Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe
Resource
win10v2004-20241007-en
General
-
Target
1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe
-
Size
521KB
-
MD5
ceb1d935e42bbd004be81b3396244e85
-
SHA1
d66f256e4fed29300a4a6888c709b00509bda36e
-
SHA256
1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a
-
SHA512
f0af8f40b8aec44e311476f665301bb15b0c97af1838186e06caa16f780edaff6d6e9d17e6372a2029cec9b5bfa2ec0ed4ce4632a3c4d367855af3416f31b185
-
SSDEEP
6144:Kcy+bnr+vp0yN90QEMYQxHVXy/WfxTUMLKKA/Oq3m4XbfQ61P3Yy+NMTfil61P/q:sMr7y902RFfxRKrdtr4cobyul69Is2/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023c73-12.dat healer behavioral1/memory/2504-15-0x0000000000090000-0x000000000009A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr107717.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr107717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr107717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr107717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr107717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr107717.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/4176-22-0x0000000002500000-0x0000000002546000-memory.dmp family_redline behavioral1/memory/4176-24-0x0000000004AA0000-0x0000000004AE4000-memory.dmp family_redline behavioral1/memory/4176-34-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-39-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-36-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-32-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-30-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-76-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-62-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-52-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-28-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-26-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-25-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-89-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-86-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-84-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-82-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-80-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-78-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-74-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-72-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-70-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-68-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-66-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-64-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-60-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-58-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-56-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-54-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-50-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-48-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-46-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-44-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-42-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4176-40-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 3704 ziwe4303.exe 2504 jr107717.exe 4176 ku582551.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr107717.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziwe4303.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku582551.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ziwe4303.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2504 jr107717.exe 2504 jr107717.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2504 jr107717.exe Token: SeDebugPrivilege 4176 ku582551.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3380 wrote to memory of 3704 3380 1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe 85 PID 3380 wrote to memory of 3704 3380 1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe 85 PID 3380 wrote to memory of 3704 3380 1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe 85 PID 3704 wrote to memory of 2504 3704 ziwe4303.exe 86 PID 3704 wrote to memory of 2504 3704 ziwe4303.exe 86 PID 3704 wrote to memory of 4176 3704 ziwe4303.exe 93 PID 3704 wrote to memory of 4176 3704 ziwe4303.exe 93 PID 3704 wrote to memory of 4176 3704 ziwe4303.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe"C:\Users\Admin\AppData\Local\Temp\1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwe4303.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwe4303.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr107717.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr107717.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku582551.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku582551.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
379KB
MD59207d6829521453221db52965898ac07
SHA1222b007622d7b3fd99080ff73f64a2252290d49b
SHA25606a8f253f83a4416021efd1ff49ee547748986ed991b4374425778d58aca1552
SHA512104e39f3ff5fcaadd482452d92f99ca3a111b474ab7021aef74f6338e94802d5d80ce0f77de89f37a62be41993481ef99b48070371fec4665c5f68bcc8e28ac1
-
Filesize
11KB
MD5ff689586f8862f087928224a664e9930
SHA187e75195a1d83a7d9831e2e42ed77ffc741bf520
SHA2562da2171c81243a36f21404765886b78710c1cd0274b9a4e70ea627e471fafd58
SHA51203f3197642e87fd05dbab699ebaab2bcf9922b5446c2fcea0d8c834233f5ed371b21b7fa6eef9e7579849f591c968edfc67a94a63cff39a806a32d301af86b6b
-
Filesize
294KB
MD53bf4ecec45421c39998d2de7a9408677
SHA1f1d702b4df099f565de9e6bddd67f8dd36c601b4
SHA256e6b56ab2d31cc296d87eca646ca8197442e99d16ff86512c6f7269d6c58d8a1d
SHA512bf2733500d6753fffcad6fb47a6f3db27b9741deccecc2dc412b5d222be56fd5659764605378cd17d9ae0bb62e9075a489d33847e570965c1238e93027bc78e6