Analysis

  • max time kernel
    143s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 20:52

General

  • Target

    06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe

  • Size

    545KB

  • MD5

    c85a857d3eb14849db7e2279e9f5c83a

  • SHA1

    252b6f13e91aed7e8edf2b98b990a2220b3a2e51

  • SHA256

    06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2

  • SHA512

    42f8000a0c0d939d1eb28a7473dcd2520e525171c61631d2df29c5b4d6c4ce1145b98c10a8852bc2c4fa344e720333ab0990d92ba261bc1a6af7892827a12971

  • SSDEEP

    12288:jMrVy90xVZy72+ztY+0wikc6dWi0ywzcLfqrha10SF7b:Ky56+ztY+okXdWi0lzkiltSh

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe
    "C:\Users\Admin\AppData\Local\Temp\06a4d5a185784302d7237e814a8b5011efb66cf24d1466ae9bb14a3d6ca0d0b2.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5885UT.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5885UT.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3632
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w23Zm79.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w23Zm79.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5885UT.exe

    Filesize

    323KB

    MD5

    ee43881ab62092621b2d2e22a0295878

    SHA1

    0339221e3f787602fea6a0541817565d751a293c

    SHA256

    2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

    SHA512

    df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w23Zm79.exe

    Filesize

    382KB

    MD5

    084bd8a8fbb93dd4f4fe78b1111bd9e2

    SHA1

    6cec443b0c4215de1ce8685f0e58c17a13f08b33

    SHA256

    aff53afbb407c1e40a0ba6585f686576edd4a13540f9d416bf152f94476588c5

    SHA512

    c01f18e421cfc6c9243110d34a5311552b568ccb4c71dd5342e30a8b8b5848860931389f265cc9e3ad57a3ea09519fcb6f7a40d99ff93fe284744b5c881837d2

  • memory/3460-75-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-67-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-968-0x0000000005A70000-0x0000000005ABC000-memory.dmp

    Filesize

    304KB

  • memory/3460-967-0x0000000005920000-0x000000000595C000-memory.dmp

    Filesize

    240KB

  • memory/3460-966-0x0000000005900000-0x0000000005912000-memory.dmp

    Filesize

    72KB

  • memory/3460-965-0x00000000057C0000-0x00000000058CA000-memory.dmp

    Filesize

    1.0MB

  • memory/3460-964-0x0000000005120000-0x0000000005738000-memory.dmp

    Filesize

    6.1MB

  • memory/3460-54-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

  • memory/3460-59-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-56-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

  • memory/3460-61-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-83-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-65-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-55-0x0000000002540000-0x0000000002586000-memory.dmp

    Filesize

    280KB

  • memory/3460-53-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

  • memory/3460-71-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-73-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-77-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-79-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-81-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-85-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-87-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-89-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-91-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-69-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-63-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3460-57-0x0000000004AE0000-0x0000000004B24000-memory.dmp

    Filesize

    272KB

  • memory/3460-58-0x0000000004AE0000-0x0000000004B1E000-memory.dmp

    Filesize

    248KB

  • memory/3632-26-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-37-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-10-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3632-9-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/3632-48-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/3632-47-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3632-44-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/3632-43-0x0000000000830000-0x0000000000930000-memory.dmp

    Filesize

    1024KB

  • memory/3632-15-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-16-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-18-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-20-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-8-0x0000000000830000-0x0000000000930000-memory.dmp

    Filesize

    1024KB

  • memory/3632-22-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-24-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-29-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-30-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-32-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-34-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-38-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-42-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-40-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/3632-14-0x0000000004A70000-0x0000000004A88000-memory.dmp

    Filesize

    96KB

  • memory/3632-13-0x0000000004B80000-0x0000000005124000-memory.dmp

    Filesize

    5.6MB

  • memory/3632-12-0x0000000002350000-0x000000000236A000-memory.dmp

    Filesize

    104KB

  • memory/3632-11-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB