Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2024 15:26

General

  • Target

    47bd200613f4e4e446645854c85f7583065167ca306266528148808789e9a627.exe

  • Size

    534KB

  • MD5

    ded9713d59beee0dedd37e141e052966

  • SHA1

    7c787877355203301b47e8f84e46aff1e8e7e63c

  • SHA256

    47bd200613f4e4e446645854c85f7583065167ca306266528148808789e9a627

  • SHA512

    2a926719d3a5719121b7334727548294252531cdbc2d1fbf1bdb813dddf52f5ef437ddbeb539297639773b6f01886316583e4a7b659aad51f0456d27dac38598

  • SSDEEP

    12288:1Mr2y90ZXZ87Oal5Rb3WNXlwJbX5I3WD8z:PyfOax3WXlwl53D8z

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47bd200613f4e4e446645854c85f7583065167ca306266528148808789e9a627.exe
    "C:\Users\Admin\AppData\Local\Temp\47bd200613f4e4e446645854c85f7583065167ca306266528148808789e9a627.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQf4902.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQf4902.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr857743.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr857743.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4296
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku982892.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku982892.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQf4902.exe

    Filesize

    392KB

    MD5

    1816221fa7302348b1201f9b7749c9e0

    SHA1

    81f30ad383033dc2f5ce36176de747aaa9fb85a1

    SHA256

    c2537242b4bcb08d242cb18008acf92181c3dd14855873416edcea2b9e622896

    SHA512

    44df2a2d7bb4cb2760e4017892e7b52efbb283556212ece0276921bcf13fe0ac7d3bbdb426fc35234a6a71306786b336702c716537e2b98bb44f771337ccf5fc

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr857743.exe

    Filesize

    11KB

    MD5

    831637d4cb8694ca2f8db05ffc8f5c4d

    SHA1

    462b405afdf32641f5e73f7db48eb1546542d5bc

    SHA256

    7e88fd34570c1c8221e20a902e16a0b6dcb8a96f32f6860b213e96676acc49c0

    SHA512

    f50989544131c683bdf348ab30dbd608376f2f4a791d4c60a2c1a82aaeca0d25779b706814d77ef5933dd05234508fcad6b1002f2d7cbb473b9811d314e95366

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku982892.exe

    Filesize

    319KB

    MD5

    0ff701927be2f69b016b6ed6ab11187f

    SHA1

    e29c861a8dab850cce0b0e94a9f2b779663080ea

    SHA256

    cf85a9e648473f24c5c520b5990e67a1b12a50b1b808175b1a8b25d14a85eba9

    SHA512

    7991e3387e7880d61b2fa6031753f77ed8a77b31fa5b32c7bda27f4a6468687bc7c61aa9c8cc7131c00b052805b897f2312dc6e6b6105dd0f68da8ba9cc748f6

  • memory/2152-72-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-22-0x0000000002500000-0x0000000002546000-memory.dmp

    Filesize

    280KB

  • memory/2152-935-0x0000000005B80000-0x0000000005BCC000-memory.dmp

    Filesize

    304KB

  • memory/2152-68-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-23-0x0000000004AC0000-0x0000000005064000-memory.dmp

    Filesize

    5.6MB

  • memory/2152-24-0x00000000050B0000-0x00000000050F4000-memory.dmp

    Filesize

    272KB

  • memory/2152-26-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-84-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-62-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-54-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-70-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-25-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-66-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-86-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-82-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-80-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-78-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-76-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-74-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-934-0x0000000005A30000-0x0000000005A6C000-memory.dmp

    Filesize

    240KB

  • memory/2152-38-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-933-0x0000000005A10000-0x0000000005A22000-memory.dmp

    Filesize

    72KB

  • memory/2152-88-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-64-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-60-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-58-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-57-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-52-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-50-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-48-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-46-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-44-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-42-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-40-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-36-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-34-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-32-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-30-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-28-0x00000000050B0000-0x00000000050EF000-memory.dmp

    Filesize

    252KB

  • memory/2152-931-0x0000000005230000-0x0000000005848000-memory.dmp

    Filesize

    6.1MB

  • memory/2152-932-0x00000000058D0000-0x00000000059DA000-memory.dmp

    Filesize

    1.0MB

  • memory/4296-16-0x00007FFA38EF3000-0x00007FFA38EF5000-memory.dmp

    Filesize

    8KB

  • memory/4296-14-0x00007FFA38EF3000-0x00007FFA38EF5000-memory.dmp

    Filesize

    8KB

  • memory/4296-15-0x0000000000940000-0x000000000094A000-memory.dmp

    Filesize

    40KB