Analysis
- max time kernel
146s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/11/2024, 14:21
General
- Target 63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf.exe
- Size 723KB
- Sample241104-rn38ys1cpd
- SHA256 63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf
Malware Config
Extracted
-
redline
-
dezik
-
193.56.146.220:4174
-
auth_value
d39f21dca8edc10800b036ab83f4d75e
Signatures
- Detects Healer an antivirus disabler dropper 17 IoCs
- Healer
Healer an antivirus disabler dropper.
- Healer family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Redline family
- Executes dropped EXE 3 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf.exe"C:\Users\Admin\AppData\Local\Temp\63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film5950.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bum8113.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\con3150.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
film5950.exe
bum8113.exe
con3150.exe
memory/1708-52-0x0000000002190000-0x0000000002217000-memory.dmp
memory/1708-1-0x0000000002190000-0x0000000002217000-memory.dmp
memory/1708-2-0x0000000002220000-0x00000000022AF000-memory.dmp
memory/1708-3-0x0000000000400000-0x0000000000492000-memory.dmp
memory/1708-55-0x0000000000400000-0x0000000000538000-memory.dmp
memory/1708-54-0x0000000000400000-0x0000000000492000-memory.dmp
memory/1708-53-0x0000000002220000-0x00000000022AF000-memory.dmp
memory/2320-68-0x0000000004EC0000-0x0000000004F0C000-memory.dmp
memory/2320-67-0x0000000004D40000-0x0000000004D7C000-memory.dmp
memory/2320-66-0x0000000004CE0000-0x0000000004CF2000-memory.dmp
memory/2320-65-0x0000000004DB0000-0x0000000004EBA000-memory.dmp
memory/2320-64-0x0000000005280000-0x0000000005898000-memory.dmp
memory/2320-63-0x00000000002D0000-0x0000000000302000-memory.dmp
memory/4072-23-0x0000000005170000-0x0000000005188000-memory.dmp
memory/4072-45-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-37-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-35-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-31-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-29-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-27-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-25-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-24-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-41-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-43-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-40-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-47-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-59-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/4072-49-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-51-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-33-0x0000000005170000-0x0000000005182000-memory.dmp
memory/4072-22-0x0000000004B60000-0x0000000005104000-memory.dmp
memory/4072-21-0x0000000002530000-0x000000000254A000-memory.dmp
memory/4072-20-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/4072-19-0x0000000000400000-0x00000000004D4000-memory.dmp