Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 13:19

General

  • Target

    464a7168620633d6f4e27494eec6c1cedff2ae39e5ffda7f9913f43efd93bd38.exe

  • Size

    480KB

  • MD5

    2e6a4fc6e3fb6ef41f3e9a1c0245473b

  • SHA1

    e8b2387fff202d400c02a75b92d31c95400abc95

  • SHA256

    464a7168620633d6f4e27494eec6c1cedff2ae39e5ffda7f9913f43efd93bd38

  • SHA512

    e9f733e6de8dcee03191129a06f1e72f8858fe89662914be2bc39d595fa7681d02d536136f200836c3fd624c4bf478283d85289fb2c141b21d818debd6281ef9

  • SSDEEP

    12288:JMrVy901LN4BkGvpYh66jV8uL3jl8TzH//:oy8GBkqpEt9jSz//

Malware Config

Extracted

Family

redline

Botnet

mihan

C2

217.196.96.101:4132

Attributes
  • auth_value

    9a6a8fdae02ed7caa0a49a6ddc6d4520

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\464a7168620633d6f4e27494eec6c1cedff2ae39e5ffda7f9913f43efd93bd38.exe
    "C:\Users\Admin\AppData\Local\Temp\464a7168620633d6f4e27494eec6c1cedff2ae39e5ffda7f9913f43efd93bd38.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4391517.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4391517.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:996
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1342500.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1342500.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4336
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3543593.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3543593.exe
        3⤵
        • Executes dropped EXE
        PID:4188

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4391517.exe

    Filesize

    309KB

    MD5

    8067106c1a967b7bb5811be1ae14865c

    SHA1

    5c73dab5e1086c66477eec2ffc87f2d307c6c2e8

    SHA256

    8bf51808036692b58c97fc2ad6b9831492c31663235b3c6a04fc5d1febdef994

    SHA512

    69d7dc4f4584e1155e6b30f8a82af04c217512de3dcaa1867e673f9fcd1501f476040ef69cb176d4e00f08aaa3c05bc20104d9c462d7bb7c957e44993f623079

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1342500.exe

    Filesize

    180KB

    MD5

    fb624114dcc06c40c7d5a5dd6638c9e3

    SHA1

    169dfd4765ce943492d1bc716e3c865bb21b2382

    SHA256

    d8c78b8289dbcba18306ffa4f2e5ce2cb545f767634849fbfde4c7b0d3d9f06c

    SHA512

    db80b5fc4017036322cfbade1a5b5146cb41e1edc69d018204b380297f426f0c669fe8b8f8f401c8ad7fd967815c242e6fac7376f56f59eb7cb3ef4c05c27223

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3543593.exe

    Filesize

    168KB

    MD5

    b28f0616ae5d240ea35b31918179ecfe

    SHA1

    5c275f432426411ca46193a4e12bbe38b89c814c

    SHA256

    61d42fbe74bb90f8d932a8ad63ced2f82409b7cab8b3378aba0981d6c9f46dba

    SHA512

    527aa8f0e6045af3d85fa4537bd83d2977411dfd6d17a704e68f11afe1523f4cb302e1112d4acbc0aefb70b8008cb648930afaf135c5071036bd4b447d8946b7

  • memory/4188-59-0x0000000004380000-0x00000000043CC000-memory.dmp

    Filesize

    304KB

  • memory/4188-58-0x000000000A0C0000-0x000000000A0FC000-memory.dmp

    Filesize

    240KB

  • memory/4188-57-0x000000000A060000-0x000000000A072000-memory.dmp

    Filesize

    72KB

  • memory/4188-56-0x000000000A140000-0x000000000A24A000-memory.dmp

    Filesize

    1.0MB

  • memory/4188-55-0x000000000A610000-0x000000000AC28000-memory.dmp

    Filesize

    6.1MB

  • memory/4188-54-0x00000000008B0000-0x00000000008B6000-memory.dmp

    Filesize

    24KB

  • memory/4188-53-0x0000000000180000-0x00000000001B0000-memory.dmp

    Filesize

    192KB

  • memory/4336-46-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-28-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-40-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-38-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-36-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-34-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-32-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-24-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-22-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-20-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-19-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-42-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-26-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-49-0x0000000074530000-0x0000000074CE0000-memory.dmp

    Filesize

    7.7MB

  • memory/4336-47-0x0000000074530000-0x0000000074CE0000-memory.dmp

    Filesize

    7.7MB

  • memory/4336-44-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-30-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4336-17-0x0000000004980000-0x0000000004998000-memory.dmp

    Filesize

    96KB

  • memory/4336-18-0x0000000074530000-0x0000000074CE0000-memory.dmp

    Filesize

    7.7MB

  • memory/4336-16-0x0000000004A30000-0x0000000004FD4000-memory.dmp

    Filesize

    5.6MB

  • memory/4336-15-0x00000000022D0000-0x00000000022EA000-memory.dmp

    Filesize

    104KB

  • memory/4336-14-0x000000007453E000-0x000000007453F000-memory.dmp

    Filesize

    4KB