Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-11-2024 22:35

General

  • Target

    95ecfc19962afc152ba14fbd662c1564e6050e44dc673a1791d11697c9ab8048.exe

  • Size

    537KB

  • MD5

    880bd6a0e961c176c890113fe98a3107

  • SHA1

    e844ca6be56c8947d1f35e63ae62533fbc0f62cc

  • SHA256

    95ecfc19962afc152ba14fbd662c1564e6050e44dc673a1791d11697c9ab8048

  • SHA512

    d857e33d0ba2b1c7acb0870a73c58875002a95c003143f74b2bcca053e31ed61e92919cfe8202979d8cc60e483ef87dbc4acff458613b8efd51dc3e52bbeec90

  • SSDEEP

    12288:4MrOy90zp1aFfgs1wh3xJ/UHnHcwbm5ePofr5:2yRdgs1whBJ/48wbmIP45

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95ecfc19962afc152ba14fbd662c1564e6050e44dc673a1791d11697c9ab8048.exe
    "C:\Users\Admin\AppData\Local\Temp\95ecfc19962afc152ba14fbd662c1564e6050e44dc673a1791d11697c9ab8048.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibB1386.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibB1386.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4768
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr085943.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr085943.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2136
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku750082.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku750082.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibB1386.exe

    Filesize

    395KB

    MD5

    327cac6981764ab2e108eb094928a36b

    SHA1

    797698d2a85b1d07b12bbc6bb99893fba2ecda94

    SHA256

    18cdec35a9bc9aa9f0056b28bdff87de83f2831d3a86bf892fb71570203dac6b

    SHA512

    72d33b96ef79371d0e21ba583b93d442be9089d256ebe335bf24207efaa5127da2d4d840016ba43f0c956d9ae7e6083bd56d2007b9988ffb06c6ca94307c22f6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr085943.exe

    Filesize

    14KB

    MD5

    4f4a4f495a4023bd010d20b36602c53d

    SHA1

    4bf774e85190a52495a197af0e161535fac931a3

    SHA256

    0a485b319dba0ac3e624fe0145df38f42319b793b76bc98d36b80cc93f82b1ab

    SHA512

    52cc7fa9694ed5208f147fc7bb6d73b2a2eb7db1a711723638d44f8fdeec7b3cf258e8721916bfbfd913cbd621f245c2e44df306b1fdad5129b100a54274034b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku750082.exe

    Filesize

    352KB

    MD5

    7df740b83b84a8a9a88ef3f428347d49

    SHA1

    7fa0cdff0684361d9f6b1a3dd804a5b363777339

    SHA256

    cea8b92b0c56083711533888db14ce08d8f984d595e1d7ae8daf8ae1cefdd589

    SHA512

    317d8bd44d3964a9373174171feb1586b7611bc00ef40a462cc669cf2d96947b606a0b2144ce1e1a1b8874ab1a065a706a8bcf9e51fd6c143ad696bd9fedc27c

  • memory/2136-14-0x00007FFEC6833000-0x00007FFEC6835000-memory.dmp

    Filesize

    8KB

  • memory/2136-15-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB

  • memory/2720-59-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-51-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-23-0x0000000002770000-0x00000000027B4000-memory.dmp

    Filesize

    272KB

  • memory/2720-33-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-39-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-87-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-85-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-83-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-81-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-79-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-77-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-75-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-71-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-69-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-68-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-65-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-63-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-21-0x0000000002680000-0x00000000026C6000-memory.dmp

    Filesize

    280KB

  • memory/2720-57-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-55-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-53-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-22-0x0000000005140000-0x00000000056E4000-memory.dmp

    Filesize

    5.6MB

  • memory/2720-47-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-45-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-43-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-41-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-37-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-35-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-31-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-29-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-73-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-61-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-49-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-27-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-25-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-24-0x0000000002770000-0x00000000027AF000-memory.dmp

    Filesize

    252KB

  • memory/2720-930-0x00000000056F0000-0x0000000005D08000-memory.dmp

    Filesize

    6.1MB

  • memory/2720-931-0x0000000004F90000-0x000000000509A000-memory.dmp

    Filesize

    1.0MB

  • memory/2720-932-0x0000000002AE0000-0x0000000002AF2000-memory.dmp

    Filesize

    72KB

  • memory/2720-933-0x0000000002B00000-0x0000000002B3C000-memory.dmp

    Filesize

    240KB

  • memory/2720-934-0x00000000050B0000-0x00000000050FC000-memory.dmp

    Filesize

    304KB