Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8.exe
Resource
win10v2004-20241007-en
General
-
Target
f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8.exe
-
Size
666KB
-
MD5
58d49f9b0107d8032c25ccdb80c3d109
-
SHA1
7c0e75da21c944ca0f54243b2d7700269df6b928
-
SHA256
f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8
-
SHA512
a3f2781cb4ba75cd2f8c1f671d5a9528ecbf4f8e1451a8f695120c2656862da8b52ce41d7bc6d733cf6b95fe6bf8b420cfd4ae18b695c7166575d8b61a8f6bb9
-
SSDEEP
12288:EMrQy90TRw31J6VGuFM65q2lw1Mm8+umSWw2WYhW7hT1hNfv:cyew3D6XFMIm1Mm8d8NWvhJ
Malware Config
Extracted
redline
ruzhpe
pepunn.com:4162
-
auth_value
f735ced96ae8d01d0bd1d514240e54e0
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/3008-19-0x0000000002350000-0x000000000236A000-memory.dmp healer behavioral1/memory/3008-21-0x00000000023A0000-0x00000000023B8000-memory.dmp healer behavioral1/memory/3008-25-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-47-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-45-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-44-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-41-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-39-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-37-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-35-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-33-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-31-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-29-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-27-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-49-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-22-0x00000000023A0000-0x00000000023B2000-memory.dmp healer behavioral1/memory/3008-23-0x00000000023A0000-0x00000000023B2000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" urVu48xm97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" urVu48xm97.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection urVu48xm97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" urVu48xm97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" urVu48xm97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" urVu48xm97.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
resource yara_rule behavioral1/memory/4180-60-0x00000000024C0000-0x0000000002506000-memory.dmp family_redline behavioral1/memory/4180-61-0x0000000004BC0000-0x0000000004C04000-memory.dmp family_redline behavioral1/memory/4180-65-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-77-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-95-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-93-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-91-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-89-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-85-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-83-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-81-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-79-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-75-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-74-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-71-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-69-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-67-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-87-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-63-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/4180-62-0x0000000004BC0000-0x0000000004BFE000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 440 yceL52PD30.exe 3008 urVu48xm97.exe 4180 wrRC30RW34.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features urVu48xm97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" urVu48xm97.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" yceL52PD30.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1832 3008 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yceL52PD30.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language urVu48xm97.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wrRC30RW34.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3008 urVu48xm97.exe 3008 urVu48xm97.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3008 urVu48xm97.exe Token: SeDebugPrivilege 4180 wrRC30RW34.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1744 wrote to memory of 440 1744 f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8.exe 83 PID 1744 wrote to memory of 440 1744 f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8.exe 83 PID 1744 wrote to memory of 440 1744 f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8.exe 83 PID 440 wrote to memory of 3008 440 yceL52PD30.exe 84 PID 440 wrote to memory of 3008 440 yceL52PD30.exe 84 PID 440 wrote to memory of 3008 440 yceL52PD30.exe 84 PID 440 wrote to memory of 4180 440 yceL52PD30.exe 95 PID 440 wrote to memory of 4180 440 yceL52PD30.exe 95 PID 440 wrote to memory of 4180 440 yceL52PD30.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8.exe"C:\Users\Admin\AppData\Local\Temp\f11216fdc1245867881403846609d2f7727dfba1b713a495cf867f6b871b15b8.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yceL52PD30.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yceL52PD30.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urVu48xm97.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urVu48xm97.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 10844⤵
- Program crash
PID:1832
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrRC30RW34.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrRC30RW34.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3008 -ip 30081⤵PID:2544
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
522KB
MD55a4280594a93ca558918583231fb9241
SHA1a936f7424b5f6c4926001bffe1759c36d217623b
SHA25614249036212f569d3126bdf684ff33bb6b6c9389c1668e2019ae5a75985a4270
SHA512ab5f0b62e41b601a4956ebc2e74ad89b4a80ab01c5b5761f2eb91423b89a0cbe32c1fbd55172cffc27c864ee89a9dc0fffb2bbb7a553fa6760262cc4e47c6ca8
-
Filesize
250KB
MD5e86d6512a605f1fcd0435b9d980a7473
SHA13c256c47fc1b8d43a2e64ed7463e47301178380d
SHA2564d3feae0f76c5b673ad0b420fb396e931e93d9bf08629742e2f1a47716ad4ad3
SHA512be1b75490e6a8534eaed0ecb8516ad73e95542787d7123ca205ac52a82637abafe7c44479e2d994e10a221c0b7fe193f3c881d660485a0f415246aa70e7b7d78
-
Filesize
309KB
MD5c399447de03079c2f5c1482ddeb1706b
SHA1dbeaa79a4b8e1190fc5c054b408948631dac089c
SHA256afce08c2456f2f7a0ca5d02fca432a29b387b7f1d6fb1d58c6fc6da96749f7d7
SHA5123f7001cfb7e54a471786f96c6788858718b867cdcd9c2caabd19018f74228461bcfa45211c11e5a541fdb4fd6c4ff0c330e6b6c8734304d670fc393072480b3c