc93e33259f76bfb8a68b19b4b43dd28678e
SHA256eb0fb8fabb95798d507af3ed1999ab280efb55d61f62222aad3fc59be9551c3e
SHA512eeeba09adb6171e9a56481e4b68b53359a0d94c16716e0783d7cfd69d61c923f627d41c1e47f0164a705445bf182cbf912347577bb45418fbe44c242bdba4bb7