Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 12:30

General

  • Target

    61f1a776dcd13885a5979397d5b945e89d26cfcfe61e000ac89070e4a45bc562.exe

  • Size

    479KB

  • MD5

    1b385dfef9c3683b4849ce42c7b6b5f3

  • SHA1

    8aa540ad4ad25b905fdfadc3e351ba1c49e3e9b7

  • SHA256

    61f1a776dcd13885a5979397d5b945e89d26cfcfe61e000ac89070e4a45bc562

  • SHA512

    20e65a503be4341c386046a617c4875e006527eebd214299d971650a22c245450bfccd600d9fd9e2d0b6d1a9c5dd719037b2477452e29ddf4bdaaf20b83998b3

  • SSDEEP

    12288:MMr2y90GYO4OtK8z1J6Rxt0wptqtOTy2A8xADCvc:qyGV8z1YRgOuUAkc

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61f1a776dcd13885a5979397d5b945e89d26cfcfe61e000ac89070e4a45bc562.exe
    "C:\Users\Admin\AppData\Local\Temp\61f1a776dcd13885a5979397d5b945e89d26cfcfe61e000ac89070e4a45bc562.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3756826.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3756826.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3719439.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3719439.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3608
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6925739.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6925739.exe
        3⤵
        • Executes dropped EXE
        PID:3996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3756826.exe

    Filesize

    307KB

    MD5

    ca2ad17b64a10b961c2b14a7e47a8030

    SHA1

    a339ebb686b832fc87af3c287f67d8ef52e140e8

    SHA256

    23bc83a4a63831c87e6d79e2b366e2534c967a13a377e66f4d92e226f9e8be94

    SHA512

    ad5e5a03336562d58b02f2556eb833fe3c39d2a7c47584379059cc5a584be1efc981cde4c84a350a4bb244502a73fb7bf0bee7b03b4ef002bb6ecc17d3caff04

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3719439.exe

    Filesize

    180KB

    MD5

    0e2a8712db80505e38c2816483598edf

    SHA1

    8ff6735fc1c080fb73825928f2bf9aa409b3758c

    SHA256

    a88a17437aa434a4c8df1657b4ac4c72d5d65247c160b7d2351101a2955ecd0c

    SHA512

    1076c1d65c2bd3be562d57ebe5a00af294242456a80a4149e3ae5ed1816a35abdab48cca90617ccb9839a14020391ed425cedba42f63c75b8488f45485108d91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6925739.exe

    Filesize

    168KB

    MD5

    9eb1e1ed0fb5f198b60699f1d6f2c4d8

    SHA1

    0a93100586a585ffaceecff9c67cf28e703b67d2

    SHA256

    0fce1f4c2a87e2bdccfe4c3112f837d1fdeb91edb113f055787e29000a4a348b

    SHA512

    fe9679472176c5d0648355a230eb9b77a19d565b17cb957a14d96d60df338f039ddbbdc97c611776239e8b5b3e842c85e8ac6b50882feb59917a1bb12496140d

  • memory/3608-33-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-17-0x0000000004980000-0x0000000004F24000-memory.dmp

    Filesize

    5.6MB

  • memory/3608-29-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-18-0x0000000004F40000-0x0000000004F58000-memory.dmp

    Filesize

    96KB

  • memory/3608-21-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-47-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-46-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-48-0x0000000073EF0000-0x00000000746A0000-memory.dmp

    Filesize

    7.7MB

  • memory/3608-43-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-42-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-39-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-37-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-35-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-15-0x00000000020B0000-0x00000000020CA000-memory.dmp

    Filesize

    104KB

  • memory/3608-31-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-16-0x0000000073EF0000-0x00000000746A0000-memory.dmp

    Filesize

    7.7MB

  • memory/3608-27-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-25-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-23-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-20-0x0000000004F40000-0x0000000004F52000-memory.dmp

    Filesize

    72KB

  • memory/3608-19-0x0000000073EF0000-0x00000000746A0000-memory.dmp

    Filesize

    7.7MB

  • memory/3608-50-0x0000000073EF0000-0x00000000746A0000-memory.dmp

    Filesize

    7.7MB

  • memory/3608-14-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

    Filesize

    4KB

  • memory/3996-54-0x0000000000760000-0x0000000000790000-memory.dmp

    Filesize

    192KB

  • memory/3996-55-0x00000000028F0000-0x00000000028F6000-memory.dmp

    Filesize

    24KB

  • memory/3996-56-0x00000000056F0000-0x0000000005D08000-memory.dmp

    Filesize

    6.1MB

  • memory/3996-57-0x00000000051E0000-0x00000000052EA000-memory.dmp

    Filesize

    1.0MB

  • memory/3996-58-0x00000000050F0000-0x0000000005102000-memory.dmp

    Filesize

    72KB

  • memory/3996-59-0x0000000005150000-0x000000000518C000-memory.dmp

    Filesize

    240KB

  • memory/3996-60-0x0000000005190000-0x00000000051DC000-memory.dmp

    Filesize

    304KB