Analysis
-
max time kernel
111s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 20:31
Static task
static1
Behavioral task
behavioral1
Sample
45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exe
Resource
win10v2004-20241007-en
General
-
Target
45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exe
-
Size
659KB
-
MD5
50d9a321b1ddbc08636df1e03e07eb80
-
SHA1
28e98ee469ada88bbcc93e197c95cd36fc59c10b
-
SHA256
45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8
-
SHA512
875d7ebbea17e7c8e2b1485437446bec3c2831c4e26f917fbe4f0d1e367085c872cad06291527344087616028b8d0e89b95e1f686fd332042c88a178c292b1b7
-
SSDEEP
12288:LMrjy90LUyvlQ3jDZzFGajY85CYayiau7ZSala7sl6RY+d9:oyGlQ3rj30YuyalHsa+H
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3160-27-0x00000000008C0000-0x00000000008DA000-memory.dmp healer behavioral1/memory/3160-29-0x0000000002230000-0x0000000002248000-memory.dmp healer behavioral1/memory/3160-32-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-59-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-57-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-55-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-53-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-51-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-49-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-47-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-45-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-43-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-35-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-34-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-41-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-39-0x0000000002230000-0x0000000002242000-memory.dmp healer behavioral1/memory/3160-37-0x0000000002230000-0x0000000002242000-memory.dmp healer -
Healer family
-
Processes:
pro5355.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro5355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro5355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro5355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro5355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro5355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro5355.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1112-30-0x0000000002430000-0x0000000002476000-memory.dmp family_redline behavioral1/memory/1112-31-0x00000000050B0000-0x00000000050F4000-memory.dmp family_redline behavioral1/memory/1112-89-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-87-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-85-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-83-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-81-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-79-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-77-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-75-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-73-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-71-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-69-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-65-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-63-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-61-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-60-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-91-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline behavioral1/memory/1112-67-0x00000000050B0000-0x00000000050EF000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
Processes:
un476497.exepro5355.exepro5355.exequ5839.exepid Process 4736 un476497.exe 1408 pro5355.exe 3160 pro5355.exe 1112 qu5839.exe -
Processes:
pro5355.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro5355.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro5355.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exeun476497.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un476497.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro5355.exedescription pid Process procid_target PID 1408 set thread context of 3160 1408 pro5355.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exeun476497.exepro5355.exepro5355.exequ5839.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un476497.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro5355.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pro5355.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu5839.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pro5355.exepid Process 3160 pro5355.exe 3160 pro5355.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pro5355.exequ5839.exedescription pid Process Token: SeDebugPrivilege 3160 pro5355.exe Token: SeDebugPrivilege 1112 qu5839.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exeun476497.exepro5355.exedescription pid Process procid_target PID 4800 wrote to memory of 4736 4800 45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exe 83 PID 4800 wrote to memory of 4736 4800 45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exe 83 PID 4800 wrote to memory of 4736 4800 45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exe 83 PID 4736 wrote to memory of 1408 4736 un476497.exe 84 PID 4736 wrote to memory of 1408 4736 un476497.exe 84 PID 4736 wrote to memory of 1408 4736 un476497.exe 84 PID 1408 wrote to memory of 3160 1408 pro5355.exe 88 PID 1408 wrote to memory of 3160 1408 pro5355.exe 88 PID 1408 wrote to memory of 3160 1408 pro5355.exe 88 PID 1408 wrote to memory of 3160 1408 pro5355.exe 88 PID 1408 wrote to memory of 3160 1408 pro5355.exe 88 PID 1408 wrote to memory of 3160 1408 pro5355.exe 88 PID 1408 wrote to memory of 3160 1408 pro5355.exe 88 PID 1408 wrote to memory of 3160 1408 pro5355.exe 88 PID 1408 wrote to memory of 3160 1408 pro5355.exe 88 PID 4736 wrote to memory of 1112 4736 un476497.exe 89 PID 4736 wrote to memory of 1112 4736 un476497.exe 89 PID 4736 wrote to memory of 1112 4736 un476497.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exe"C:\Users\Admin\AppData\Local\Temp\45ca9c62cbfc50748697d4ed00ef5c66d60582dbd10d94f88eb53a77f13df6d8N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un476497.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un476497.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5355.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5355.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5355.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5355.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5839.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5839.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517KB
MD5d67ad4ec73dc55c66cf686a14b3a959c
SHA1f9e8ee9a06b4626081d8f678c1dba363fd718a65
SHA256ccf29cb7a247613252b931070b38cb39a3c6d64662e369551d61911ea5d5fabf
SHA512704226f056f355290259141a114e15f3aa73a513d05d6781891939ef72c93e79552482fa8c47e28c3adc3200c1ffd7784608c5439b8b4f83b2db764235cba21c
-
Filesize
237KB
MD5757b21b2f02e86f76b2db189b14a9c8b
SHA178dc622f3edeec778557e78d77618bb659d41aaf
SHA25669634db2a628037c4ef3d277de12c31962a1dc420e41e2f9f201a0b18a2920af
SHA5120b4319fc6c35f90dc74c42f99a02084dc3d25eedb18b98be46ed6269a48421b0a0d4f957e1aec42f645d4e8c59118f6de67758d12935e4c60b848acff9c5a495
-
Filesize
294KB
MD585037860efb74eb3e17a5b3b38b5944e
SHA156ff1ad47d214bc6fb2d9c98db0bc2741226d7e3
SHA256db9f58ef5bcdd1842d7ccd764ba068a913b5fda798b19e9583cdf284a47fc685
SHA51256bd49b85e106dc80a0c9c90139ec1ef31243df2242e58eddec3fd326effae5195d7563d356d92462b126931a4fbf69d186509aa954a2e8ea591dae7917c836c