Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe
Resource
win10v2004-20241007-en
General
-
Target
659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe
-
Size
659KB
-
MD5
f9428e751724949d58f4c9dccdce9ebe
-
SHA1
0d842817e8fd753b9f3d62735a0658ad0753be93
-
SHA256
659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a
-
SHA512
2b1b2a54ec50a0f6104c7729335168efddcf17fffbf208a54627b379454311829a1194c26bc96b039520bc43983d255b483a90bf4b8f4fee6f34d5f359fb4ab3
-
SSDEEP
12288:DMrEy90KoYKcwaq5evC4IRUwP48BcaZS2tzEpW6VR7xO:Xy6Ym5evtIRnP48Bi2tmZVy
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/3988-27-0x0000000002290000-0x00000000022AA000-memory.dmp healer behavioral1/memory/3988-29-0x0000000002520000-0x0000000002538000-memory.dmp healer behavioral1/memory/3988-58-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-56-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-54-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-53-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-50-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-48-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-46-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-44-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-42-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-40-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-38-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-36-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-34-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-32-0x0000000002520000-0x0000000002532000-memory.dmp healer behavioral1/memory/3988-31-0x0000000002520000-0x0000000002532000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4485.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
resource yara_rule behavioral1/memory/336-30-0x0000000004A10000-0x0000000004A56000-memory.dmp family_redline behavioral1/memory/336-59-0x0000000004A90000-0x0000000004AD4000-memory.dmp family_redline behavioral1/memory/336-86-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-89-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-87-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-83-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-81-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-79-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-77-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-75-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-73-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-71-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-69-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-67-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-65-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-63-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-61-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/336-60-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
pid Process 2044 un221871.exe 3412 pro4485.exe 3988 pro4485.exe 336 qu4678.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4485.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4485.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un221871.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3412 set thread context of 3988 3412 pro4485.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un221871.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro4485.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro4485.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu4678.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3988 pro4485.exe 3988 pro4485.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3988 pro4485.exe Token: SeDebugPrivilege 336 qu4678.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2044 1292 659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe 83 PID 1292 wrote to memory of 2044 1292 659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe 83 PID 1292 wrote to memory of 2044 1292 659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe 83 PID 2044 wrote to memory of 3412 2044 un221871.exe 85 PID 2044 wrote to memory of 3412 2044 un221871.exe 85 PID 2044 wrote to memory of 3412 2044 un221871.exe 85 PID 3412 wrote to memory of 3988 3412 pro4485.exe 88 PID 3412 wrote to memory of 3988 3412 pro4485.exe 88 PID 3412 wrote to memory of 3988 3412 pro4485.exe 88 PID 3412 wrote to memory of 3988 3412 pro4485.exe 88 PID 3412 wrote to memory of 3988 3412 pro4485.exe 88 PID 3412 wrote to memory of 3988 3412 pro4485.exe 88 PID 3412 wrote to memory of 3988 3412 pro4485.exe 88 PID 3412 wrote to memory of 3988 3412 pro4485.exe 88 PID 3412 wrote to memory of 3988 3412 pro4485.exe 88 PID 2044 wrote to memory of 336 2044 un221871.exe 89 PID 2044 wrote to memory of 336 2044 un221871.exe 89 PID 2044 wrote to memory of 336 2044 un221871.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe"C:\Users\Admin\AppData\Local\Temp\659ed428114d2a8cf1b492c95a46b371b1531c5acc0257cec4acc0b7aa1a671a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un221871.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un221871.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4485.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4485.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4485.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4485.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3988
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4678.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4678.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:336
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517KB
MD5fa595d02a1e12f6f29917f91827478f0
SHA12235843fec1799a7274bd8f361cf1fbb300a4307
SHA256829f24d7351a56ef7eba4bfb13c9ec6fc1775b4ed17ba70422ec0e420dcd5059
SHA512dc44dcc2a6db23feb6c4bdaf269fd9bf3660277205ac960751237f67fc0122ccec53db3643a90c827ec049c6093390def8f1b2b98977f13de219b60adba6a057
-
Filesize
237KB
MD5f1cedcd8d84a9fb0b2859dbbb92c9f70
SHA1c31cd91c1fdf62ae91f73c57c6f13ae14cadda93
SHA2569bf9655346b3984e1f5c859c39776318f43d6d21fc38ffae64c6bc732ccca3ec
SHA5125926987beb0be1e8e194ff629aa9576c0f971aa8ed41e78dc715c19d9b2c66e742d815ac66a4c3f7db7c325dc047b2b342e690f3da95187380ff0d3df88f1b5a
-
Filesize
294KB
MD5881e2f431c396967071e295bb7e71ddb
SHA1d1fa9aaf59b94cd5d94e0bf09095534fca820410
SHA2562ab6793794f87e49409a65fa75ad3d3c935be3223a5c641aff7ef643dfdb650d
SHA51262eaf38b38516ca818518bea1136b387c643d566b9f60bc1f4a8e1ad6e833be2f91c906b661db6cc1ebf7e371da058208074c2fa3f1c1f410de17d29b528afae