Analysis
- max time kernel
145s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/11/2024, 15:06
General
- Target c58eaed8811920fadb636b393328aaadff0c6cbc3c376050e0e2c60496d644f3.exe
- Size 660KB
- Sample241104-sg6aea1lfv
- SHA256 c58eaed8811920fadb636b393328aaadff0c6cbc3c376050e0e2c60496d644f3
Malware Config
Extracted
-
redline
-
sony
-
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Signatures
- Detects Healer an antivirus disabler dropper 2 IoCs
- Healer
Healer an antivirus disabler dropper.
- Healer family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 34 IoCs
- Redline family
- Executes dropped EXE 3 IoCs
- Windows security modification 2 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c58eaed8811920fadb636b393328aaadff0c6cbc3c376050e0e2c60496d644f3.exe"C:\Users\Admin\AppData\Local\Temp\c58eaed8811920fadb636b393328aaadff0c6cbc3c376050e0e2c60496d644f3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKx1693.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKx1693.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr861184.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr861184.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku852284.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku852284.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
ziKx1693.exe
jr861184.exe
ku852284.exe
memory/1608-1-0x0000000002570000-0x00000000025FD000-memory.dmp
memory/1608-2-0x0000000002600000-0x000000000268A000-memory.dmp
memory/1608-3-0x0000000000400000-0x000000000048E000-memory.dmp
memory/1608-20-0x0000000002570000-0x00000000025FD000-memory.dmp
memory/1608-21-0x0000000002600000-0x000000000268A000-memory.dmp
memory/1608-22-0x0000000000400000-0x000000000048E000-memory.dmp
memory/1608-23-0x0000000000400000-0x0000000000767000-memory.dmp
memory/2376-94-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-84-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-31-0x0000000000400000-0x000000000044E000-memory.dmp
memory/2376-32-0x00000000026D0000-0x0000000002716000-memory.dmp
memory/2376-33-0x0000000004F50000-0x00000000054F4000-memory.dmp
memory/2376-34-0x0000000002780000-0x00000000027C4000-memory.dmp
memory/2376-48-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-50-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-74-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-62-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-46-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-44-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-42-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-40-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-38-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-36-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-35-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-96-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-30-0x00000000022C0000-0x000000000230B000-memory.dmp
memory/2376-92-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-90-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-88-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-86-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-29-0x0000000000920000-0x0000000000A20000-memory.dmp
memory/2376-82-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-80-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-78-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-76-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-72-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-70-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-68-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-66-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-64-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-60-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-58-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-56-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-54-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-52-0x0000000002780000-0x00000000027BE000-memory.dmp
memory/2376-941-0x0000000005500000-0x0000000005B18000-memory.dmp
memory/2376-942-0x0000000005B20000-0x0000000005C2A000-memory.dmp
memory/2376-943-0x0000000004E50000-0x0000000004E62000-memory.dmp
memory/2376-944-0x0000000004E70000-0x0000000004EAC000-memory.dmp
memory/2376-945-0x0000000004EB0000-0x0000000004EFC000-memory.dmp
memory/2376-946-0x0000000000920000-0x0000000000A20000-memory.dmp
memory/2376-947-0x00000000022C0000-0x000000000230B000-memory.dmp
memory/2376-950-0x0000000000400000-0x000000000044E000-memory.dmp
memory/3648-18-0x00007FFF14CB3000-0x00007FFF14CB5000-memory.dmp
memory/3648-19-0x0000000000AC0000-0x0000000000ACA000-memory.dmp