Analysis
-
max time kernel
126s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 05:33
Static task
static1
Behavioral task
behavioral1
Sample
abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe
Resource
win10v2004-20241007-en
General
-
Target
abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe
-
Size
478KB
-
MD5
87d0f8209c784d8b514ac512998f25bf
-
SHA1
82be5d34df215e7f4a6f7e3e1866aa12c6341c3d
-
SHA256
abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47
-
SHA512
64024a1e685c9df1cf57721110c38039c80662d9511ff31478f04b494f126d18a38e7bc8eaec9a6f99cf280238adbbe5b13c7716e3f03ea135c083c75580dbfd
-
SSDEEP
6144:Ksy+bnr+ep0yN90QEUnLAJAyUoV2oJkBAsKg0LQSFTFO/vUtYgudY4O6SKRmUY0k:MMr2y90+HoVkB+gSFs3Uj7FKRm4Z+5
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
resource yara_rule behavioral1/files/0x0008000000023cc9-12.dat healer behavioral1/memory/4756-15-0x0000000000250000-0x000000000025A000-memory.dmp healer behavioral1/memory/1280-22-0x00000000025C0000-0x00000000025DA000-memory.dmp healer behavioral1/memory/1280-24-0x00000000029B0000-0x00000000029C8000-memory.dmp healer behavioral1/memory/1280-25-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-32-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-52-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-50-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-48-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-46-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-44-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-42-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-40-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-38-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-36-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-34-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-30-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-28-0x00000000029B0000-0x00000000029C2000-memory.dmp healer behavioral1/memory/1280-26-0x00000000029B0000-0x00000000029C2000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" dXS04Fv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection ecB28HQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" ecB28HQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" ecB28HQ.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection dXS04Fv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" dXS04Fv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" dXS04Fv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" ecB28HQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" ecB28HQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" dXS04Fv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dXS04Fv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" ecB28HQ.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000023cc7-57.dat family_redline behavioral1/memory/1632-59-0x00000000009F0000-0x0000000000A22000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
pid Process 928 nYC92TT60.exe 4756 dXS04Fv.exe 1280 ecB28HQ.exe 1632 fok25Ta.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" dXS04Fv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features ecB28HQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" ecB28HQ.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nYC92TT60.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 716 1280 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nYC92TT60.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecB28HQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fok25Ta.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4756 dXS04Fv.exe 4756 dXS04Fv.exe 1280 ecB28HQ.exe 1280 ecB28HQ.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4756 dXS04Fv.exe Token: SeDebugPrivilege 1280 ecB28HQ.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5072 wrote to memory of 928 5072 abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe 83 PID 5072 wrote to memory of 928 5072 abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe 83 PID 5072 wrote to memory of 928 5072 abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe 83 PID 928 wrote to memory of 4756 928 nYC92TT60.exe 84 PID 928 wrote to memory of 4756 928 nYC92TT60.exe 84 PID 928 wrote to memory of 1280 928 nYC92TT60.exe 95 PID 928 wrote to memory of 1280 928 nYC92TT60.exe 95 PID 928 wrote to memory of 1280 928 nYC92TT60.exe 95 PID 5072 wrote to memory of 1632 5072 abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe 100 PID 5072 wrote to memory of 1632 5072 abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe 100 PID 5072 wrote to memory of 1632 5072 abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe"C:\Users\Admin\AppData\Local\Temp\abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYC92TT60.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYC92TT60.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dXS04Fv.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dXS04Fv.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ecB28HQ.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ecB28HQ.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 10844⤵
- Program crash
PID:716
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fok25Ta.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fok25Ta.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1280 -ip 12801⤵PID:1276
Network
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request17.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.209.201.84.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
17.160.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
72 B 132 B 1 1
DNS Request
73.209.201.84.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
333KB
MD538b3c72de817bc8325d966644b3ab2ea
SHA156511d41f43b2d12791142e3ac67bb726d37f303
SHA2562a72ed7f205a5e893912ce8618918c00dd94b09e7f9a52a81f3cab3ededc4994
SHA5121c14c018530c970b23eb5a57670091f6c3e58550677541b201c0e101a09a3a2d13ec1c148f3d54da2f39c9443efdd531d75536adf41382eb3068d768bc69cec5
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
235KB
MD551eaf3c9171c3352f9656cae26564893
SHA1f34140400948baf80b116d9d59839a3f9018168d
SHA2567f83dffe8e01e47ab8e070ff65d79e728d717efac490183e68ba36908fd2a720
SHA512dff81178fc1a2e66e701a722244f2bba11994762f11fac71880f82eb816183e61f203fc0ad5adbaa17992f6ccad63f962420a3037ecfc35a21de8af8e091fe02