Analysis

  • max time kernel
    144s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2023, 19:10 UTC

General

  • Target

    829cadee0d03495a0fb24c959.exe

  • Size

    790KB

  • MD5

    829cadee0d03495a0fb24c959f11a1d0

  • SHA1

    016655462d6fe5340d1589e9f2e8e702c955184e

  • SHA256

    79281c19da4dcb0340c2f62b8ef029791a6f6772852ff45aa2108cdeae265b51

  • SHA512

    30f4960dfc0a38fbb0c24c3fea1ac38b16d74538a5610ab8d0fcc768f306dec4c579008089e53010aeecf3ce2792c2fbb63b64f655838582f5472279ff053262

  • SSDEEP

    24576:oLRlTv582gyB0OCJcdjtJcFxagh/3xO5fmCbz:oVZGMs0KwSOmCbz

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.68.70:19073

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\829cadee0d03495a0fb24c959.exe
    "C:\Users\Admin\AppData\Local\Temp\829cadee0d03495a0fb24c959.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5337196.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5337196.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1528549.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1528549.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8504945.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8504945.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8127655.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8127655.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2068
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3232627.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3232627.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2128
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c6110944.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c6110944.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2956

Network

    No results found
  • 77.91.68.70:19073
    c6110944.exe
    152 B
    3
  • 77.91.68.70:19073
    c6110944.exe
    152 B
    3
  • 77.91.68.70:19073
    c6110944.exe
    152 B
    3
  • 77.91.68.70:19073
    c6110944.exe
    152 B
    3
  • 77.91.68.70:19073
    c6110944.exe
    104 B
    2
No results found

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5337196.exe

    Filesize

    522KB

    MD5

    7373b097bafd17274a1638d896a01462

    SHA1

    7b87ad8ba8d89a5b0bd6d9deaa81f89fa0099f9c

    SHA256

    45059f7e13975168ed208f4d1f9db258fecb83b0c371f5b5ad6d57beb170e458

    SHA512

    1a665434315352fb14b22cc9c40d515294f0ed1e67e1b20f793414d7e51ea6938bdbffb45c99c75fc492a887737854c3cbd6daa32292998bf1a867f91b3d0b62

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5337196.exe

    Filesize

    522KB

    MD5

    7373b097bafd17274a1638d896a01462

    SHA1

    7b87ad8ba8d89a5b0bd6d9deaa81f89fa0099f9c

    SHA256

    45059f7e13975168ed208f4d1f9db258fecb83b0c371f5b5ad6d57beb170e458

    SHA512

    1a665434315352fb14b22cc9c40d515294f0ed1e67e1b20f793414d7e51ea6938bdbffb45c99c75fc492a887737854c3cbd6daa32292998bf1a867f91b3d0b62

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1528549.exe

    Filesize

    397KB

    MD5

    b52cd68a302934d0d9d7e2e84b61c277

    SHA1

    b8a2df4fb75145856af1d3404b66b28e0545a147

    SHA256

    f56a76bf5ebabd346eb8b57778c17347f62cb8d60e31e7f0b5cc368c4de4a667

    SHA512

    d5a9f9d827fccc1b922fbb655a11b231332c6b053eb77658a63decfeabed1d2cd31a9706f313c64b967207874351b34ec06573fc3532b59dcb81adc9290d8d21

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1528549.exe

    Filesize

    397KB

    MD5

    b52cd68a302934d0d9d7e2e84b61c277

    SHA1

    b8a2df4fb75145856af1d3404b66b28e0545a147

    SHA256

    f56a76bf5ebabd346eb8b57778c17347f62cb8d60e31e7f0b5cc368c4de4a667

    SHA512

    d5a9f9d827fccc1b922fbb655a11b231332c6b053eb77658a63decfeabed1d2cd31a9706f313c64b967207874351b34ec06573fc3532b59dcb81adc9290d8d21

