Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 14:49

General

  • Target

    cc6d978c1f4f3ff1c9f85ac715299464b6b106c70aeb9adce32b6d355ba45721.exe

  • Size

    309KB

  • MD5

    290ff81ba12e0d1d1a636eb5a3de8823

  • SHA1

    98ec545dbb97f4b7c55ee3fc91afe85d8e2d60aa

  • SHA256

    cc6d978c1f4f3ff1c9f85ac715299464b6b106c70aeb9adce32b6d355ba45721

  • SHA512

    f168ae49314180c63bd492aa57a7f74b629f4a4398772ade9e4cc9dbcf3e8f8d228beb23c81a668edc4351c892e32c7c0867f91a77a6a667d7151ddbcec2e6f4

  • SSDEEP

    6144:KUy+bnr+sp0yN90QEM5F5OYc1u31g4TByQpv2+YtIpTA:IMrQy906xc1u31TTEQh2HtSA

Malware Config

Extracted

Family

redline

Botnet

mihan

C2

217.196.96.101:4132

Attributes
  • auth_value

    9a6a8fdae02ed7caa0a49a6ddc6d4520

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc6d978c1f4f3ff1c9f85ac715299464b6b106c70aeb9adce32b6d355ba45721.exe
    "C:\Users\Admin\AppData\Local\Temp\cc6d978c1f4f3ff1c9f85ac715299464b6b106c70aeb9adce32b6d355ba45721.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a1587872.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a1587872.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4524
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b9227143.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b9227143.exe
      2⤵
      • Executes dropped EXE
      PID:3320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a1587872.exe

    Filesize

    180KB

    MD5

    dc02f493457d8140b6ed053d863b22ac

    SHA1

    23e8d16252858e158ce9c2ad1f4cdd98af7fafdf

    SHA256

    f3b4b311bb327baada40d1816a63b07e3f746c34c0ac2697c2c2ded49f749441

    SHA512

    40140ba8ef1acd512c4386e75197d700e672e7ba9947fca55ec7133c8b60e3dcdf2819e27e02034b144bc018b76d3a11f68fae369b12913936f2f994d28c09f9

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b9227143.exe

    Filesize

    168KB

    MD5

    b7208351dc609734ee4b3c3ccee39446

    SHA1

    d465d144bd92d9ba65519093831fa959e7fcefcc

    SHA256

    e58a43efebb2b72b288207f0988b24dd69e9f9895207564211f5b667c1c7770f

    SHA512

    8d808468ecbc0248d298646513085aa7062742fb422d1a4aba32aa78f8042e3331379581e80bc856f648f7d34a23abbbfac9bddf6d8ee6140ba1888079c5ad69

  • memory/3320-56-0x00000000744B0000-0x000000007455B000-memory.dmp

    Filesize

    684KB

  • memory/3320-55-0x0000000004D10000-0x0000000004D5C000-memory.dmp

    Filesize

    304KB

  • memory/3320-54-0x0000000004B90000-0x0000000004BCC000-memory.dmp

    Filesize

    240KB

  • memory/3320-53-0x00000000744B0000-0x000000007455B000-memory.dmp

    Filesize

    684KB

  • memory/3320-52-0x0000000004B30000-0x0000000004B42000-memory.dmp

    Filesize

    72KB

  • memory/3320-51-0x0000000004C00000-0x0000000004D0A000-memory.dmp

    Filesize

    1.0MB

  • memory/3320-50-0x00000000050F0000-0x0000000005708000-memory.dmp

    Filesize

    6.1MB

  • memory/3320-49-0x0000000000810000-0x0000000000816000-memory.dmp

    Filesize

    24KB

  • memory/3320-47-0x00000000744B0000-0x000000007455B000-memory.dmp

    Filesize

    684KB

  • memory/3320-48-0x0000000000070000-0x00000000000A0000-memory.dmp

    Filesize

    192KB

  • memory/4524-38-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-43-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/4524-28-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-25-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-23-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-21-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-19-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-17-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-15-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-13-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-41-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/4524-30-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-31-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-33-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-35-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-40-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/4524-39-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-12-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/4524-11-0x0000000004980000-0x0000000004998000-memory.dmp

    Filesize

    96KB

  • memory/4524-9-0x0000000004A10000-0x0000000004FB4000-memory.dmp

    Filesize

    5.6MB

  • memory/4524-10-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/4524-8-0x0000000002070000-0x000000000208A000-memory.dmp

    Filesize

    104KB

  • memory/4524-7-0x000000007450E000-0x000000007450F000-memory.dmp

    Filesize

    4KB