Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe
Resource
win10v2004-20241007-en
General
-
Target
e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe
-
Size
529KB
-
MD5
ee9f947fd512d62a3330478d0cb151bd
-
SHA1
8cc30a4f5091152e69bf96edff6c0645a3c13897
-
SHA256
e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70
-
SHA512
0914aee41a4b767a0dda452807c71629725923108296b17b1feed117dd4674ff44b537b74c1c4d16dd4e83b7d03d34d9112c386573caacfc141cf3769efb201f
-
SSDEEP
12288:zMrIy901/xLNPKtttzRrjJOS7E8+x4CGG8:XyK/atRrjp7E8UlGF
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023cb1-13.dat healer behavioral1/memory/1596-15-0x0000000000430000-0x000000000043A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr201859.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr201859.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr201859.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr201859.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr201859.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr201859.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/2348-22-0x0000000004970000-0x00000000049B6000-memory.dmp family_redline behavioral1/memory/2348-24-0x0000000007160000-0x00000000071A4000-memory.dmp family_redline behavioral1/memory/2348-32-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-38-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-88-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-86-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-84-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-82-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-80-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-78-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-74-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-72-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-70-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-68-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-66-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-64-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-62-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-60-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-58-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-54-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-52-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-50-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-48-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-46-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-44-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-42-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-40-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-36-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-34-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-30-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-28-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-76-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-56-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-26-0x0000000007160000-0x000000000719F000-memory.dmp family_redline behavioral1/memory/2348-25-0x0000000007160000-0x000000000719F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2156 zizp8690.exe 1596 jr201859.exe 2348 ku041375.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr201859.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zizp8690.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3268 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zizp8690.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku041375.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1596 jr201859.exe 1596 jr201859.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1596 jr201859.exe Token: SeDebugPrivilege 2348 ku041375.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2156 1304 e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe 83 PID 1304 wrote to memory of 2156 1304 e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe 83 PID 1304 wrote to memory of 2156 1304 e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe 83 PID 2156 wrote to memory of 1596 2156 zizp8690.exe 84 PID 2156 wrote to memory of 1596 2156 zizp8690.exe 84 PID 2156 wrote to memory of 2348 2156 zizp8690.exe 97 PID 2156 wrote to memory of 2348 2156 zizp8690.exe 97 PID 2156 wrote to memory of 2348 2156 zizp8690.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe"C:\Users\Admin\AppData\Local\Temp\e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizp8690.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizp8690.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr201859.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr201859.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku041375.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku041375.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3268
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
388KB
MD572561f604ea3dec5f67cd49dcb915c61
SHA127c80d71c57c6cf8682bfc09380cef0c3f64d57d
SHA256373b64ed15138fb8e5ef2cf4ec405e105d0d918d9dc10124102400a9779e708d
SHA512ffe843cd1899157d22f7356545e5bf627b50bedbd57c074ce2525a0d8914aa146ec60f3ac5558291dc1cf22f5490d822c74ae4d668c7db0f733dcf6bda288054
-
Filesize
11KB
MD523b33000afb994059f5da681c613980f
SHA1fca986918b5542a5c35402498556e075f15e91cd
SHA25670c4e7772e9bff2137631185bd0d7e0871d7db6fae1ccf0f2588583dd33299dc
SHA512044c9ad9cc0f67863981ffa13219dccef6493cbf6ec3de537481526f082968c22b0293b51adade65a4e7ba9533c7f8b5fc33e02ddbe007a71510682b07770d55
-
Filesize
354KB
MD57a41e6091d04288d798493587759de59
SHA1a6173ac8a8cc593c3e80eee4c8862fe015914577
SHA25625295e04008342ff2cf093b1c9a7f1d7f490999fdcd6c5287bf9a6c263950f2f
SHA5125d88334fb965f722602e0b8480091d8abd66a02936c815112f6b74d075324aa6cdd996460ed2fc871a6d1f2f782f7e7ed9eaa8bc63ef1caa4b00d610d5dc508a