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c6110944.exe

    Filesize

    258KB

    MD5

    1b08ba8ca1dc1d0fbfc322d6eb3e2840

    SHA1

    b72837e143a2ca428c6034577549abbddd1ac9be

    SHA256

    e6289cab0c6e2e23f834a677b79915edbdc2a0f0a55af98b61ea490735668282

    SHA512

    c29549a91a45a1384062170a0a61f28655c713540c872787475f4f6004a64efa60f05dde48bcdebd351d872121ed2a551e601741454f0108a4cdd1e52a587536

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c6110944.exe

    Filesize

    258KB

    MD5

    1b08ba8ca1dc1d0fbfc322d6eb3e2840

    SHA1

    b72837e143a2ca428c6034577549abbddd1ac9be

    SHA256

    e6289cab0c6e2e23f834a677b79915edbdc2a0f0a55af98b61ea490735668282

    SHA512

    c29549a91a45a1384062170a0a61f28655c713540c872787475f4f6004a64efa60f05dde48bcdebd351d872121ed2a551e601741454f0108a4cdd1e52a587536

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c6110944.exe

    Filesize

    258KB

    MD5

    1b08ba8ca1dc1d0fbfc322d6eb3e2840

    SHA1

    b72837e143a2ca428c6034577549abbddd1ac9be

    SHA256

    e6289cab0c6e2e23f834a677b79915edbdc2a0f0a55af98b61ea490735668282

    SHA512

    c29549a91a45a1384062170a0a61f28655c713540c872787475f4f6004a64efa60f05dde48bcdebd351d872121ed2a551e601741454f0108a4cdd1e52a587536

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8504945.exe

    Filesize

    197KB

    MD5

    eff0449d888c52064862022a63abf1c2

    SHA1

    60d66b9f330787edd78363f7bf58040d76be5c39

    SHA256

    390ede2a34ef1185d05a3087212902361ba84ba2cf7f0948b5b32aa72786c5b7

    SHA512

    928841a81c5e9597e1a4c914259761435e1e9360cd435286ddc9fa5051be3c0f60788b9ad21b0498c3bc5fe1e88ab153080717e7c538e5bef8bc222cc3fd950c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8504945.exe

    Filesize

    197KB

    MD5

    eff0449d888c52064862022a63abf1c2

    SHA1

    60d66b9f330787edd78363f7bf58040d76be5c39

    SHA256

    390ede2a34ef1185d05a3087212902361ba84ba2cf7f0948b5b32aa72786c5b7

    SHA512

    928841a81c5e9597e1a4c914259761435e1e9360cd435286ddc9fa5051be3c0f60788b9ad21b0498c3bc5fe1e88ab153080717e7c538e5bef8bc222cc3fd950c

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8127655.exe

    Filesize

    96KB

    MD5

    e63cc72c007efbd4e68369e1d1d736a9

    SHA1

    140dc0ec2a34c2807759f7abd732934ae017383e

    SHA256

    b5442b7bd45ad5e224a1a0e11bae8842290eacc44e5739caaa60c0320bf539ef

    SHA512

    779fae4ca2db99df8006d82a1c06e2b32ece6e349c5ac1fe3a9ce2b041eab2be8228942de293ff4d15764f23b647493918e8060f44bad2c603416a8fa03d6bb1

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8127655.exe

    Filesize

    96KB

    MD5

    e63cc72c007efbd4e68369e1d1d736a9

    SHA1

    140dc0ec2a34c2807759f7abd732934ae017383e

    SHA256

    b5442b7bd45ad5e224a1a0e11bae8842290eacc44e5739caaa60c0320bf539ef

    SHA512

    779fae4ca2db99df8006d82a1c06e2b32ece6e349c5ac1fe3a9ce2b041eab2be8228942de293ff4d15764f23b647493918e8060f44bad2c603416a8fa03d6bb1

