Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799.exe
Resource
win10v2004-20241007-en
General
-
Target
0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799.exe
-
Size
611KB
-
MD5
4d519be44bc1294d457408a23df00e98
-
SHA1
a786894d036c91d73d002938f675d25c5205886d
-
SHA256
0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799
-
SHA512
51df91d67c8de3846372d13324908a78062d2e762a80a474c3ee312d9582ca575d8a913c88d35789a646172d7ed6fa6263b3e879e529d3cfc9972ccc8c639687
-
SSDEEP
12288:7y90lDUY0Yy6zhmKybSmHuK8W4rwfb2Pwq2PE444mSA7niSG:7y4AY0Yy6zI1pDSIb2oJE444mSA7iSG
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023cb1-12.dat healer behavioral1/memory/2532-15-0x0000000000A30000-0x0000000000A3A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 32244164.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 32244164.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 32244164.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 32244164.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 32244164.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 32244164.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/2368-21-0x0000000002730000-0x000000000276C000-memory.dmp family_redline behavioral1/memory/2368-23-0x0000000005400000-0x000000000543A000-memory.dmp family_redline behavioral1/memory/2368-37-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-27-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-25-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-24-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-45-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-87-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-85-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-83-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-81-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-77-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-75-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-73-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-71-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-69-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-67-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-65-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-61-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-59-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-57-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-55-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-53-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-51-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-49-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-43-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-41-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-39-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-35-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-33-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-31-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-29-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-79-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-63-0x0000000005400000-0x0000000005435000-memory.dmp family_redline behavioral1/memory/2368-47-0x0000000005400000-0x0000000005435000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 1336 st027898.exe 2532 32244164.exe 2368 kp198828.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 32244164.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st027898.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language st027898.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kp198828.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2532 32244164.exe 2532 32244164.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2532 32244164.exe Token: SeDebugPrivilege 2368 kp198828.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4960 wrote to memory of 1336 4960 0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799.exe 83 PID 4960 wrote to memory of 1336 4960 0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799.exe 83 PID 4960 wrote to memory of 1336 4960 0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799.exe 83 PID 1336 wrote to memory of 2532 1336 st027898.exe 84 PID 1336 wrote to memory of 2532 1336 st027898.exe 84 PID 1336 wrote to memory of 2368 1336 st027898.exe 95 PID 1336 wrote to memory of 2368 1336 st027898.exe 95 PID 1336 wrote to memory of 2368 1336 st027898.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799.exe"C:\Users\Admin\AppData\Local\Temp\0442f44fc672971161914640763b8111a3d177e3b66669b263dc4e3a8aeec799.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st027898.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st027898.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\32244164.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\32244164.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp198828.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp198828.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457KB
MD539daf655846eb53461d6f068116a6738
SHA191d2ad0357cdeaec3243686c6f8378fc3cb5b1fd
SHA256f89c67bdb9a19133ced2b0f1c6bd2eea0f352fd9792d713c9f3fca3acaf254f7
SHA5122f5cb05168dfe3db656429f8fe133166fa6c81bffd707b8c5a3036acbfb300b672e9102f9bb556cd67f8876ad20218d41e2037e4c02316ca7141593b0e44b9e2
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
459KB
MD5d2dd6d513278088043f2c843606d32e4
SHA1209da3bf1388bec7b4ff49b8b254a1d56d20c7be
SHA25671eff2a0b638364a485917924ed83023b8876936fd86b325d59e39d50701336e
SHA51220c937a6e25353151eff425aefdf3c6d1a18a78bdc4749b7b131ce4a6d1091a0092558a169669491db255c6b604f5f681d84ca4739e0e0cbbe57ff686f45e8bc