Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 15:01

General

  • Target

    6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe

  • Size

    924KB

  • MD5

    f2a435288af42881303cdb4793ee7400

  • SHA1

    9f5bd3e4f31299347372107b08b89938437393df

  • SHA256

    6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680

  • SHA512

    18a69e04bd6ae02bf78bb2673dbe3b7710c889afa62189238db4837f1230d5debc6b97f02a8a8d677f5df5cc19b6fc735ef1502a35c05a060d767a9fcd550e5d

  • SSDEEP

    24576:oyWuYzzI8C7pWy5JAFCCMr58qneW2i4IFoYYOiG:vmzIls0OMr58qneni4EoYYj

Malware Config

Extracted

Family

redline

Botnet

lamp

C2

77.91.68.56:19071

Attributes
  • auth_value

    ee1df63bcdbe3de70f52810d94eaff7d

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe
    "C:\Users\Admin\AppData\Local\Temp\6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4939975.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4939975.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8386149.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8386149.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3687580.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3687580.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2012
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1580374.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1580374.exe
          4⤵
          • Executes dropped EXE
          PID:764
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:4912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

    Filesize

    226B

    MD5

    916851e072fbabc4796d8916c5131092

    SHA1

    d48a602229a690c512d5fdaf4c8d77547a88e7a2

    SHA256

    7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

    SHA512

    07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4939975.exe

    Filesize

    769KB

    MD5

    4e2ed87ab13740312980b1234c473f30

    SHA1

    e0fa5e983211bfddc5455f561eb851b270831d21

    SHA256

    44c2d430d0e632ac382ff69f145c780dc7d5edfa076d654f2a50addb2cec44c5

    SHA512

    d65f7fcf177a42a019ddc24d5806c1c0ea45c7a2abb1f79fb9a9b46fa3c1725a07dcceaf7488e46ac5b6e4535d40edcf30d259cc7e093b13b2b06b02f240fe62

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8386149.exe

    Filesize

    585KB

    MD5

    68fad26ce9ec0769a342a98d678121aa

    SHA1

    a016b3f5a0b8d4028fc34d1d88739069f9118f4a

    SHA256

    dd392838a4ada327f8d19ff9267f07a66c77cff37c0fe896a11e6976d2ec4ad2

    SHA512

    fb4d57ec4f2219fd0c1f735a1f256c60f8efb2f0b3e39126bfeeb6601f8ab70b38733455120941a864c8d7eebace2cb68299c2109407143bad4a0e87eb8b48e9

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3687580.exe

    Filesize

    293KB

    MD5

    82da915b520ee55a0c99f15ebfcb20a9

    SHA1

    13aa02baafd27b191cbc444d5d0495390ab21944

    SHA256

    633271b1342a29011618b4f80c9593600520342c364bb28432e2ecdc7d88887f

    SHA512

    1ba2ca8c73f574d98bf0be1be56abfc2275798823ceb2236764042222fd76470eaa948ba6d87b74d5cb8313a3fa2eb8fcd96c7674cb80512342788d998081864

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l1580374.exe

    Filesize

    491KB

    MD5

    818ec8db504a8cf205c9a72d83261269

    SHA1

    4477b0959d99ebe973613b184b77dd983269d375

    SHA256

    23c2976f15feed76828bf10c91d4d631cba06e041c388e8d8068d161a4ce98c4

    SHA512

    1fc28585a58ab00f36cde57307ebc70b7ad1b6f07736614cade71ed918fcbd2d1798cd61cc625196a7208ba258a7a1e647694c6c9270097ee4c3f4230fd85da5

  • memory/764-45-0x0000000005EB0000-0x00000000064C8000-memory.dmp

    Filesize

    6.1MB

  • memory/764-36-0x0000000001FD0000-0x000000000205C000-memory.dmp

    Filesize

    560KB

  • memory/764-42-0x0000000001FD0000-0x000000000205C000-memory.dmp

    Filesize

    560KB

  • memory/764-44-0x00000000022A0000-0x00000000022A6000-memory.dmp

    Filesize

    24KB

  • memory/764-46-0x0000000004A90000-0x0000000004B9A000-memory.dmp

    Filesize

    1.0MB

  • memory/764-47-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

    Filesize

    72KB

  • memory/764-48-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

    Filesize

    240KB

  • memory/764-49-0x0000000006500000-0x000000000654C000-memory.dmp

    Filesize

    304KB

  • memory/2012-28-0x0000000001F90000-0x0000000001FCE000-memory.dmp

    Filesize

    248KB

  • memory/2012-29-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/2012-27-0x0000000000401000-0x0000000000404000-memory.dmp

    Filesize

    12KB

  • memory/2012-22-0x0000000001F90000-0x0000000001FCE000-memory.dmp

    Filesize

    248KB