Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 20:50

General

  • Target

    9759d6116e588c0c8f3878795b0545932b019351620fd3dd12e64ec7385c7aeb.exe

  • Size

    490KB

  • MD5

    1215d76105b0078674248a8cb221c748

  • SHA1

    db1016eb26aa74a2149c7d5d1b6d63adef0c3313

  • SHA256

    9759d6116e588c0c8f3878795b0545932b019351620fd3dd12e64ec7385c7aeb

  • SHA512

    f6d00c0a8d8f66d46ed239d28471a53ddb1f4777e0fca97c946e0018f1c744c327fe4a531e64c6a84e54e051c3d4a82f059200ff16b23be5d0f3b9a8b3acecce

  • SSDEEP

    12288:xMrqy90Mj0cJSaGqqX1G0oAbziFQkQAj89lE0G0/:HyRjVTUX1G0FxkX43/

Malware Config

Extracted

Family

redline

Botnet

lulsa

C2

217.196.96.101:4132

Attributes
  • auth_value

    2bb8e3870ce0ad119d2840b124222121

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9759d6116e588c0c8f3878795b0545932b019351620fd3dd12e64ec7385c7aeb.exe
    "C:\Users\Admin\AppData\Local\Temp\9759d6116e588c0c8f3878795b0545932b019351620fd3dd12e64ec7385c7aeb.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1501834.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1501834.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o4594391.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o4594391.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:372
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9632447.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9632447.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1501834.exe

    Filesize

    307KB

    MD5

    3d2f4ef876bd909c0b6d75673702d38d

    SHA1

    707097866b5af1bf4db16f389d085042fbe43b82

    SHA256

    9ddc432228d4ba9e10ec94b5f782b97320bc748884abc0e89fdc44c30a4f7b60

    SHA512

    9f5a899f3c73aac480c50c2ee5bd369183e35686a63e4e92b17bd9847405f3549bbc2fb3fb1ac62eaa8b878fe4047bde409f388052264b4ff0a83b333d1dde29

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o4594391.exe

    Filesize

    181KB

    MD5

    e8718337779b9a242b1d796090552450

    SHA1

    9357adfb8e3c0a9c52d7cca79dcca38d855d289b

    SHA256

    8fa0ce732399bf674d7b33cc6ad6762fa92aaaaead6e419c73361cf200f2b7b4

    SHA512

    316d6415e2d6a91f30f7da357c4ac0604ae61523ca51c36b4bf33af8f06ffed68ba1754dd98be5bfd9dafd8f34388c56782fb4d4d922f3fb838bd6422fa6e0fb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9632447.exe

    Filesize

    168KB

    MD5

    65a87881f0802e85c5c2ce4122508680

    SHA1

    899fe5a301af18797cd8ea6aaff94299733f1934

    SHA256

    7ec8e27669397c45b6d132adfef1b023fa60deacdc5bbf26dde973224a5a7090

    SHA512

    720bd6ef2681752e29b3094ba6e9d38c206a69bdf3546fc6bf5e056aae7fca1216ece7c5f649aaa5aa56f2d3d77593a972628428ed50d88909c39a6fa5691b84

  • memory/372-35-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-31-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-19-0x0000000074110000-0x00000000748C0000-memory.dmp

    Filesize

    7.7MB

  • memory/372-18-0x00000000021D0000-0x00000000021E8000-memory.dmp

    Filesize

    96KB

  • memory/372-17-0x0000000004C70000-0x0000000005214000-memory.dmp

    Filesize

    5.6MB

  • memory/372-25-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-23-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-47-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-20-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-43-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-41-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-39-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-37-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-15-0x0000000000960000-0x000000000097A000-memory.dmp

    Filesize

    104KB

  • memory/372-16-0x0000000074110000-0x00000000748C0000-memory.dmp

    Filesize

    7.7MB

  • memory/372-33-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-45-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-21-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-29-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-27-0x00000000021D0000-0x00000000021E2000-memory.dmp

    Filesize

    72KB

  • memory/372-48-0x0000000074110000-0x00000000748C0000-memory.dmp

    Filesize

    7.7MB

  • memory/372-49-0x000000007411E000-0x000000007411F000-memory.dmp

    Filesize

    4KB

  • memory/372-50-0x0000000074110000-0x00000000748C0000-memory.dmp

    Filesize

    7.7MB

  • memory/372-52-0x0000000074110000-0x00000000748C0000-memory.dmp

    Filesize

    7.7MB

  • memory/372-14-0x000000007411E000-0x000000007411F000-memory.dmp

    Filesize

    4KB

  • memory/5028-56-0x0000000000280000-0x00000000002B0000-memory.dmp

    Filesize

    192KB

  • memory/5028-57-0x0000000000B30000-0x0000000000B36000-memory.dmp

    Filesize

    24KB

  • memory/5028-58-0x0000000005250000-0x0000000005868000-memory.dmp

    Filesize

    6.1MB

  • memory/5028-59-0x0000000004D40000-0x0000000004E4A000-memory.dmp

    Filesize

    1.0MB

  • memory/5028-60-0x00000000049F0000-0x0000000004A02000-memory.dmp

    Filesize

    72KB

  • memory/5028-61-0x0000000004C70000-0x0000000004CAC000-memory.dmp

    Filesize

    240KB

  • memory/5028-62-0x0000000004CB0000-0x0000000004CFC000-memory.dmp

    Filesize

    304KB