Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d.exe
Resource
win10v2004-20241007-en
General
-
Target
f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d.exe
-
Size
611KB
-
MD5
74833203c403021faa9f2e1c0d25e7f3
-
SHA1
75c719a076b25b7206be27738887bd50005e1396
-
SHA256
f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d
-
SHA512
cc3cfde8833a5901261005011bd4749de634dd2cc57117d3087770a4ab00e72d1255e6d2fd276460921087fc0b48e9ae2b360801ae35bc137566a3636295a4be
-
SSDEEP
12288:Jy90875YJOlG4Sv2ff/kqgS9zIiIdCvMDa94ic:JyZ7RS+nZ98iIdOMDaHc
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b93-12.dat healer behavioral1/memory/3460-15-0x0000000000130000-0x000000000013A000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 89226167.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 89226167.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 89226167.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 89226167.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 89226167.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 89226167.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/3880-22-0x0000000002710000-0x000000000274C000-memory.dmp family_redline behavioral1/memory/3880-24-0x00000000053D0000-0x000000000540A000-memory.dmp family_redline behavioral1/memory/3880-25-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-82-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-88-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-86-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-84-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-80-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-78-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-76-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-72-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-68-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-66-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-64-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-62-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-60-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-58-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-56-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-54-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-52-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-48-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-46-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-44-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-40-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-36-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-34-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-32-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-30-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-74-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-70-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-50-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-42-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-38-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-28-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline behavioral1/memory/3880-26-0x00000000053D0000-0x0000000005405000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2340 st623528.exe 3460 89226167.exe 3880 kp467859.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 89226167.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st623528.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language st623528.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kp467859.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3460 89226167.exe 3460 89226167.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3460 89226167.exe Token: SeDebugPrivilege 3880 kp467859.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 364 wrote to memory of 2340 364 f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d.exe 83 PID 364 wrote to memory of 2340 364 f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d.exe 83 PID 364 wrote to memory of 2340 364 f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d.exe 83 PID 2340 wrote to memory of 3460 2340 st623528.exe 84 PID 2340 wrote to memory of 3460 2340 st623528.exe 84 PID 2340 wrote to memory of 3880 2340 st623528.exe 93 PID 2340 wrote to memory of 3880 2340 st623528.exe 93 PID 2340 wrote to memory of 3880 2340 st623528.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d.exe"C:\Users\Admin\AppData\Local\Temp\f37659549cb2cfd920edc790fdf8e107bc15798455760bf11f53db6ee91af68d.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st623528.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st623528.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\89226167.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\89226167.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp467859.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp467859.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3880
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457KB
MD56b321ae90270fd92cdd6e5b91321f0bd
SHA16cc1267cec8ce2793c64a34671c30944abaf0feb
SHA256ddf9b628543930ae93288cfae6cbed73f9abc1544f7dc9b27ccf82e63bc73198
SHA512518c981210caf96a120aa4c51fea4a8612e8b971e40273b006ab3113408ce56e1585eec83d777d8805c30f0482ad4eb408902dab5e497adccb400cb661fcfeed
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
459KB
MD54f8aaec67752b9073b76bf609a19a608
SHA1325ebf43eb3c5008eb0e28fe93b046dce63bc584
SHA2569ea78c559dcd58194c98741381edd13ec121b2232b642bd40bb4690c194316cf
SHA5120c20d886797933f59d4a37a5547686c5b39fec4726803aa2a8c150aba0be945f2f32afc7f3360b2b19a07b8e2378d920cd0ab9a42e20e5ecb1a7def10d530726