Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 21:26

General

  • Target

    0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe

  • Size

    1.5MB

  • MD5

    fbd46982e2845ad803edb569cc9ac627

  • SHA1

    d32896454d3eccd2d66804f00be156b997531167

  • SHA256

    0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb

  • SHA512

    e1b6fa081dac305e2f491d045a2baec5a18667038a201ab5021c7496122608deb02695d5258152b45590d6c7798d06fdbbca13fe0396df026ae0a790577a201f

  • SSDEEP

    24576:vyDFcw7PyWymJjFz61IDEKYppR4620k/Qj/sZPsobXpWSYdWgsyu6agBU:6DdLhSODpErIxQg7p8dWQ

Malware Config

Extracted

Family

redline

Botnet

max

C2

185.161.248.73:4164

Attributes
  • auth_value

    efb1499709a5d08ed1ddf71cff71211f

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe
    "C:\Users\Admin\AppData\Local\Temp\0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i57805258.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i57805258.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i01915325.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i01915325.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i14906422.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i14906422.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1184
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i14591860.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i14591860.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3584
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73106153.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73106153.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4924
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b87968139.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b87968139.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1756
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:5028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i57805258.exe

    Filesize

    1.2MB

    MD5

    ae3120de142240133369adcd054863ae

    SHA1

    751c2625cdb857f7aa35e308b4d1a3414514b3e7

    SHA256

    fde3b9f4c67f1179771603a27f0ca8a7acb12f6b42fc2d5d0b0431d8b411f1fb

    SHA512

    c74bf2d5ad3dd79e154f26508aeba08baad8ea046b877af8ac6a750367bd9b09dcadd0f3fcb2674bd225ade43a78f4e55dc780b6bee1e8f890bf458119127ea4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i01915325.exe

    Filesize

    1.1MB

    MD5

    c3e47f6981b4403d6024b7e0f03572fa

    SHA1

    d1bd01524c475e81f40fa8f80698994260eb75db

    SHA256

    313ec4442d2bc3f8444a8d32c7a98a8cb1d53b3c9ec984970c0535549f52278f

    SHA512

    c5a45cbfaae3814bec15680372a8aa73507cf34b10eccdb9e5baa781cc76058b6a3550ddd36da2e3ba8d03c45dc845e870a5213ad3cbe872eded0344409f4b5b

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i14906422.exe

    Filesize

    590KB

    MD5

    ab7975778b0884fd105b9a43a1badc85

    SHA1

    a519b8ee0dc5bb56c9212319fffbbe5aca80b6df

    SHA256

    322481e4f929eed7133bcb446cdbdbaa21168a9d4889320487c085ab9a79f955

    SHA512

    06bad8ae3652ae23b72c6f40e353e21514c7d1659ad9ff9697002e25c988c7ae5ac14779a803422747c5d4e20821a8633d6190f01d27eb483808468b741f1292

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i14591860.exe

    Filesize

    310KB

    MD5

    db35c62fd3611fcdf2bb0a01faf83b9d

    SHA1

    361fb3a2a41f3331e9132b1b72b786f732b85bc0

    SHA256

    0769f2a6ad821f4ccecfb59628deabdbc8fe7bcef858e2cfe84c1590c3bf420d

    SHA512

    1a48c1acf594d00dbf3be53fb764edf890784e1eb28599efdf29fc0d7d311e0d5d2e5533eb60131127e22a78390ac64787ad4ccf3df48fc6665580f19d1c7f74

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73106153.exe

    Filesize

    177KB

    MD5

    035673723873f1197ed4161cdc5d949d

    SHA1

    699847dd4757f20391d17cbb616da3240db5e48d

    SHA256

    b25eaf6dd2e8752ed2a8b7081217a01bb94ce7e116e1d7802205cf8afe62ea95

    SHA512

    96fa0103c259a12c87e2f0f57e21b950c908256f2e3e1ca765dd39da534aa2b8e9ae819cdf1f61edcb1fab09614cef17e7dfa842917b33fb370f935f58a56568

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b87968139.exe

    Filesize

    168KB

    MD5

    300774f7b4fd8b774aa9ccad4ef94993

    SHA1

    ff0b64209b0fde7eaba149a0b79598e717aea859

    SHA256

    e2e69ca36f0c193004383528daeb9968f97e7d31a4fd96417759702798a1b92b

    SHA512

    4d273ada8623571a1f1912d883e0ff78ff3ba4d5d9eb2780a3f26400a1e82580af479f27739ce752f94246476de7b0f3e08a8985c9b9ce65f76f425a4adf256d

  • memory/1756-75-0x000000000AF00000-0x000000000AF3C000-memory.dmp

    Filesize

    240KB

  • memory/1756-74-0x000000000AEA0000-0x000000000AEB2000-memory.dmp

    Filesize

    72KB

  • memory/1756-73-0x000000000AF70000-0x000000000B07A000-memory.dmp

    Filesize

    1.0MB

  • memory/1756-72-0x000000000B460000-0x000000000BA78000-memory.dmp

    Filesize

    6.1MB

  • memory/1756-71-0x00000000031B0000-0x00000000031B6000-memory.dmp

    Filesize

    24KB

  • memory/1756-70-0x0000000000FC0000-0x0000000000FF0000-memory.dmp

    Filesize

    192KB

  • memory/1756-76-0x0000000005300000-0x000000000534C000-memory.dmp

    Filesize

    304KB

  • memory/4924-53-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-38-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-51-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-49-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-47-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-45-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-43-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-41-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-39-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-56-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-57-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-59-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-61-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-63-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-65-0x00000000050A0000-0x00000000050B3000-memory.dmp

    Filesize

    76KB

  • memory/4924-37-0x00000000050A0000-0x00000000050B8000-memory.dmp

    Filesize

    96KB

  • memory/4924-36-0x0000000004AF0000-0x0000000005094000-memory.dmp

    Filesize

    5.6MB

  • memory/4924-35-0x00000000021C0000-0x00000000021DA000-memory.dmp

    Filesize

    104KB