Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 09:03

General

  • Target

    fb0e1ca50a06687dfabf55f8b8bd779cc3cb0cf0f8539f44e40eefee6cab9035.exe

  • Size

    1.1MB

  • MD5

    0a70815331bfecee9c13d11a968b31dd

  • SHA1

    9397bc6d15227410cf06b1ddf7597f7cbdcba87c

  • SHA256

    fb0e1ca50a06687dfabf55f8b8bd779cc3cb0cf0f8539f44e40eefee6cab9035

  • SHA512

    f28fcb24a6a4a2fb36f4a3206a0a223eab2cad44c44a5f6115b5645df809fc4d613e711d71530d44c69aa3e5c5a9bce33781142592914f360794108a8713c1a9

  • SSDEEP

    12288:1MrXy90nGCFVZIBZO+XDNxK7I4QRJh8g5EBXN85Xv7avojYUcT+xfI5UYevG4IYi:ayy2OABR48laXev7avoGTb5evaNKHpc

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb0e1ca50a06687dfabf55f8b8bd779cc3cb0cf0f8539f44e40eefee6cab9035.exe
    "C:\Users\Admin\AppData\Local\Temp\fb0e1ca50a06687dfabf55f8b8bd779cc3cb0cf0f8539f44e40eefee6cab9035.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVS74aK.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVS74aK.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nvA62Ub.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nvA62Ub.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3432
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nHW56Ho.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nHW56Ho.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3988
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bjh80Iq.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bjh80Iq.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2156
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bpv38aO26.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bpv38aO26.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVS74aK.exe

    Filesize

    940KB

    MD5

    dc76acb268fae6b33a29d4feb4722c1f

    SHA1

    ea75e8d40b4b96fceb8998f692fc7428a667debc

    SHA256

    2389bd940e9b2064efa6b74f0d2017869753baad913523f280f9bdfe7fe1e61b

    SHA512

    ab6b021e5905cae2da1d7ead787c61769b5d27babeefddf8c83ebc0f5988c61895770e781486ecc76eb7233571d9d509077c9b03a6daad0c1bcef09ae1a3bf99

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nvA62Ub.exe

    Filesize

    668KB

    MD5

    c9352bbcb1ca2071682971947852daff

    SHA1

    a59f7ef033389712cc98f348373e8d2baa82e791

    SHA256

    47c773e147bebefd2a15c0f9398a64e112c340dbea37a850e323d0c227db6643

    SHA512

    138de848fba1aafea1867c4f231e8317a01fcfe690be74b99aec034a48df5715baf5ec9cc83660915e39bb64f6e61cd24421bb0b40c400f3741db4b5d14153de

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nHW56Ho.exe

    Filesize

    392KB

    MD5

    480c1ee383607cfaacea67560ad07dbd

    SHA1

    c9a017baea16e1752a06e8a8edc03e20e0c9487a

    SHA256

    7ab879d117c7467a9fc597eafe58d1f09098c70c4df02b9f6bafb127ae920271

    SHA512

    183e7611d0848890494722d6b22cdef2dceb7140abae0ff7a530a0f915a08b6a706d9afb556e9731ff7b07b8eadc962bb2f5438ad7cf7f702b34c711ce523409

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bjh80Iq.exe

    Filesize

    11KB

    MD5

    d0c7caeaece902b292190c86955f6abd

    SHA1

    2624317e55983a353d360bde3c8418f5e313b077

    SHA256

    157122297f8a108eed1e91d27d85c243fd336fb42eaba0d766920e30525a2d48

    SHA512

    1721591b58c3f69745dbb4503bc72d0db5de1953ec7270053cd7c45db994ba719eae8a08ff93799ae8d71e0539b933595d80ca4d29d42d72cbe360432308a3c9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bpv38aO26.exe

    Filesize

    364KB

    MD5

    b907779ac03be51e3fe55c545e16195d

    SHA1

    d39a6ffa3af1153cb920e4fd1a9bd38b99c1f37b

    SHA256

    49c804cc4ef692834971fe93b96777381c9b247ce2f1d49b34b39e01b05d610c

    SHA512

    c72a9fbaad8653f9f2f065c196a8abf5dcf540dd5f52514df72b9668220849d8921cd6b3c9441386bcfbc27e507b578bcf59b31d802279d5141d1c0bcf3b78b7

  • memory/2156-28-0x0000000000EE0000-0x0000000000EEA000-memory.dmp

    Filesize

    40KB

  • memory/3284-79-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-68-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-36-0x0000000007770000-0x00000000077B4000-memory.dmp

    Filesize

    272KB

  • memory/3284-54-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-52-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-100-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-99-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-96-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-94-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-92-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-90-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-89-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-86-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-85-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-82-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-80-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-34-0x0000000004AD0000-0x0000000004B16000-memory.dmp

    Filesize

    280KB

  • memory/3284-76-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-74-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-72-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-70-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-35-0x00000000071C0000-0x0000000007764000-memory.dmp

    Filesize

    5.6MB

  • memory/3284-66-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-64-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-60-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-58-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-56-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-50-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-46-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-44-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-42-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-62-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-48-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-40-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-38-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-37-0x0000000007770000-0x00000000077AF000-memory.dmp

    Filesize

    252KB

  • memory/3284-943-0x00000000077F0000-0x0000000007E08000-memory.dmp

    Filesize

    6.1MB

  • memory/3284-944-0x0000000007E90000-0x0000000007F9A000-memory.dmp

    Filesize

    1.0MB

  • memory/3284-945-0x0000000007FD0000-0x0000000007FE2000-memory.dmp

    Filesize

    72KB

  • memory/3284-946-0x00000000080F0000-0x000000000812C000-memory.dmp

    Filesize

    240KB

  • memory/3284-947-0x0000000008140000-0x000000000818C000-memory.dmp

    Filesize

    304KB