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8127655.exe

    Filesize

    96KB

    MD5

    e63cc72c007efbd4e68369e1d1d736a9

    SHA1

    140dc0ec2a34c2807759f7abd732934ae017383e

    SHA256

    b5442b7bd45ad5e224a1a0e11bae8842290eacc44e5739caaa60c0320bf539ef

    SHA512

    779fae4ca2db99df8006d82a1c06e2b32ece6e349c5ac1fe3a9ce2b041eab2be8228942de293ff4d15764f23b647493918e8060f44bad2c603416a8fa03d6bb1

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3232627.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3232627.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v5337196.exe

    Filesize

    522KB

    MD5

    7373b097bafd17274a1638d896a01462

    SHA1

    7b87ad8ba8d89a5b0bd6d9deaa81f89fa0099f9c

    SHA256

    45059f7e13975168ed208f4d1f9db258fecb83b0c371f5b5ad6d57beb170e458

    SHA512

    1a665434315352fb14b22cc9c40d515294f0ed1e67e1b20f793414d7e51ea6938bdbffb45c99c75fc492a887737854c3cbd6daa32292998bf1a867f91b3d0b62

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v5337196.exe

    Filesize

    522KB

    MD5

    7373b097bafd17274a1638d896a01462

    SHA1

    7b87ad8ba8d89a5b0bd6d9deaa81f89fa0099f9c

    SHA256

    45059f7e13975168ed208f4d1f9db258fecb83b0c371f5b5ad6d57beb170e458

    SHA512

    1a665434315352fb14b22cc9c40d515294f0ed1e67e1b20f793414d7e51ea6938bdbffb45c99c75fc492a887737854c3cbd6daa32292998bf1a867f91b3d0b62

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v1528549.exe

    Filesize

    397KB

    MD5

    b52cd68a302934d0d9d7e2e84b61c277

    SHA1

    b8a2df4fb75145856af1d3404b66b28e0545a147

    SHA256

    f56a76bf5ebabd346eb8b57778c17347f62cb8d60e31e7f0b5cc368c4de4a667

    SHA512

    d5a9f9d827fccc1b922fbb655a11b231332c6b053eb77658a63decfeabed1d2cd31a9706f313c64b967207874351b34ec06573fc3532b59dcb81adc9290d8d21

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v1528549.exe

    Filesize

    397KB

    MD5

    b52cd68a302934d0d9d7e2e84b61c277

    SHA1

    b8a2df4fb75145856af1d3404b66b28e0545a147

    SHA256

    f56a76bf5ebabd346eb8b57778c17347f62cb8d60e31e7f0b5cc368c4de4a667

    SHA512

    d5a9f9d827fccc1b922fbb655a11b231332c6b053eb77658a63decfeabed1d2cd31a9706f313c64b967207874351b34ec06573fc3532b59dcb81adc9290d8d21

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\c6110944.exe

    Filesize

    258KB

    MD5

    1b08ba8ca1dc1d0fbfc322d6eb3e2840

    SHA1

    b72837e143a2ca428c6034577549abbddd1ac9be

    SHA256

    e6289cab0c6e2e23f834a677b79915edbdc2a0f0a55af98b61ea490735668282

    SHA512

    c29549a91a45a1384062170a0a61f28655c713540c872787475f4f6004a64efa60f05dde48bcdebd351d872121ed2a551e601741454f0108a4cdd1e52a587536

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\c6110944.exe

    Filesize

    258KB

    MD5

    1b08ba8ca1dc1d0fbfc322d6eb3e2840

    SHA1

    b72837e143a2ca428c6034577549abbddd1ac9be

    SHA256

    e6289cab0c6e2e23f834a677b79915edbdc2a0f0a55af98b61ea490735668282

    SHA512

    c29549a91a45a1384062170a0a61f28655c713540c872787475f4f6004a64efa60f05dde48bcdebd351d872121ed2a551e601741454f0108a4cdd1e52a587536

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\c6110944.exe

    Filesize

    258KB

    MD5

    1b08ba8ca1dc1d0fbfc322d6eb3e2840

    SHA1

    b72837e143a2ca428c6034577549abbddd1ac9be

    SHA256

    e6289cab0c6e2e23f834a677b79915edbdc2a0f0a55af98b61ea490735668282

    SHA512

    c29549a91a45a1384062170a0a61f28655c713540c872787475f4f6004a64efa60f05dde48bcdebd351d872121ed2a551e601741454f0108a4cdd1e52a587536

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v8504945.exe

    Filesize

    197KB

    MD5

    eff0449d888c52064862022a63abf1c2

    SHA1

    60d66b9f330787edd78363f7bf58040d76be5c39

    SHA256

    390ede2a34ef1185d05a3087212902361ba84ba2cf7f0948b5b32aa72786c5b7

    SHA512

    928841a81c5e9597e1a4c914259761435e1e9360cd435286ddc9fa5051be3c0f60788b9ad21b0498c3bc5fe1e88ab153080717e7c538e5bef8bc222cc3fd950c

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v8504945.exe

    Filesize

    197KB

    MD5

    eff0449d888c52064862022a63abf1c2

    SHA1

    60d66b9f330787edd78363f7bf58040d76be5c39

    SHA256

    390ede2a34ef1185d05a3087212902361ba84ba2cf7f0948b5b32aa72786c5b7

    SHA512

    928841a81c5e9597e1a4c914259761435e1e9360cd435286ddc9fa5051be3c0f60788b9ad21b0498c3bc5fe1e88ab153080717e7c538e5bef8bc222cc3fd950c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a8127655.exe

    Filesize

    96KB

    MD5

    e63cc72c007efbd4e68369e1d1d736a9

    SHA1

    140dc0ec2a34c2807759f7abd732934ae017383e

    SHA256

    b5442b7bd45ad5e224a1a0e11bae8842290eacc44e5739caaa60c0320bf539ef

    SHA512

    779fae4ca2db99df8006d82a1c06e2b32ece6e349c5ac1fe3a9ce2b041eab2be8228942de293ff4d15764f23b647493918e8060f44bad2c603416a8fa03d6bb1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a8127655.exe

    Filesize

    96KB

    MD5

    e63cc72c007efbd4e68369e1d1d736a9

    SHA1

    140dc0ec2a34c2807759f7abd732934ae017383e

    SHA256

    b5442b7bd45ad5e224a1a0e11bae8842290eacc44e5739caaa60c0320bf539ef

    SHA512

    779fae4ca2db99df8006d82a1c06e2b32ece6e349c5ac1fe3a9ce2b041eab2be8228942de293ff4d15764f23b647493918e8060f44bad2c603416a8fa03d6bb1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\a8127655.exe

    Filesize

    96KB

    MD5

    e63cc72c007efbd4e68369e1d1d736a9

    SHA1

    140dc0ec2a34c2807759f7abd732934ae017383e

    SHA256

    b5442b7bd45ad5e224a1a0e11bae8842290eacc44e5739caaa60c0320bf539ef

    SHA512

    779fae4ca2db99df8006d82a1c06e2b32ece6e349c5ac1fe3a9ce2b041eab2be8228942de293ff4d15764f23b647493918e8060f44bad2c603416a8fa03d6bb1

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\b3232627.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • memory/2068-103-0x0000000000020000-0x000000000002A000-memory.dmp

    Filesize

    40KB

  • memory/2128-112-0x00000000003C0000-0x00000000003CA000-memory.dmp

    Filesize

    40KB

  • memory/2320-54-0x00000000004D0000-0x0000000000585000-memory.dmp

    Filesize

    724KB

  • memory/2956-122-0x0000000000350000-0x0000000000380000-memory.dmp

    Filesize

    192KB

  • memory/2956-126-0x00000000020D0000-0x00000000020D6000-memory.dmp

    Filesize

    24KB

  • memory/2956-127-0x00000000023B0000-0x00000000023F0000-memory.dmp

    Filesize

    256KB

  • memory/2956-128-0x00000000023B0000-0x00000000023F0000-memory.dmp

    Filesize

    256KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.