Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 12:30

General

  • Target

    ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe

  • Size

    925KB

  • MD5

    182c7282a0ce3f4b3167518c8a2f9d66

  • SHA1

    7277f55f22c18008840d4aa0c65721df2129d761

  • SHA256

    ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da

  • SHA512

    57895e1fe2d89271097e920e8eeaccbeafc861fde18aa85cdac7cf716cebb332fe201e2821512be04a92c965894526c3f7bcb8d3d7b010909cc8318f95ce79a0

  • SSDEEP

    24576:UylKFVXmbDRGB2xA30pIMporMtfc/FgIHs8:jEVGFGB2CkpIuPtfees

Malware Config

Extracted

Family

redline

Botnet

lamp

C2

77.91.68.56:19071

Attributes
  • auth_value

    ee1df63bcdbe3de70f52810d94eaff7d

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe
    "C:\Users\Admin\AppData\Local\Temp\ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3736
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:544
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3688
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8276002.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8276002.exe
          4⤵
          • Executes dropped EXE
          PID:1696
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:3544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

    Filesize

    226B

    MD5

    916851e072fbabc4796d8916c5131092

    SHA1

    d48a602229a690c512d5fdaf4c8d77547a88e7a2

    SHA256

    7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

    SHA512

    07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8792484.exe

    Filesize

    769KB

    MD5

    e9c35fad007c9abb695cdf32a6ef8350

    SHA1

    d97cc8e389c68e9aff8d28d0691db3da4b56e93d

    SHA256

    a7e240048e51d605d4c92f47e4dae2c31558849be479794c2ee0761e240ef03d

    SHA512

    c6e80f476737b9d56d884438fe2045c3b42ce5e2ebc0833ec786f4c75df10934c67e0b194b79174e6588de14de2d651da5b788553ac3e7a619f3effc110c0ef7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3682092.exe

    Filesize

    585KB

    MD5

    eac44c7b9549f1b58cf25c60ee304435

    SHA1

    bf66fe6604311066fd2d8de1743af49c8f902edf

    SHA256

    7adab0943d097033395ba73d8760b3f523fd636a0bb13c8ac0dd37f0a63be91d

    SHA512

    c32120a4fbeb8b9bff77a9d5fb8f324752524fb8edd87387a28780c0e6eb0affad63a26860f682abac7835ddbcee4cdb9b67f2ecb3a22bdc57802509b5af5ade

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8000827.exe

    Filesize

    295KB

    MD5

    82c2b3a4497da45e69dce662504c47f7

    SHA1

    068c99cc9b40709f9967d393edd5a9e56b269015

    SHA256

    cc13fa7cc073a8810513c3fc4bea322132f6c659785cc68a6d11368fe4b11e7d

    SHA512

    b99991a938c78a90830c08285e98a552c5e0f7eb7717c1a2d4f89f4553bc452944b8b0bf91ad3b930fd9b2c21422fad73b975779c8a7e7a6932b6100fc13e55b

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8276002.exe

    Filesize

    492KB

    MD5

    6d30780150b36e2b9c70bcf294a2fba7

    SHA1

    60555be1736e34f14a4fb14aa8f1196d982dd29f

    SHA256

    fcf9145080af193ac72b17a81c9a76688e37ebd172c6b47e39a4ecd1aedd17fd

    SHA512

    2dc7a5f53794b4c548861f10fad1f0d79e7485cb2bb4de388f3109f8b82d22d1b87456d2e4f9d19d356180fc8cbebb74d3cd696059bd0c1c60284e45895cc58c

  • memory/1696-45-0x0000000004A10000-0x0000000005028000-memory.dmp

    Filesize

    6.1MB

  • memory/1696-36-0x00000000005F0000-0x000000000067C000-memory.dmp

    Filesize

    560KB

  • memory/1696-42-0x00000000005F0000-0x000000000067C000-memory.dmp

    Filesize

    560KB

  • memory/1696-44-0x00000000022B0000-0x00000000022B6000-memory.dmp

    Filesize

    24KB

  • memory/1696-47-0x00000000051E0000-0x00000000051F2000-memory.dmp

    Filesize

    72KB

  • memory/1696-46-0x00000000050B0000-0x00000000051BA000-memory.dmp

    Filesize

    1.0MB

  • memory/1696-48-0x0000000005200000-0x000000000523C000-memory.dmp

    Filesize

    240KB

  • memory/1696-49-0x0000000005270000-0x00000000052BC000-memory.dmp

    Filesize

    304KB

  • memory/3688-29-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB

  • memory/3688-28-0x00000000005C0000-0x00000000005FE000-memory.dmp

    Filesize

    248KB

  • memory/3688-27-0x0000000000401000-0x0000000000404000-memory.dmp

    Filesize

    12KB

  • memory/3688-21-0x00000000005C0000-0x00000000005FE000-memory.dmp

    Filesize

    248KB