Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2023, 20:01

General

  • Target

    61b58351b6c4f111d36c99a0b2423d39.exe

  • Size

    529KB

  • MD5

    61b58351b6c4f111d36c99a0b2423d39

  • SHA1

    2b702240763744c9e93f19905f744530d551cf3c

  • SHA256

    7f8953281cf918422ed33f6126aab3fe22a9ffe10a04a003320f348c96172cad

  • SHA512

    acad90e6dbee95ab217e9ebaabcf58cd7764590403305da89f95bccb3ce65954d94ab5847790594d606aee18e07b053187de190c27b340bdd4900dbff6b761f3

  • SSDEEP

    12288:2MgsfvmaRdnQgOtHKec+85cDJc3IhJFoQTDkgx:2Mgmvm82gGHPtACu4Dkgx

Malware Config

Extracted

Family

redline

Botnet

furod

C2

77.91.68.70:19073

Attributes
  • auth_value

    d2386245fe11799b28b4521492a5879d

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61b58351b6c4f111d36c99a0b2423d39.exe
    "C:\Users\Admin\AppData\Local\Temp\61b58351b6c4f111d36c99a0b2423d39.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5016
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe
        3⤵
        • Executes dropped EXE
        PID:3188

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

    Filesize

    226B

    MD5

    916851e072fbabc4796d8916c5131092

    SHA1

    d48a602229a690c512d5fdaf4c8d77547a88e7a2

    SHA256

    7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

    SHA512

    07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe

    Filesize

    260KB

    MD5

    158369a68427f760955993a82c6cf6c1

    SHA1

    3ac577746adafbf4247ceceb2fdf79b7899857d6

    SHA256

    5a3bfd93f1a6251f884a110a582177f9238b0cf0aaebcaba59648e2e9c367cce

    SHA512

    dcff982504ba9c8d33f026bbc9deb3b1d020f0bb90144abe1cea7d1064dbf2ec8815e6d1856581af29f31090986108c67499eef31c21fcfa8a9e8b6ea58801fd

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5490391.exe

    Filesize

    260KB

    MD5

    158369a68427f760955993a82c6cf6c1

    SHA1

    3ac577746adafbf4247ceceb2fdf79b7899857d6

    SHA256

    5a3bfd93f1a6251f884a110a582177f9238b0cf0aaebcaba59648e2e9c367cce

    SHA512

    dcff982504ba9c8d33f026bbc9deb3b1d020f0bb90144abe1cea7d1064dbf2ec8815e6d1856581af29f31090986108c67499eef31c21fcfa8a9e8b6ea58801fd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe

    Filesize

    96KB

    MD5

    29d389c10ced1d150f8c5d8206c3b798

    SHA1

    0403c9a42287e4c077219da03f5bf5b0df1fe12c

    SHA256

    a890b005219be450e2107de584dbf36b19f071db4a011352e241032f97bc7b27

    SHA512

    5312054895d83f55441e08b327714b27359c2e374d35a9c3e1cb50728a41d514ed88bdfae4889c0e620d1cbf71f15bd86494c11eb93ab234490158d30865126f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0636062.exe

    Filesize

    96KB

    MD5

    29d389c10ced1d150f8c5d8206c3b798

    SHA1

    0403c9a42287e4c077219da03f5bf5b0df1fe12c

    SHA256

    a890b005219be450e2107de584dbf36b19f071db4a011352e241032f97bc7b27

    SHA512

    5312054895d83f55441e08b327714b27359c2e374d35a9c3e1cb50728a41d514ed88bdfae4889c0e620d1cbf71f15bd86494c11eb93ab234490158d30865126f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe

    Filesize

    257KB

    MD5

    42d183766ce86938595cec7adf64190d

    SHA1

    c7b0b5ebf7fd48dcc31b773b96d004930f736c00

    SHA256

    9dd14c32dfba7d12faa9823549585e40d21e9b33055f5aaea37d224156ed6011

    SHA512

    89f1ca220984e127516fa1e30615b53a36e7f386ddeaeb85db438c9ebf32db7a14de48b8e1939a9eafb06f8c18518fa45847c47a7d96595639098308468d0e4e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l2107065.exe

    Filesize

    257KB

    MD5

    42d183766ce86938595cec7adf64190d

    SHA1

    c7b0b5ebf7fd48dcc31b773b96d004930f736c00

    SHA256

    9dd14c32dfba7d12faa9823549585e40d21e9b33055f5aaea37d224156ed6011

    SHA512

    89f1ca220984e127516fa1e30615b53a36e7f386ddeaeb85db438c9ebf32db7a14de48b8e1939a9eafb06f8c18518fa45847c47a7d96595639098308468d0e4e

  • memory/680-133-0x00000000006B0000-0x0000000000724000-memory.dmp

    Filesize

    464KB

  • memory/3188-162-0x0000000000560000-0x0000000000590000-memory.dmp

    Filesize

    192KB

  • memory/3188-167-0x000000000A0D0000-0x000000000A6E8000-memory.dmp

    Filesize

    6.1MB

  • memory/3188-168-0x000000000A760000-0x000000000A86A000-memory.dmp

    Filesize

    1.0MB

  • memory/3188-169-0x000000000A8A0000-0x000000000A8B2000-memory.dmp

    Filesize

    72KB

  • memory/3188-170-0x000000000A8C0000-0x000000000A8FC000-memory.dmp

    Filesize

    240KB

  • memory/3188-171-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/3188-172-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/5016-153-0x00000000001F0000-0x00000000001FA000-memory.dmp

    Filesize

    40KB