Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 13:27

General

  • Target

    b9b5a6ff31e4f9c42391a16423c592a1141cb0a7cec80080ddeaf252dd487082.exe

  • Size

    658KB

  • MD5

    ac93827aec4c95204707afb08f6f4329

  • SHA1

    45799ca5a063f5530793016df973777300c8c6d5

  • SHA256

    b9b5a6ff31e4f9c42391a16423c592a1141cb0a7cec80080ddeaf252dd487082

  • SHA512

    242ad798ad40a171ebb0eb540e50721b76dffcd39f22c8ce62b9106c6a37c0f64765d6459e87905d2580e4711dc3082e08a5bb8a253cf43710d956380578fb68

  • SSDEEP

    12288:0Mrhy90TCfs7UBqGkMEZzFM06bhuN0FF+LArBzl:VyQ8qGgpMFb8qFhrr

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9b5a6ff31e4f9c42391a16423c592a1141cb0a7cec80080ddeaf252dd487082.exe
    "C:\Users\Admin\AppData\Local\Temp\b9b5a6ff31e4f9c42391a16423c592a1141cb0a7cec80080ddeaf252dd487082.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un291695.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un291695.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9100.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9100.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3640
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1084
          4⤵
          • Program crash
          PID:2112
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2543.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2543.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2176
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3640 -ip 3640
    1⤵
      PID:1336

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un291695.exe

      Filesize

      517KB

      MD5

      8b6ddbdbaa07a19025c59a92356213e7

      SHA1

      2d93838e75671a3393387d2c3ff9f793fe628d0f

      SHA256

      aa234b55e4ab253fe9a1e943879ebd49ee75534d663e807a21cd9bbc88042256

      SHA512

      319bf311eb0ed19b9b1f09fece85c77bf4288669882696df320a9cc65236f3bb8d0bca83ac6c451e02462c89ade2a3e8c0d73f10c7dace0873d18da83d5a34a0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9100.exe

      Filesize

      376KB

      MD5

      e4a14716f6bf532acd62d78ff195faac

      SHA1

      d920def604caea13a3de6ae90901b5c39a83557d

      SHA256

      e7344b1ad6ab954a4fb2c0dafc42884f6d8e69d18b064c705e160277f5af4da7

      SHA512

      bab89cd6b985a9cd9901386cb848ce256e7c6826bb01b393c762902be472f009097fc1bf0548b3651be202b348d303ebdd09243d93d9e198dda762028545a3b4

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2543.exe

      Filesize

      434KB

      MD5

      d71ee4f014b8126399d40113315db366

      SHA1

      54e9b25ad77a805753be6547373de2a39a30def5

      SHA256

      4a5a4deb96113f0d98a347a38f8f37331c1bcbd76de193757435ab3d3f62d0d4

      SHA512

      d5ca0997f581d225f938cca6dde62a3b7d875187d231e4bb3f3cf60d9c12eb812335c86cb1a312d62932510bf3acc3f944f5219bf5ae29f0a2dd187d2d7ea0fe

    • memory/2176-74-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-78-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-970-0x0000000005AF0000-0x0000000005BFA000-memory.dmp

      Filesize

      1.0MB

    • memory/2176-969-0x0000000005450000-0x0000000005A68000-memory.dmp

      Filesize

      6.1MB

    • memory/2176-63-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-64-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-92-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-66-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-68-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-72-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-972-0x0000000005C50000-0x0000000005C8C000-memory.dmp

      Filesize

      240KB

    • memory/2176-973-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

      Filesize

      304KB

    • memory/2176-76-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-971-0x0000000005C30000-0x0000000005C42000-memory.dmp

      Filesize

      72KB

    • memory/2176-82-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-84-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-86-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-88-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-90-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-94-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-96-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-80-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-70-0x00000000053B0000-0x00000000053EF000-memory.dmp

      Filesize

      252KB

    • memory/2176-62-0x00000000053B0000-0x00000000053F4000-memory.dmp

      Filesize

      272KB

    • memory/2176-61-0x0000000004D30000-0x0000000004D76000-memory.dmp

      Filesize

      280KB

    • memory/3640-41-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-55-0x0000000000400000-0x0000000000813000-memory.dmp

      Filesize

      4.1MB

    • memory/3640-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/3640-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/3640-51-0x0000000000AA0000-0x0000000000ACD000-memory.dmp

      Filesize

      180KB

    • memory/3640-50-0x00000000009A0000-0x0000000000AA0000-memory.dmp

      Filesize

      1024KB

    • memory/3640-22-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-23-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-25-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-27-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-29-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-31-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-33-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-35-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-37-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-39-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-43-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-45-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-47-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-49-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3640-21-0x0000000002A70000-0x0000000002A88000-memory.dmp

      Filesize

      96KB

    • memory/3640-20-0x0000000004F50000-0x00000000054F4000-memory.dmp

      Filesize

      5.6MB

    • memory/3640-19-0x0000000002560000-0x000000000257A000-memory.dmp

      Filesize

      104KB

    • memory/3640-18-0x0000000000400000-0x0000000000813000-memory.dmp

      Filesize

      4.1MB

    • memory/3640-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/3640-16-0x0000000000AA0000-0x0000000000ACD000-memory.dmp

      Filesize

      180KB

    • memory/3640-15-0x00000000009A0000-0x0000000000AA0000-memory.dmp

      Filesize

      1024KB