Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 03:25
Static task
static1
Behavioral task
behavioral1
Sample
f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe
Resource
win10v2004-20241007-en
General
-
Target
f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe
-
Size
652KB
-
MD5
170304966f08a379d1fdd8b61bddfdc6
-
SHA1
0a96b84514b44c8f8a5e052683e9111a2ccafe5f
-
SHA256
f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291
-
SHA512
a30a5142adc5d7dbe95f8dd832f3643aeabde848b0f1dde775b0efbad8e7757477905e948336d0eccbad558d26f3e724e52f71c2632d305635fe3fb9dceb6685
-
SSDEEP
12288:8y90LUvjYwCnaa4eP9a4eER/IE/hxDzWZzRp3baTOAwb0:8yzvjX2P9+ERxxDzW1RZbaH
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/2868-15-0x00000000025A0000-0x00000000025BA000-memory.dmp healer behavioral1/memory/2868-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp healer behavioral1/memory/2868-48-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-46-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-44-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-42-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-40-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-36-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-34-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-32-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-30-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-28-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-26-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-24-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-22-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2868-21-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 76415258.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 76415258.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 76415258.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 76415258.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 76415258.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 76415258.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
resource yara_rule behavioral1/memory/1936-57-0x0000000002480000-0x00000000024BC000-memory.dmp family_redline behavioral1/memory/1936-58-0x0000000004A50000-0x0000000004A8A000-memory.dmp family_redline behavioral1/memory/1936-72-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-80-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-94-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-92-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-90-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-88-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-86-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-84-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-82-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-78-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-76-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-74-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-70-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-68-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-67-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-64-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-62-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-60-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline behavioral1/memory/1936-59-0x0000000004A50000-0x0000000004A85000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2480 st594835.exe 2868 76415258.exe 1936 kp639452.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 76415258.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 76415258.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st594835.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language st594835.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76415258.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kp639452.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2868 76415258.exe 2868 76415258.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2868 76415258.exe Token: SeDebugPrivilege 1936 kp639452.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1120 wrote to memory of 2480 1120 f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe 85 PID 1120 wrote to memory of 2480 1120 f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe 85 PID 1120 wrote to memory of 2480 1120 f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe 85 PID 2480 wrote to memory of 2868 2480 st594835.exe 86 PID 2480 wrote to memory of 2868 2480 st594835.exe 86 PID 2480 wrote to memory of 2868 2480 st594835.exe 86 PID 2480 wrote to memory of 1936 2480 st594835.exe 93 PID 2480 wrote to memory of 1936 2480 st594835.exe 93 PID 2480 wrote to memory of 1936 2480 st594835.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe"C:\Users\Admin\AppData\Local\Temp\f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st594835.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st594835.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\76415258.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\76415258.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp639452.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp639452.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
497KB
MD5c32be658ad0ddbfa04cabdd5fb2bbd11
SHA196746c5f3b6eef3a66202d066b5ea06602c8f73c
SHA256bd83887991305acef5189c3739a1ee544d25db8e5e01d6024ff33b2bf5797365
SHA512c7e94773516e2c4485749f12ee93d78d4c193c0c5188710c4bd16bdd6a3551e0742f1d9b40a8d2c7e8829664bf0795fc8b5f433e5447562d713ac99852e49a4a
-
Filesize
175KB
MD5a165b5f6b0a4bdf808b71de57bf9347d
SHA139a7b301e819e386c162a47e046fa384bb5ab437
SHA25668349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a
SHA5123dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1
-
Filesize
342KB
MD55a0611c64d614f69cd195b272df69aff
SHA1495e4ba6bbb7fec824035b93328789037591f25e
SHA2563a60fa9cff97a6096a11e67bc724a607b39c402c0aa7086354cb0766fac13bab
SHA5122f5590ef384abe57dbe582ee67e5e4f92389cd30a3033034b0bc8522efba13ee147e8796de9f6df0aa8e2e319a5f077cacc9cbf92ffbad75ae15fff39792b6d3