Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 13:28

General

  • Target

    e56b831b3a8709fcfafb0436cf0659623a277cfc7901d3eb588225b67119ab62.exe

  • Size

    695KB

  • MD5

    569cc46df2287d34db748c1e1692e889

  • SHA1

    7e793077eee94fb696ce60a9a0896293b513acc2

  • SHA256

    e56b831b3a8709fcfafb0436cf0659623a277cfc7901d3eb588225b67119ab62

  • SHA512

    8bb63f615daefe491068191998b090dd087216ab52797cf382ae198a4a1fbc45b27a2573ce9d17cab048975b2fe1cbcc9781ff46566393b718357bccacfec264

  • SSDEEP

    12288:iMrey907kf0Vk5KTvuHoVK2+ctig0wiyc/ED/0mQsc2zjsVr1gIeT:QyHMVk8T2HUb+ctigoy5YmDc2zi+IeT

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e56b831b3a8709fcfafb0436cf0659623a277cfc7901d3eb588225b67119ab62.exe
    "C:\Users\Admin\AppData\Local\Temp\e56b831b3a8709fcfafb0436cf0659623a277cfc7901d3eb588225b67119ab62.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ntE7554az.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ntE7554az.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0673po.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0673po.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2212
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c18iN53.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c18iN53.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ntE7554az.exe

    Filesize

    550KB

    MD5

    8d8cff7f9ff25d4b0fbcb5b02ef6e07e

    SHA1

    264460c42c1bc1855eae79be429bae5eb4944bbe

    SHA256

    c91214269ca20b1d77f3634ededa7994749c5909cb502b0b2226b570fdfa92e1

    SHA512

    7b1bec5662b59df78246cfe6b4642c6f68970b6f1952c5657a857a751e4274b440b0dc9021bc31d212b23f9e66cde648c28ecf99baff6063bbed2e115cabed47

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0673po.exe

    Filesize

    323KB

    MD5

    ee43881ab62092621b2d2e22a0295878

    SHA1

    0339221e3f787602fea6a0541817565d751a293c

    SHA256

    2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

    SHA512

    df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c18iN53.exe

    Filesize

    381KB

    MD5

    b7fd6550e1ca3851916615fe813c75ae

    SHA1

    36291cf993af455c8d64d8c81e7f187e930d87ff

    SHA256

    4329461f1afe5dde94f9e943f3a0d7f6230cad1afa14247b5f09612c96d63177

    SHA512

    99fb8ff6f99d6c4670a0c948b4ae3fc0fdbd4bac446e0cb9168fb382929c23e9419fb628b038c2c7dc2db61a844984269e9fd002f3984d362914b882fc830f56

  • memory/2212-53-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/2212-20-0x0000000004BB0000-0x0000000004BC8000-memory.dmp

    Filesize

    96KB

  • memory/2212-15-0x0000000000760000-0x0000000000860000-memory.dmp

    Filesize

    1024KB

  • memory/2212-19-0x0000000004CE0000-0x0000000005284000-memory.dmp

    Filesize

    5.6MB

  • memory/2212-30-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-26-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-48-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-46-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-44-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-42-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-40-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-38-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-36-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-34-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-32-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-17-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/2212-28-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-24-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-23-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-21-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

  • memory/2212-49-0x0000000000760000-0x0000000000860000-memory.dmp

    Filesize

    1024KB

  • memory/2212-50-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2212-16-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2212-54-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2212-18-0x00000000026C0000-0x00000000026DA000-memory.dmp

    Filesize

    104KB

  • memory/3224-59-0x0000000004940000-0x0000000004986000-memory.dmp

    Filesize

    280KB

  • memory/3224-86-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-60-0x00000000049C0000-0x0000000004A04000-memory.dmp

    Filesize

    272KB

  • memory/3224-78-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-61-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-94-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-92-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-70-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-88-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-84-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-80-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-971-0x0000000005A70000-0x0000000005ABC000-memory.dmp

    Filesize

    304KB

  • memory/3224-72-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-75-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-90-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-68-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-66-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-64-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-62-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-82-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB

  • memory/3224-967-0x0000000005120000-0x0000000005738000-memory.dmp

    Filesize

    6.1MB

  • memory/3224-968-0x00000000057C0000-0x00000000058CA000-memory.dmp

    Filesize

    1.0MB

  • memory/3224-969-0x0000000005900000-0x0000000005912000-memory.dmp

    Filesize

    72KB

  • memory/3224-970-0x0000000005920000-0x000000000595C000-memory.dmp

    Filesize

    240KB

  • memory/3224-76-0x00000000049C0000-0x00000000049FE000-memory.dmp

    Filesize

    248KB