Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe
Resource
win10v2004-20241007-en
General
-
Target
c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe
-
Size
488KB
-
MD5
38ccd2ad873b486ab74bab4c266beb67
-
SHA1
0b599ffdd50fbe98f38b1081c6ee4da66b3c5182
-
SHA256
c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9
-
SHA512
4e2d9624c7e737c87598ee65cf0e545806102f37d6ad8d1e0b24a4612e6390252261bde02c34e6efc853ac095ab2a5b42d208bc15ef20a54f52fdfc68e54a9eb
-
SSDEEP
12288:dy90DyKZqLtr15nS2hvczco9L2W+KfDe45RvX/:dyTh1LEZL2Ef645Rf/
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/2028-8-0x00000000025C0000-0x00000000025DA000-memory.dmp healer behavioral1/memory/2028-11-0x0000000004AC0000-0x0000000004AD8000-memory.dmp healer behavioral1/memory/2028-40-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-36-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-34-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-32-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-30-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-28-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-26-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-24-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-22-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-20-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-18-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-16-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-14-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2028-13-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 09510150.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 09510150.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 09510150.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 09510150.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 09510150.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 09510150.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
resource yara_rule behavioral1/memory/2412-53-0x0000000004B90000-0x0000000004BCC000-memory.dmp family_redline behavioral1/memory/2412-54-0x0000000004E40000-0x0000000004E7A000-memory.dmp family_redline behavioral1/memory/2412-66-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-68-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-90-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-88-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-86-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-84-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-82-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-80-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-78-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-76-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-74-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-72-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-70-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-64-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-62-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-60-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-58-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-56-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline behavioral1/memory/2412-55-0x0000000004E40000-0x0000000004E75000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 2 IoCs
pid Process 2028 09510150.exe 2412 kp716169.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 09510150.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 09510150.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kp716169.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09510150.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2028 09510150.exe 2028 09510150.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2028 09510150.exe Token: SeDebugPrivilege 2412 kp716169.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2028 2964 c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe 83 PID 2964 wrote to memory of 2028 2964 c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe 83 PID 2964 wrote to memory of 2028 2964 c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe 83 PID 2964 wrote to memory of 2412 2964 c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe 91 PID 2964 wrote to memory of 2412 2964 c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe 91 PID 2964 wrote to memory of 2412 2964 c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe"C:\Users\Admin\AppData\Local\Temp\c00d042d0194201100661810be544d85364685e725bbc663ef06e8344dfc8ee9.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\09510150.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\09510150.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kp716169.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kp716169.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD52b71f4b18ac8214a2bff547b6ce2f64f
SHA1b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5
SHA256f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc
SHA51233518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177
-
Filesize
341KB
MD5443729794c983b0277558887b029eb18
SHA11e1a67f0a6fc9c34432a917558b17ead895b49d7
SHA256f5681d48a3780f584f761b636925741847df78fb6be8c95930183c528e7fd16b
SHA512f9dbfeb41a7880210f3fc34a50d7b029de492fa97c2ef6aafcb6b3610b0ded2cc673c03e842101fd6d03638f41b9698030c1beffb8602e83124de45e2e7dc7d0