Analysis

  • max time kernel
    291s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19-09-2023 06:53

General

  • Target

    x2956276.exe

  • Size

    767KB

  • MD5

    1c6c7a45405df7f0ffa13ba4b0e13cdf

  • SHA1

    a07565f75853d665ba77066708ca389013eec8c1

  • SHA256

    8223ecb59ab7857b5c818e0a2b46f718af34cbfd315ef44aac14abcf7b10eae0

  • SHA512

    12ad25bbb3fbcce8c5aec9bef01691f43d1f323d1f13c479d83e66b7072d8e4fa460fa58df0921cc77b96d84480de075bb17b238c655e3c41b8dcd4b9311894e

  • SSDEEP

    12288:iMrRy90oJfvnDybDtf2MTTXqdvlyFL+LEVEjqjdd39rNdwxe:PyHuDZ1X6lISxqZL/wA

Malware Config

Extracted

Family

redline

Botnet

black

C2

77.91.124.82:19071

Attributes
  • auth_value

    c5887216cebc5a219113738140bc3047

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\x2956276.exe
    "C:\Users\Admin\AppData\Local\Temp\x2956276.exe"
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3053086.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3053086.exe
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5182030.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5182030.exe
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6429604.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6429604.exe
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1776
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4232
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h4643382.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h4643382.exe
          • Executes dropped EXE
          PID:1876

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3053086.exe
    Filesize

    492KB

    MD5

    fb222f908910b188d9e6f9c343280e34

    SHA1

    993ae7465553bfd4789b5144cc9f70928e0c299a

    SHA256

    95fb552e223bacb356225f06399cca3ddd1dcc3302de5f39d26a56665c656a75

    SHA512

    1ae6b2185526b0f7b244b945d254e41ae85f334b76e72d9160bd84c135eefc1ad01923425167c5d8449c8497850e0c67fb11595b89f0c1f5c870bd15d2fe182b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3053086.exe
    Filesize

    492KB

    MD5

    fb222f908910b188d9e6f9c343280e34

    SHA1

    993ae7465553bfd4789b5144cc9f70928e0c299a

    SHA256

    95fb552e223bacb356225f06399cca3ddd1dcc3302de5f39d26a56665c656a75

    SHA512

    1ae6b2185526b0f7b244b945d254e41ae85f334b76e72d9160bd84c135eefc1ad01923425167c5d8449c8497850e0c67fb11595b89f0c1f5c870bd15d2fe182b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5182030.exe
    Filesize

    326KB

    MD5

    11924a7c6b34d401fce9a0289a495d90

    SHA1

    7e07aa42127ad4e83b4db9988d42f36229275c72

    SHA256

    b610208386aff19bb310792255e5022f47fc360015fde0da73df201153ae013d

    SHA512

    1d1501b04e60ac2e2ebd31a9ec8d62690f556ad4f7b1e3aa7ca822ac8137dc7ae04f8c06e404798973e487f17930fac08237e6329ae0d860a6d3d27218931fb1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5182030.exe
    Filesize

    326KB

    MD5

    11924a7c6b34d401fce9a0289a495d90

    SHA1

    7e07aa42127ad4e83b4db9988d42f36229275c72

    SHA256

    b610208386aff19bb310792255e5022f47fc360015fde0da73df201153ae013d

    SHA512

    1d1501b04e60ac2e2ebd31a9ec8d62690f556ad4f7b1e3aa7ca822ac8137dc7ae04f8c06e404798973e487f17930fac08237e6329ae0d860a6d3d27218931fb1

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6429604.exe
    Filesize

    242KB

    MD5

    8989f700c821326027fe2fe0f49e5377

    SHA1

    42caa5229b3098681604d0ef16959b4bf0bbb4c2

    SHA256

    f083e0adfc6196b5a9eff007132b1bbce34ff64ea672a9aebe64ed0bcf745421

    SHA512

    2405054d42419eacc4e4ee9630e80a146e3a359a22152ad7d49098aac72691b218db1c3085a3d4b5ac604ddc874bc8369719f8e0ad126f6b1c4abdcfcfb2e368

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6429604.exe
    Filesize

    242KB

    MD5

    8989f700c821326027fe2fe0f49e5377

    SHA1

    42caa5229b3098681604d0ef16959b4bf0bbb4c2

    SHA256

    f083e0adfc6196b5a9eff007132b1bbce34ff64ea672a9aebe64ed0bcf745421

    SHA512

    2405054d42419eacc4e4ee9630e80a146e3a359a22152ad7d49098aac72691b218db1c3085a3d4b5ac604ddc874bc8369719f8e0ad126f6b1c4abdcfcfb2e368

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h4643382.exe
    Filesize

    174KB

    MD5

    1827ae586ad2402dc0adc144a7669594

    SHA1

    7c4c2a6be7c2cb469e0ca47d971957620938edea

    SHA256

    0429a60d41dd59931c21923cfaf7158b5678f26d4cd8b2832ba200487a17ab78

    SHA512

    0d20f12df977497f7959a22a5568bc5b681f2e7caad0c6014f19c5a70d49b1ee56e5bf548a3679ce51618d687c68975565ae13a2e1808ba64329d25d6a13f71e

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h4643382.exe
    Filesize

    174KB

    MD5

    1827ae586ad2402dc0adc144a7669594

    SHA1

    7c4c2a6be7c2cb469e0ca47d971957620938edea

    SHA256

    0429a60d41dd59931c21923cfaf7158b5678f26d4cd8b2832ba200487a17ab78

    SHA512

    0d20f12df977497f7959a22a5568bc5b681f2e7caad0c6014f19c5a70d49b1ee56e5bf548a3679ce51618d687c68975565ae13a2e1808ba64329d25d6a13f71e

  • memory/1876-29-0x00000000733D0000-0x0000000073ABE000-memory.dmp
    Filesize

    6MB

  • memory/1876-28-0x0000000000530000-0x0000000000560000-memory.dmp
    Filesize

    192KB

  • memory/1876-31-0x0000000004CF0000-0x0000000004CF6000-memory.dmp
    Filesize

    24KB

  • memory/1876-32-0x000000000A940000-0x000000000AF46000-memory.dmp
    Filesize

    6MB

  • memory/1876-33-0x000000000A480000-0x000000000A58A000-memory.dmp
    Filesize

    1MB

  • memory/1876-34-0x000000000A3B0000-0x000000000A3C2000-memory.dmp
    Filesize

    72KB

  • memory/1876-35-0x000000000A410000-0x000000000A44E000-memory.dmp
    Filesize

    248KB

  • memory/1876-40-0x000000000A590000-0x000000000A5DB000-memory.dmp
    Filesize

    300KB

  • memory/1876-45-0x00000000733D0000-0x0000000073ABE000-memory.dmp
    Filesize

    6MB

  • memory/4232-21-0x0000000000400000-0x000000000040A000-memory.dmp
    Filesize

    40KB

  • memory/4232-30-0x00000000733D0000-0x0000000073ABE000-memory.dmp
    Filesize

    6MB

  • memory/4232-46-0x00000000733D0000-0x0000000073ABE000-memory.dmp
    Filesize

    6MB

  • memory/4232-61-0x00000000733D0000-0x0000000073ABE000-memory.dmp
    Filesize

    6MB