Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 13:31

General

  • Target

    6239fcfa95f5b7d296867ef3e819427f062b3cd41374bedea9eb6236b87eef7e.exe

  • Size

    536KB

  • MD5

    7c49325fde016ef1e025cf6a2e05db38

  • SHA1

    807e75cb122cb46ebfe0f8b7a6de96b3bfe9e352

  • SHA256

    6239fcfa95f5b7d296867ef3e819427f062b3cd41374bedea9eb6236b87eef7e

  • SHA512

    bb4d383dffbe377a9a64fce8ecdda3ba3b37624326db869a7051d3a27ceb320624e1c38c54c10863ac8d07a2a20eda5b8fa02f067640f7a3e65fbd8299d64f46

  • SSDEEP

    12288:TMrHy90xvvFUP/oBj9y0/x9mP5FyaKn84JKt6fBQtf:oyovKPgBBy0DuTyfnRMt60f

Malware Config

Extracted

Family

redline

Botnet

rumfa

C2

193.233.20.24:4123

Attributes
  • auth_value

    749d02a6b4ef1fa2ad908e44ec2296dc

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6239fcfa95f5b7d296867ef3e819427f062b3cd41374bedea9eb6236b87eef7e.exe
    "C:\Users\Admin\AppData\Local\Temp\6239fcfa95f5b7d296867ef3e819427f062b3cd41374bedea9eb6236b87eef7e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vjA8002pf.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vjA8002pf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3648
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw32GQ05KM14.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw32GQ05KM14.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3928
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tiW66hp93.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tiW66hp93.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4828
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:5568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vjA8002pf.exe

    Filesize

    391KB

    MD5

    436de899850c0ce7c337eaa5ce04af55

    SHA1

    b144d8f43c028f087fadaf44bf081e29996e6b3c

    SHA256

    5859c63aab925dbce5cce9ea7e402b80e99c9f1720ded017597885e681615287

    SHA512

    a8ae7eabb475d971fb3db6a904a4de01905bc1b58a8387f85bb004c29a8aa7bf8a140b8fdaa58161d28100bab0e90d0b0fa2f43e901beabdc721f7c42f021802

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw32GQ05KM14.exe

    Filesize

    17KB

    MD5

    023dfa66c97a31e4adef242da786e97b

    SHA1

    9e24d79a0ad22852069570a1320d37d978ddd329

    SHA256

    e7e691dca8f730a466024c5deb2efb768167a9ab0ebe4290396a2ad8b91a74a2

    SHA512

    b7c03cdcd11b854b14bad5139da2a9dd688e390e28c9958c89c062e6510cacaecea0cda23565a15e427b3d0a469881783595ade36411eb1494d1f625d1794253

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tiW66hp93.exe

    Filesize

    303KB

    MD5

    12a07204bf4c65efdd968689ed260c4e

    SHA1

    8430e5110448dc962c4191a1a06b05c4e3c1a140

    SHA256

    e4666bb9e57296f0140b125a1c5e32f446659b0baa2c3d7fef87a7aef339433b

    SHA512

    61dbfcedae6259039196942064d62cae0de853c6c5afa3547e6394e789ddf3c0acc6e94cd2c89c090c6f891a77565b0fe332b21da0afa5a5102f1d12d4f3989a

  • memory/3928-14-0x00007FF9DE053000-0x00007FF9DE055000-memory.dmp

    Filesize

    8KB

  • memory/3928-15-0x0000000000510000-0x000000000051A000-memory.dmp

    Filesize

    40KB

  • memory/3928-17-0x00007FF9DE053000-0x00007FF9DE055000-memory.dmp

    Filesize

    8KB

  • memory/4828-62-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-52-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-24-0x0000000002660000-0x00000000026A4000-memory.dmp

    Filesize

    272KB

  • memory/4828-32-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-44-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-88-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-84-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-82-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-80-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-78-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-76-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-74-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-70-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-68-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-66-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-64-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-22-0x0000000002560000-0x00000000025A6000-memory.dmp

    Filesize

    280KB

  • memory/4828-60-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-58-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-56-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-54-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-23-0x0000000004E50000-0x00000000053F4000-memory.dmp

    Filesize

    5.6MB

  • memory/4828-48-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-46-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-43-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-40-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-39-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-36-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-34-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-86-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-72-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-50-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-30-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-28-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-26-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-25-0x0000000002660000-0x000000000269E000-memory.dmp

    Filesize

    248KB

  • memory/4828-931-0x0000000005400000-0x0000000005A18000-memory.dmp

    Filesize

    6.1MB

  • memory/4828-932-0x0000000004C80000-0x0000000004D8A000-memory.dmp

    Filesize

    1.0MB

  • memory/4828-933-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

    Filesize

    72KB

  • memory/4828-934-0x0000000004DE0000-0x0000000004E1C000-memory.dmp

    Filesize

    240KB

  • memory/4828-935-0x0000000005B20000-0x0000000005B6C000-memory.dmp

    Filesize

    304KB