Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe
Resource
win10v2004-20241007-en
General
-
Target
ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe
-
Size
392KB
-
MD5
70944f1f08a32d8bda2990e543c089f1
-
SHA1
90783f8e9d305bc64630a761b692964c0b5f16e5
-
SHA256
ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5
-
SHA512
e0032299a4a791a2a78ea72e07b285df57ebacfe036e35fddc19db08ec011a09468dc14490a7d9b2812f70e05d251c5415ccc253809b7b7778eea4b81a8d1ec1
-
SSDEEP
12288:1Mrdy90Sm7sETfxP6LrrQQ3Lqces4M9kl:oyDm7sEbxPBQ3GceuKl
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x000e000000023b72-6.dat healer behavioral1/memory/2328-8-0x0000000000920000-0x000000000092A000-memory.dmp healer -
Healer family
-
Processes:
jr513777.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr513777.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr513777.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr513777.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr513777.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr513777.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr513777.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2340-18-0x0000000003AD0000-0x0000000003B16000-memory.dmp family_redline behavioral1/memory/2340-20-0x00000000060D0000-0x0000000006114000-memory.dmp family_redline behavioral1/memory/2340-28-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-32-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-84-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-82-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-80-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-76-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-75-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-72-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-70-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-68-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-66-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-64-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-60-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-58-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-56-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-54-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-52-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-48-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-46-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-44-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-42-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-40-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-38-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-36-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-34-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-30-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-26-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-24-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-78-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-62-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-50-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-22-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline behavioral1/memory/2340-21-0x00000000060D0000-0x000000000610F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 2 IoCs
Processes:
jr513777.exeku985487.exepid Process 2328 jr513777.exe 2340 ku985487.exe -
Processes:
jr513777.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr513777.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exeku985487.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku985487.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
jr513777.exepid Process 2328 jr513777.exe 2328 jr513777.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
jr513777.exeku985487.exedescription pid Process Token: SeDebugPrivilege 2328 jr513777.exe Token: SeDebugPrivilege 2340 ku985487.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exedescription pid Process procid_target PID 4912 wrote to memory of 2328 4912 ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe 83 PID 4912 wrote to memory of 2328 4912 ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe 83 PID 4912 wrote to memory of 2340 4912 ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe 95 PID 4912 wrote to memory of 2340 4912 ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe 95 PID 4912 wrote to memory of 2340 4912 ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe"C:\Users\Admin\AppData\Local\Temp\ae424a1ebdd732c1348c708d55bd26148bde78ea82e7ad8373ae9e92d3dc0ca5.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr513777.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr513777.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku985487.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku985487.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD51aa707fed5a8592527423bab6d1fdcc8
SHA113ac8609ecbe1bdab59ab69567a31af9e788882a
SHA256ab1f8cf30dae527528990a04117c8d09c5103a083f6d375929f3ccf3e53add15
SHA5121bde684a930f3721da8ead17d7ecbdc6a25f19d1443bd9b5228a2d2a04ede76a672475f262ec086236a5075a3bdf30d340e3b3bf717644f183d3df190431320b
-
Filesize
359KB
MD57e97a9123cc709936384fc64bba5f954
SHA1f18bddc3a572d39334330a6ef183a3f279588975
SHA256ec9207f8421a3b7545de08caf41768a866ba342bc49f52e610bc24818b2f6744
SHA512d5d1f663ca4c1b2eff8761bbce3d138755a5b7175bc25c9ae58a3804d13852f583ded0d65e4bfd15f3f1b104febeea3bf928329ebb1e388c0cd35f1cfa093f3a