Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 20:53

General

  • Target

    dc41cb7649cef3eafbd6bbb98711f8405d6072da7fe5e557001da0c27966553d.exe

  • Size

    689KB

  • MD5

    c7049d8fe7c23baf761a33f0f35187ff

  • SHA1

    68eb6e30e12b2a3ffa1726b479f6f9c02cbceab2

  • SHA256

    dc41cb7649cef3eafbd6bbb98711f8405d6072da7fe5e557001da0c27966553d

  • SHA512

    c3a62797e1cb0e371b0199b2bd7b8c8cbcae91b60247edd24fa457cb08398927c204ffe545fb7af1f7d01241d2ccf69329939d974e1dccfaa7e171a129112c15

  • SSDEEP

    12288:DMrgy90+MD1ExuftThmcZ1x5NRgGSylfxbZB3hio1V4T5zCYscOuLfKyPMAE+cCz:ryJMOuft9rr5NJ1lRZ1z4UYscOqbPMAb

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc41cb7649cef3eafbd6bbb98711f8405d6072da7fe5e557001da0c27966553d.exe
    "C:\Users\Admin\AppData\Local\Temp\dc41cb7649cef3eafbd6bbb98711f8405d6072da7fe5e557001da0c27966553d.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un172409.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un172409.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6811.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6811.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2808
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1092
          4⤵
          • Program crash
          PID:1620
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5999.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5999.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4676
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 2808
    1⤵
      PID:1012

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un172409.exe

      Filesize

      536KB

      MD5

      68d2205e9726aca1758625ca51b7d63d

      SHA1

      424e36ce69f0c64992b36697767a1c5b35e2c361

      SHA256

      0c8fee303e59a0047ba4f22a4dcc83bfc3a1cded078712a022ffe325e9336e0d

      SHA512

      415c3a2b263a9c901929defdf5c8e4def6d252938cab9054aaf6207efdb6417490ff02d85c0574023798bebdef3e1ce181c165bb0c9256d414f58af19c2c7ae3

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6811.exe

      Filesize

      312KB

      MD5

      5300d3477af652f468b8aabad3ced01e

      SHA1

      c5733b467b45efb40f175c30034e7ff66bcf87c4

      SHA256

      5aeaf1a4b2aaa35a6596e5bf0a84bb98280293af08b64a788352789076e9e053

      SHA512

      af71ad8569977347ff6f1904d028daa59b210de6ca2cd8fa7785d927e7236994ff39ab65aebdc7e104d8256802c1de78dfb80d1c0ad7ba23a4f593efac8f99bc

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5999.exe

      Filesize

      370KB

      MD5

      fd471499e0aa36147d4e25c9708a504a

      SHA1

      f8332f614d4dc1e9b320600c006bc9ca5403f663

      SHA256

      7f8bdbb25e926604513d52045d990f44c8914f4d51ee275aa4df4bc0b7fc2de4

      SHA512

      fadfd947f043e59fd57b5e91ca6b4137b8afa09ea251c56a48317126e0ce042f4600accffc381eeafd54edfaf506cb2478adedf1bc4a08afddaa29d08b52e70e

    • memory/2808-15-0x0000000000950000-0x0000000000A50000-memory.dmp

      Filesize

      1024KB

    • memory/2808-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2808-16-0x00000000008C0000-0x00000000008ED000-memory.dmp

      Filesize

      180KB

    • memory/2808-18-0x0000000000400000-0x0000000000802000-memory.dmp

      Filesize

      4.0MB

    • memory/2808-19-0x0000000002410000-0x000000000242A000-memory.dmp

      Filesize

      104KB

    • memory/2808-20-0x0000000004F40000-0x00000000054E4000-memory.dmp

      Filesize

      5.6MB

    • memory/2808-21-0x0000000002840000-0x0000000002858000-memory.dmp

      Filesize

      96KB

    • memory/2808-25-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-47-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-45-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-43-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-42-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-39-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-37-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-49-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-35-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-33-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-31-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-27-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-23-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-22-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-29-0x0000000002840000-0x0000000002852000-memory.dmp

      Filesize

      72KB

    • memory/2808-50-0x0000000000950000-0x0000000000A50000-memory.dmp

      Filesize

      1024KB

    • memory/2808-51-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2808-54-0x0000000000400000-0x0000000000802000-memory.dmp

      Filesize

      4.0MB

    • memory/2808-55-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4676-60-0x0000000002A70000-0x0000000002AB6000-memory.dmp

      Filesize

      280KB

    • memory/4676-61-0x0000000005450000-0x0000000005494000-memory.dmp

      Filesize

      272KB

    • memory/4676-65-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-73-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-96-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-93-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-91-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-89-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-87-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-86-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-83-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-81-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-77-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-75-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-71-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-69-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-67-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-79-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-63-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-62-0x0000000005450000-0x000000000548F000-memory.dmp

      Filesize

      252KB

    • memory/4676-968-0x0000000005490000-0x0000000005AA8000-memory.dmp

      Filesize

      6.1MB

    • memory/4676-969-0x0000000005AF0000-0x0000000005BFA000-memory.dmp

      Filesize

      1.0MB

    • memory/4676-970-0x0000000005C30000-0x0000000005C42000-memory.dmp

      Filesize

      72KB

    • memory/4676-971-0x0000000005C50000-0x0000000005C8C000-memory.dmp

      Filesize

      240KB

    • memory/4676-972-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

      Filesize

      304KB