Analysis

  • max time kernel
    290s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2023 06:52

General

  • Target

    x8731362.exe

  • Size

    320KB

  • MD5

    faa8635b24a3c8c194ea66f37770732e

  • SHA1

    7a45390809e3fb5a228396d3b5ff05b3a99bc9be

  • SHA256

    0fdbc770ea66f062af959235a3a6559123d5408a322c111592ef584215ef81c4

  • SHA512

    e269067cd43197b7d6c6901cb3ab55cec1a7e8aeb80f9a1b938bfcb3b4d0cb847a90766fc22ac393f7c035022911fe5ace8ce56c3268fdc3503f60b266789db3

  • SSDEEP

    6144:Khy+bnr+cp0yN90QENl926D2lD3Ka815dCpo8vYvZtAj0nwr43dlN4ZGEA:7Mroy90zl926SlDyBzPvzAj1EGjA

Malware Config

Extracted

Family

redline

Botnet

vasha

C2

77.91.124.82:19071

Attributes
  • auth_value

    42fc61786274daca54d589b85a2c1954

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\x8731362.exe
    "C:\Users\Admin\AppData\Local\Temp\x8731362.exe"
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        • Modifies Windows Defender Real-time Protection settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2648
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2672

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
    Filesize

    236KB

    MD5

    ae3c2011e6b28a83ed5ec20506e2e3eb

    SHA1

    34bcdb009271f3301b37346648ade33ceecf9556

    SHA256

    797cfa22728210b5dfc1b746fda10be7684798629c168664d754440882c5dbcf

    SHA512

    8c8f8a783cd2fa9de0a23735c958dab8563b7f100e77c3e821287a7a07d05db398dd2a3a00b447c11b34d89b0c48ef497a869003582159e7e6c134bba6cd3138

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
    Filesize

    236KB

    MD5

    ae3c2011e6b28a83ed5ec20506e2e3eb

    SHA1

    34bcdb009271f3301b37346648ade33ceecf9556

    SHA256

    797cfa22728210b5dfc1b746fda10be7684798629c168664d754440882c5dbcf

    SHA512

    8c8f8a783cd2fa9de0a23735c958dab8563b7f100e77c3e821287a7a07d05db398dd2a3a00b447c11b34d89b0c48ef497a869003582159e7e6c134bba6cd3138

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
    Filesize

    236KB

    MD5

    ae3c2011e6b28a83ed5ec20506e2e3eb

    SHA1

    34bcdb009271f3301b37346648ade33ceecf9556

    SHA256

    797cfa22728210b5dfc1b746fda10be7684798629c168664d754440882c5dbcf

    SHA512

    8c8f8a783cd2fa9de0a23735c958dab8563b7f100e77c3e821287a7a07d05db398dd2a3a00b447c11b34d89b0c48ef497a869003582159e7e6c134bba6cd3138

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
    Filesize

    174KB

    MD5

    43acc3d174d9c2da4013def25ed93107

    SHA1

    c0e91ed2ab5c607fc0b22c8f4209db792c26fa5f

    SHA256

    745e358e9b0eefe2efe8d14cdbf17a194b81a80f929df4514cc3fed696d259ee

    SHA512

    6ddecd71a2e5f9d6670f297513fe3db5e2ed4e859857d8a25a42dbcfe03e6d5f70762af836061a0ebfdfc05be6ca102d6b9116fe6e627a989811da07c59b9614

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
    Filesize

    174KB

    MD5

    43acc3d174d9c2da4013def25ed93107

    SHA1

    c0e91ed2ab5c607fc0b22c8f4209db792c26fa5f

    SHA256

    745e358e9b0eefe2efe8d14cdbf17a194b81a80f929df4514cc3fed696d259ee

    SHA512

    6ddecd71a2e5f9d6670f297513fe3db5e2ed4e859857d8a25a42dbcfe03e6d5f70762af836061a0ebfdfc05be6ca102d6b9116fe6e627a989811da07c59b9614

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
    Filesize

    236KB

    MD5

    ae3c2011e6b28a83ed5ec20506e2e3eb

    SHA1

    34bcdb009271f3301b37346648ade33ceecf9556

    SHA256

    797cfa22728210b5dfc1b746fda10be7684798629c168664d754440882c5dbcf

    SHA512

    8c8f8a783cd2fa9de0a23735c958dab8563b7f100e77c3e821287a7a07d05db398dd2a3a00b447c11b34d89b0c48ef497a869003582159e7e6c134bba6cd3138

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
    Filesize

    236KB

    MD5

    ae3c2011e6b28a83ed5ec20506e2e3eb

    SHA1

    34bcdb009271f3301b37346648ade33ceecf9556

    SHA256

    797cfa22728210b5dfc1b746fda10be7684798629c168664d754440882c5dbcf

    SHA512

    8c8f8a783cd2fa9de0a23735c958dab8563b7f100e77c3e821287a7a07d05db398dd2a3a00b447c11b34d89b0c48ef497a869003582159e7e6c134bba6cd3138

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
    Filesize

    236KB

    MD5

    ae3c2011e6b28a83ed5ec20506e2e3eb

    SHA1

    34bcdb009271f3301b37346648ade33ceecf9556

    SHA256

    797cfa22728210b5dfc1b746fda10be7684798629c168664d754440882c5dbcf

    SHA512

    8c8f8a783cd2fa9de0a23735c958dab8563b7f100e77c3e821287a7a07d05db398dd2a3a00b447c11b34d89b0c48ef497a869003582159e7e6c134bba6cd3138

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
    Filesize

    174KB

    MD5

    43acc3d174d9c2da4013def25ed93107

    SHA1

    c0e91ed2ab5c607fc0b22c8f4209db792c26fa5f

    SHA256

    745e358e9b0eefe2efe8d14cdbf17a194b81a80f929df4514cc3fed696d259ee

    SHA512

    6ddecd71a2e5f9d6670f297513fe3db5e2ed4e859857d8a25a42dbcfe03e6d5f70762af836061a0ebfdfc05be6ca102d6b9116fe6e627a989811da07c59b9614

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
    Filesize

    174KB

    MD5

    43acc3d174d9c2da4013def25ed93107

    SHA1

    c0e91ed2ab5c607fc0b22c8f4209db792c26fa5f

    SHA256

    745e358e9b0eefe2efe8d14cdbf17a194b81a80f929df4514cc3fed696d259ee

    SHA512

    6ddecd71a2e5f9d6670f297513fe3db5e2ed4e859857d8a25a42dbcfe03e6d5f70762af836061a0ebfdfc05be6ca102d6b9116fe6e627a989811da07c59b9614

  • memory/2648-15-0x0000000000400000-0x000000000040A000-memory.dmp
    Filesize

    40KB

  • memory/2648-18-0x0000000000400000-0x000000000040A000-memory.dmp
    Filesize

    40KB

  • memory/2648-20-0x0000000000400000-0x000000000040A000-memory.dmp
    Filesize

    40KB

  • memory/2648-22-0x0000000000400000-0x000000000040A000-memory.dmp
    Filesize

    40KB

  • memory/2648-17-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
    Filesize

    4KB

  • memory/2648-16-0x0000000000400000-0x000000000040A000-memory.dmp
    Filesize

    40KB

  • memory/2648-14-0x0000000000400000-0x000000000040A000-memory.dmp
    Filesize

    40KB

  • memory/2648-13-0x0000000000400000-0x000000000040A000-memory.dmp
    Filesize

    40KB

  • memory/2672-29-0x00000000012C0000-0x00000000012F0000-memory.dmp
    Filesize

    192KB

  • memory/2672-30-0x0000000000450000-0x0000000000456000-memory.dmp
    Filesize

    24KB