Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 23:44

General

  • Target

    3e06b9a6ddb24ed3e6a7afdbb02e5d2c2fda6d82e1888416f83cddbbc1d82c77.exe

  • Size

    787KB

  • MD5

    03bdd27d427bc0fb6807e178ac2b61b0

  • SHA1

    667e0925a84702c5d75fee03e325cbdb9d5ccb46

  • SHA256

    3e06b9a6ddb24ed3e6a7afdbb02e5d2c2fda6d82e1888416f83cddbbc1d82c77

  • SHA512

    615b0920b40a0b8ce063414dfc20697955c55b23352baaa69408e502898f3f1969a53e02392c28b93c93314a9bf1ff290b94f24ab46c26274d0fea12e4b399c9

  • SSDEEP

    12288:GMroy90nbjhHnvZlFRwkQqdSRuUwfI/dlDXcU7L7K1m4Zsll88mlKVU2:CygvZhQqdSRuUWI/dlDXcKomkQnwKVl

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e06b9a6ddb24ed3e6a7afdbb02e5d2c2fda6d82e1888416f83cddbbc1d82c77.exe
    "C:\Users\Admin\AppData\Local\Temp\3e06b9a6ddb24ed3e6a7afdbb02e5d2c2fda6d82e1888416f83cddbbc1d82c77.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un778091.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un778091.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3359.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3359.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:860
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 1064
          4⤵
          • Program crash
          PID:3180
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8478.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8478.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:624
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5628
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 1196
          4⤵
          • Program crash
          PID:6072
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265737.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265737.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2804
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 860 -ip 860
    1⤵
      PID:4504
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 624 -ip 624
      1⤵
        PID:6116

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si265737.exe

        Filesize

        168KB

        MD5

        5e26f2b058b31f255dc7a48357af8bdd

        SHA1

        515814d7b072a3d9983200c294daff6722686455

        SHA256

        2dfeb598b19f1971ab7c335ae85325152ad6bd0ddde5ef2f9f98a5f99d89b2ed

        SHA512

        41c219be38befa2d29550e193df7c81d1f85f5d7d5ed94bedd0a897c610c249062176971b08353dd6d2b48cfde8a20fc58eb3ffdf0d58618dc4a79b49b1fd50b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un778091.exe

        Filesize

        633KB

        MD5

        233bfb926a7ba01e213eb5fa69397c4f

        SHA1

        666577476c30c0d4984fd0de757326b0bd45f21a

        SHA256

        94ae56314a346ee6d7566c19f6941cdc39f8c0afd0afe9a7a153691f42820624

        SHA512

        12168c962996895da6db569b18117769c16b9d78ee4fbf9511a55d61b4df145e21fdd6f92777b039452612f08dd8e07931368fe867a48ffba768846bd545c14c

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3359.exe

        Filesize

        231KB

        MD5

        f1d3439d7b479c4c6ad0f67a769e9e75

        SHA1

        a0b4703d6e8f27367a52c877b003c902e54519b9

        SHA256

        2e13f33a870c84e3d26c6a449032cf6b21e9d3f75c603d94259ef50efecea87d

        SHA512

        6747900f9fc287e104d049c760c93b8df305636ade96df449c474ead53202f3e5852ed9d0a60d3304d120b1bec4cd837f688bda94b92be4bace6a6ce992d49b1

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8478.exe

        Filesize

        414KB

        MD5

        f0d422a6fcc9018cecc268db6f132fe8

        SHA1

        3ff266df2c7e5db163bedb5dd3ce0d6ac11cefda

        SHA256

        629d14dc51ac610ad8b6dd8fe56e731c3f7ab93a56ed0a38a519807a077ce778

        SHA512

        75d6a0f26d75ad989d692505dabd796a95e7088c278337faa99a3779422c9ba04505856c6ec5c1afb805efae31424615a41f6de310fa11bb1ef99eb585c13627

      • C:\Windows\Temp\1.exe

        Filesize

        168KB

        MD5

        1073b2e7f778788852d3f7bb79929882

        SHA1

        7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

        SHA256

        c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

        SHA512

        90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

      • memory/624-72-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-61-0x0000000004BC0000-0x0000000004C26000-memory.dmp

        Filesize

        408KB

      • memory/624-2143-0x0000000005400000-0x0000000005432000-memory.dmp

        Filesize

        200KB

      • memory/624-64-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-66-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-68-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-63-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-70-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-77-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-78-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-83-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-84-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-88-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-90-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-93-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-94-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-96-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-74-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-80-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-86-0x00000000051E0000-0x000000000523F000-memory.dmp

        Filesize

        380KB

      • memory/624-62-0x00000000051E0000-0x0000000005246000-memory.dmp

        Filesize

        408KB

      • memory/860-27-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-39-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-56-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/860-18-0x0000000000400000-0x00000000004A8000-memory.dmp

        Filesize

        672KB

      • memory/860-52-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/860-51-0x00000000004B0000-0x00000000004DD000-memory.dmp

        Filesize

        180KB

      • memory/860-22-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-23-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-45-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-50-0x0000000000560000-0x0000000000660000-memory.dmp

        Filesize

        1024KB

      • memory/860-25-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-19-0x00000000026D0000-0x00000000026EA000-memory.dmp

        Filesize

        104KB

      • memory/860-29-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-31-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-33-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-35-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-37-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-55-0x0000000000400000-0x00000000004A8000-memory.dmp

        Filesize

        672KB

      • memory/860-41-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-16-0x00000000004B0000-0x00000000004DD000-memory.dmp

        Filesize

        180KB

      • memory/860-43-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-47-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-49-0x0000000002740000-0x0000000002752000-memory.dmp

        Filesize

        72KB

      • memory/860-21-0x0000000002740000-0x0000000002758000-memory.dmp

        Filesize

        96KB

      • memory/860-20-0x0000000004BE0000-0x0000000005184000-memory.dmp

        Filesize

        5.6MB

      • memory/860-17-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/860-15-0x0000000000560000-0x0000000000660000-memory.dmp

        Filesize

        1024KB

      • memory/2804-2167-0x0000000000070000-0x000000000009E000-memory.dmp

        Filesize

        184KB

      • memory/2804-2168-0x0000000002360000-0x0000000002366000-memory.dmp

        Filesize

        24KB

      • memory/5628-2157-0x0000000001030000-0x0000000001036000-memory.dmp

        Filesize

        24KB

      • memory/5628-2158-0x0000000005730000-0x0000000005D48000-memory.dmp

        Filesize

        6.1MB

      • memory/5628-2159-0x0000000005220000-0x000000000532A000-memory.dmp

        Filesize

        1.0MB

      • memory/5628-2160-0x0000000005030000-0x0000000005042000-memory.dmp

        Filesize

        72KB

      • memory/5628-2161-0x0000000005090000-0x00000000050CC000-memory.dmp

        Filesize

        240KB

      • memory/5628-2156-0x00000000006A0000-0x00000000006D0000-memory.dmp

        Filesize

        192KB

      • memory/5628-2166-0x0000000005110000-0x000000000515C000-memory.dmp

        Filesize

        304KB