Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 14:29

General

  • Target

    7f80787d38486459a9c104bc8c42dd78c68e0e27411be54897379c415c7c73fd.exe

  • Size

    690KB

  • MD5

    0c87128b0af187a9fe71653d1a0e5263

  • SHA1

    001166bb1806c1063c1c1cea0ef6098514871057

  • SHA256

    7f80787d38486459a9c104bc8c42dd78c68e0e27411be54897379c415c7c73fd

  • SHA512

    e276d4155b9d5d0a68c5474f756eef46abf49adeb78ef13f3d70c5c7da785f000c7c55044641e2c6f09a7b2af2f96d60d4f9c0889de4143af59f92779e8696ba

  • SSDEEP

    12288:XMrUy90DLtlNOkp0zgKrIv1HTh3K43YALqOoTgBetsh0T7YU1+iiWW1kfd:ryQNeg2oph0AmOoEBeGhVyEM

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f80787d38486459a9c104bc8c42dd78c68e0e27411be54897379c415c7c73fd.exe
    "C:\Users\Admin\AppData\Local\Temp\7f80787d38486459a9c104bc8c42dd78c68e0e27411be54897379c415c7c73fd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un866970.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un866970.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1420.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1420.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4800
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1076
          4⤵
          • Program crash
          PID:3056
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8957.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8957.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:628
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4800 -ip 4800
    1⤵
      PID:3816

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    3
    T1112

    Impair Defenses

    2
    T1562

    Disable or Modify Tools

    2
    T1562.001

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un866970.exe
      Filesize

      548KB

      MD5

      a7fb15822f9fd5ad188bde64ac858066

      SHA1

      d43cf89daf58874fc10f0069ad15a1422afd1fdc

      SHA256

      1743aaa0c8da51a1f5dc1edbbe624d607b088ec127d12ba535d316fe7c999b90

      SHA512

      bebda16905e2ebc30ad91776c939c59488d159e84a3d01b298e1ad23a60e30c87d3110c99bd5e8f964e16ffd84ba7de7b85d66ba476847fc8c0fe1fef52e8bbd

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1420.exe
      Filesize

      291KB

      MD5

      24abf6b8ee223b90a885472a87ea4c31

      SHA1

      7feba2b130ce89722d6794b90f3fe47ec757e6bd

      SHA256

      24e94aacf0fd547ad2853afa6f561340e7103fae7a8542620fc4bf93281f420f

      SHA512

      99839c767fa4f0d2450eda15fa3e8e59c7f75d270edaa4939a4238ecf0e676761e87050a514bcb39527ab4c0e55815fde66c04aeeea581b38185593670599252

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8957.exe
      Filesize

      350KB

      MD5

      845cca2b2296b2b608ff5ad85ed25882

      SHA1

      e1eb059c3439f702262d7c333f916bf84830d69a

      SHA256

      e8c6c67aec798ccaed270e5344ddaea84a165f4cea12167d6404ca00aeec40bd

      SHA512

      da5d5e410719952365e5487dd9a7a28268a63d43b98d53c338728f9c42745f481c2ce72224e0465c7a043d705d859c28706338b5ef4c03b569e078679c00267a

    • memory/628-75-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-67-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-970-0x0000000005CA0000-0x0000000005CEC000-memory.dmp
      Filesize

      304KB

    • memory/628-969-0x0000000005B50000-0x0000000005B8C000-memory.dmp
      Filesize

      240KB

    • memory/628-968-0x0000000005B30000-0x0000000005B42000-memory.dmp
      Filesize

      72KB

    • memory/628-967-0x00000000059F0000-0x0000000005AFA000-memory.dmp
      Filesize

      1.0MB

    • memory/628-59-0x0000000004CF0000-0x0000000004D34000-memory.dmp
      Filesize

      272KB

    • memory/628-966-0x0000000005350000-0x0000000005968000-memory.dmp
      Filesize

      6.1MB

    • memory/628-60-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-83-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-63-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-61-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-65-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-69-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-71-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-73-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-77-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-79-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-81-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-85-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-58-0x0000000004C40000-0x0000000004C86000-memory.dmp
      Filesize

      280KB

    • memory/628-87-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-89-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-91-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/628-93-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
      Filesize

      252KB

    • memory/4800-35-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-39-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-41-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-23-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-17-0x0000000000400000-0x0000000000430000-memory.dmp
      Filesize

      192KB

    • memory/4800-52-0x0000000000400000-0x000000000070B000-memory.dmp
      Filesize

      3.0MB

    • memory/4800-53-0x0000000000400000-0x0000000000430000-memory.dmp
      Filesize

      192KB

    • memory/4800-22-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-25-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-27-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-29-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-16-0x0000000000900000-0x000000000092D000-memory.dmp
      Filesize

      180KB

    • memory/4800-31-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-33-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-15-0x0000000000710000-0x0000000000810000-memory.dmp
      Filesize

      1024KB

    • memory/4800-37-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-43-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-45-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-47-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-49-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
      Filesize

      72KB

    • memory/4800-21-0x0000000002AA0000-0x0000000002AB8000-memory.dmp
      Filesize

      96KB

    • memory/4800-20-0x0000000004EB0000-0x0000000005454000-memory.dmp
      Filesize

      5.6MB

    • memory/4800-19-0x0000000002430000-0x000000000244A000-memory.dmp
      Filesize

      104KB

    • memory/4800-18-0x0000000000400000-0x000000000070B000-memory.dmp
      Filesize

      3.0MB