Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 20:45
Static task
static1
Behavioral task
behavioral1
Sample
2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exe
Resource
win10v2004-20241007-en
General
-
Target
2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exe
-
Size
695KB
-
MD5
8baffb2489069b083dab9ae9a8553318
-
SHA1
98ab14ef96f3cbda8c19b0f4bfc918f75e235a76
-
SHA256
2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05
-
SHA512
fce01c9cecf4e6cebebee581dd4be7546cf49b34b905b5843001688d4b383a18c2f509bb0e10f4dec29247c67778de8fc396cac5cc6d21492d31b180bb49b40b
-
SSDEEP
12288:ny90t7V3B9m0jqDGut2uP28QSZRhuuHC0iDye7nOc4bDg:nyc7VRo0jyGutfxjvrle7nOTfg
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3988-17-0x0000000004B80000-0x0000000004B9A000-memory.dmp healer behavioral1/memory/3988-19-0x0000000004C00000-0x0000000004C18000-memory.dmp healer behavioral1/memory/3988-22-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-21-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-48-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-46-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-32-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-28-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-26-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-24-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-44-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-42-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-40-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-38-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-36-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-34-0x0000000004C00000-0x0000000004C13000-memory.dmp healer behavioral1/memory/3988-30-0x0000000004C00000-0x0000000004C13000-memory.dmp healer -
Healer family
-
Processes:
53290689.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 53290689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 53290689.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 53290689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 53290689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 53290689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 53290689.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2728-59-0x0000000004C10000-0x0000000004C4C000-memory.dmp family_redline behavioral1/memory/2728-60-0x0000000007190000-0x00000000071CA000-memory.dmp family_redline behavioral1/memory/2728-74-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-72-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-94-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-92-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-90-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-88-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-86-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-84-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-82-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-80-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-78-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-76-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-70-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-68-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-66-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-64-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-62-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline behavioral1/memory/2728-61-0x0000000007190000-0x00000000071C5000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
un807252.exe53290689.exerk994796.exepid Process 3124 un807252.exe 3988 53290689.exe 2728 rk994796.exe -
Processes:
53290689.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 53290689.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 53290689.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exeun807252.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un807252.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 3848 3988 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exeun807252.exe53290689.exerk994796.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un807252.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53290689.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rk994796.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
53290689.exepid Process 3988 53290689.exe 3988 53290689.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
53290689.exerk994796.exedescription pid Process Token: SeDebugPrivilege 3988 53290689.exe Token: SeDebugPrivilege 2728 rk994796.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exeun807252.exedescription pid Process procid_target PID 1796 wrote to memory of 3124 1796 2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exe 83 PID 1796 wrote to memory of 3124 1796 2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exe 83 PID 1796 wrote to memory of 3124 1796 2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exe 83 PID 3124 wrote to memory of 3988 3124 un807252.exe 85 PID 3124 wrote to memory of 3988 3124 un807252.exe 85 PID 3124 wrote to memory of 3988 3124 un807252.exe 85 PID 3124 wrote to memory of 2728 3124 un807252.exe 100 PID 3124 wrote to memory of 2728 3124 un807252.exe 100 PID 3124 wrote to memory of 2728 3124 un807252.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exe"C:\Users\Admin\AppData\Local\Temp\2b576ef794d567abd0bc1bade2aeee658b279c44fa9faafe05f959612bb7dd05.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un807252.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un807252.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53290689.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53290689.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3988 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 10844⤵
- Program crash
PID:3848
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk994796.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk994796.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3988 -ip 39881⤵PID:2080
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
541KB
MD5ed13505df2286e5ae96a34c065bc57c1
SHA10770aabf4782f12e3607ea462c7711492c5dcbad
SHA2565ec70a11fdbab2c76d59fba29f9e42abab67f4ca8be4c8d1f30e8a1a3f527515
SHA5127b7b6f4a7dc870d70e79ec5cf57f37fe07dfad2d21adf8ef4a664e1452af5c15bbeb8053674705199b0887d3296fb9dbf7b910050396e8241f8f0780042a7075
-
Filesize
264KB
MD551a801034a5d45f54dd55de369c0adc2
SHA1c7f168526a9d8e8ea55c201451311c79cdb7e2bf
SHA256903f54a25c54e322b767a7439c411e2f9fbcd79af576315d0976eb7ad72f3ec3
SHA5125e82f4429e41b3fbd959d6da6ed06ee3263b72d3b91c7c971032aed3c441f45d85e579302563d6ac5531224af6cd68092485e36c994e838607c4b55e70f70828
-
Filesize
348KB
MD50a0faa1473bd0474af0c37e5f5b062ab
SHA102ebe9bc96029de80fa458530f39c4776d3fcdca
SHA256d431bf8c906c891f7583696639193d132051a91c51206423170162debbb1d94b
SHA512e90e9e3ebe0d54893c049b641e9feecc7a9c1db5887a16af175aa00e6d055cb169f10bbff8e72af4da2925c2414f43ff1fd0da185f4c7ca89a190c9d4f685520