Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 13:19

General

  • Target

    2e0a9b6a39ce81b93beb155ac3c237f4a6b9248d6b872ed22bfdf8851796b19b.exe

  • Size

    1.2MB

  • MD5

    2f8765ddfb5eb9cf565d416a2fef07a9

  • SHA1

    ceb22309b872f04d9c5df1e6fe3cc35fa616e6cd

  • SHA256

    2e0a9b6a39ce81b93beb155ac3c237f4a6b9248d6b872ed22bfdf8851796b19b

  • SHA512

    6489262e8b6394e895ef7ea59c94f8b460affbb17130a1136df23b47f1cc50f3c09db0fd10319484e28679ef65d583c15086b38b5d0d27858906e4f4504f7b85

  • SSDEEP

    24576:Cy4hgIcCM5IddKY63yg7MVZeoCNElcacqdf36HXe:p4hdcidKY63jwSDEa923

Malware Config

Extracted

Family

redline

Botnet

lamp

C2

77.91.68.56:19071

Attributes
  • auth_value

    ee1df63bcdbe3de70f52810d94eaff7d

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e0a9b6a39ce81b93beb155ac3c237f4a6b9248d6b872ed22bfdf8851796b19b.exe
    "C:\Users\Admin\AppData\Local\Temp\2e0a9b6a39ce81b93beb155ac3c237f4a6b9248d6b872ed22bfdf8851796b19b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7472544.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7472544.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9263224.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9263224.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3840
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1805423.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1805423.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1328
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5289050.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5289050.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:3888
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a4992850.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a4992850.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3976
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3460427.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3460427.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5112
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4849613.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4849613.exe
            5⤵
            • Executes dropped EXE
            PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

    Filesize

    226B

    MD5

    916851e072fbabc4796d8916c5131092

    SHA1

    d48a602229a690c512d5fdaf4c8d77547a88e7a2

    SHA256

    7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

    SHA512

    07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7472544.exe

    Filesize

    1.0MB

    MD5

    4f42b9b022fd8d85dcdd9f017b90ff04

    SHA1

    676ba0ae4538adddc2b07f55a48cd628d12b7633

    SHA256

    b02ee275800185a8058ae8d737a10aa7ef514f4d772b4d85a2d65b2239545d4f

    SHA512

    38f9a1db8fb1505cb1ff738dc29aa61599c4e23a3b5fdd3cb75bfb8bfd3a300132e7c5b476e8bcaa36f5db240f3c6188e5b1028610e2f8d9ebc53f0932187c97

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9263224.exe

    Filesize

    905KB

    MD5

    9d65e889dc6cdf70ab7a92689cf92af2

    SHA1

    507fd511af4528e94e1d2c6d37855380afb4a426

    SHA256

    2203e5e15c34017bdb5d5dac6cba15f8d99920c65ef189076a1ce7d3af478ad1

    SHA512

    db30bd0c8afe77d711e58f68fb755e4cb4e762a90ed3aa6319ff4dda932abbd0b067dd9090cc87dac6e2a3b1c27a58bdad18836d609240d7f53714d699a2624c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1805423.exe

    Filesize

    722KB

    MD5

    8592a6dc936028a99ace4532cd770d5d

    SHA1

    7e44db68b7ec9a089b8a4937ed6ebb5d84860656

    SHA256

    d1285e5b0d41a774b9207d576b7f7843892698c455ef32b279164721daefa805

    SHA512

    d433730289a88f71bc6ac17faae51ff07fa32e9398c84a00dfe54e70b158fa5d94d2e73a9a2bed44f45e36ae357c6a82c5f4b6e20d487529f3b43842f98510cd

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4849613.exe

    Filesize

    492KB

    MD5

    da6ff81c6f67611413531f823ea93e2b

    SHA1

    8e4244fe534ab3ae1ea22dc12f0665bcec0db34a

    SHA256

    69220a693e0059f35711ed1e66ec35c9b62de85afe4cdb9c282c2d24d9483193

    SHA512

    f4af9745c5dab137c04b0e86f34fc696c1a9d7fcb9ca9733fcd75256981aa6835f3aeffd4f3fc1fce1c07109096c2835a2b6c83bc246ccfd719372059ebe5d36

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5289050.exe

    Filesize

    324KB

    MD5

    edc75ffe5fa9ffa372060ebd5c09c2b3

    SHA1

    1c075856c81f5648acc34d08fa5a41debd9387ae

    SHA256

    92d61909555ed2bddf1f59506648e79a53e769014afc63405405cbfea6979340

    SHA512

    27943feab8ffb5635b6b886202f75d4f839a7bc4f326df0af1ea92560ee51a167a2d8aabe341b3861876fc7766abd1c8bab3d0dcad9cf69af81dabc89b797c13

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a4992850.exe

    Filesize

    294KB

    MD5

    068c37a137de97b4569270eb0fd08b27

    SHA1

    9cef9ddd66a3c3a18a6993eff25304d29e95bf6d

    SHA256

    f9adeb967c811f699984b5a9d12d7d5c7090827a0c1ab3bea159c7d04f41286b

    SHA512

    98f1d6795cadb5ffe4f95c05fa3590832fe64cf1ea539199557fba0b4183c50ec7c0fdd210af23d4c769beb1158eca495e5b176d883ee29501334e88c0139cf1

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3460427.exe

    Filesize

    11KB

    MD5

    698c2c19db2d75dda748684546023df8

    SHA1

    f03d654d2459c82f0fbd407289c2b2f6458cfbfd

    SHA256

    e27ddbbb48705cb0790690d176d326b1e68fac8960b25b65e56582c552d6a749

    SHA512

    b937e05949307bbf8da79c416c1ab9c844bab3065e2fcd690f6ff5bb403caebc89997b6d050eb82339dd9181a8842629602794bbda2436404381d0cf68f340e4

  • memory/2876-63-0x00000000059F0000-0x0000000006008000-memory.dmp

    Filesize

    6.1MB

  • memory/2876-53-0x00000000005C0000-0x000000000064C000-memory.dmp

    Filesize

    560KB

  • memory/2876-60-0x00000000005C0000-0x000000000064C000-memory.dmp

    Filesize

    560KB

  • memory/2876-62-0x0000000004450000-0x0000000004456000-memory.dmp

    Filesize

    24KB

  • memory/2876-64-0x00000000061B0000-0x00000000062BA000-memory.dmp

    Filesize

    1.0MB

  • memory/2876-65-0x00000000060C0000-0x00000000060D2000-memory.dmp

    Filesize

    72KB

  • memory/2876-66-0x00000000060E0000-0x000000000611C000-memory.dmp

    Filesize

    240KB

  • memory/2876-67-0x0000000006150000-0x000000000619C000-memory.dmp

    Filesize

    304KB

  • memory/3976-42-0x0000000006BD0000-0x0000000006BD1000-memory.dmp

    Filesize

    4KB

  • memory/3976-41-0x00000000005C0000-0x00000000005FE000-memory.dmp

    Filesize

    248KB

  • memory/3976-35-0x00000000005C0000-0x00000000005FE000-memory.dmp

    Filesize

    248KB

  • memory/5112-48-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

    Filesize

    40KB