Analysis
-
max time kernel
116s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5.exe
Resource
win10v2004-20241007-en
General
-
Target
098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5.exe
-
Size
521KB
-
MD5
4ea1d02b11bb8449273e0ae7582933ed
-
SHA1
7262c87a3f0e5c2e23c43c2ae29cd38a7fe4fc58
-
SHA256
098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5
-
SHA512
d9184ab9c791182467451838535258bb8181a8c169c76f83e300c7cf2492f74ad17a896e0c860cdd9caae5962f3cc644b6ebf31a5a5e27fdaf7377dd971f2917
-
SSDEEP
12288:rMr7y90/U4qefnlR4iknoU/3rYxzP38B+:Eyy/FKnok7gvW+
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023ca2-12.dat healer behavioral1/memory/1940-15-0x0000000000A80000-0x0000000000A8A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr286755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr286755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr286755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr286755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr286755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr286755.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/3980-21-0x00000000025D0000-0x0000000002616000-memory.dmp family_redline behavioral1/memory/3980-23-0x00000000027D0000-0x0000000002814000-memory.dmp family_redline behavioral1/memory/3980-31-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-33-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-29-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-27-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-81-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-63-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-25-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-24-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-87-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-85-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-83-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-79-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-77-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-75-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-73-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-71-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-69-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-67-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-65-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-61-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-59-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-57-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-55-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-53-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-52-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-49-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-48-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-45-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-43-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-41-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-39-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-37-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline behavioral1/memory/3980-35-0x00000000027D0000-0x000000000280F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2756 ziTC3357.exe 1940 jr286755.exe 3980 ku301536.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr286755.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziTC3357.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ziTC3357.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku301536.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1940 jr286755.exe 1940 jr286755.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1940 jr286755.exe Token: SeDebugPrivilege 3980 ku301536.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2756 1348 098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5.exe 83 PID 1348 wrote to memory of 2756 1348 098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5.exe 83 PID 1348 wrote to memory of 2756 1348 098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5.exe 83 PID 2756 wrote to memory of 1940 2756 ziTC3357.exe 84 PID 2756 wrote to memory of 1940 2756 ziTC3357.exe 84 PID 2756 wrote to memory of 3980 2756 ziTC3357.exe 93 PID 2756 wrote to memory of 3980 2756 ziTC3357.exe 93 PID 2756 wrote to memory of 3980 2756 ziTC3357.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5.exe"C:\Users\Admin\AppData\Local\Temp\098e788f78c64635cbe90f4d58897e01a63bf45902a691cb37ddf7ac526c29b5.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTC3357.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTC3357.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr286755.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr286755.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku301536.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku301536.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
379KB
MD5dcc79cace4f288980b69c3960a406d48
SHA13302ecd47cd375b59a497bbfe2fb6d48d1e8d73f
SHA256effacd15a4cd646bd96bf5263336ce2e3c005dd9396e346321dd656e0f49afed
SHA51270eea60813fd794ba4c1131db4f01f52c094921dfa91389bbca984dc0fb6c911442818250ccfa674fe08266a86329ce9f0a338652836a13427f21af691b98786
-
Filesize
11KB
MD5efeeda40c40cace9285277ac2e8086c7
SHA1ddcc6fd29f5d7f77773ca19330ddb63330646644
SHA2563d1ba545074d04ff68022e2837500167342aecf56c1c7766827ace8438439fc1
SHA5129dfa63390688caf88726a797bbc8a66012f6278e28f989f996087a1687660fae3ef12ac3ceebf7dd88a525599f1f1360c7d863e0ecf1cb05df400cb9079161fb
-
Filesize
294KB
MD59355ae10e162d7e155db05efa095b0a0
SHA15cb78f0d2aea42771f9b403322cc62c3a7e0860d
SHA25616824c5cd606d95da6c378f6c15293ec14cc4b43c8d5aa6f5475d8e8bb4596a5
SHA5125f40705e625ab5e15fe92a9a941f6993148fbc5f36d81ce9481822627c3aeafc70fb381614820fd86b333ceb7c957cc2b474da0aa07b2f477d64d585efab2cba