Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 02:34

General

  • Target

    ee14b6fb8112e867a5b075077fa5455d6443318605f9cd8c2fcb8807ec28cf69.exe

  • Size

    1.0MB

  • MD5

    a89b8910107f3463c025e649c65dbb70

  • SHA1

    397aaf3dfc3fab6c3c1deaa0d1885cb4287e8317

  • SHA256

    ee14b6fb8112e867a5b075077fa5455d6443318605f9cd8c2fcb8807ec28cf69

  • SHA512

    32f74b773dfea40a4d2e9629ddbbb09bbc087dc92d08f44b782e8016f1ab7d6c6b0424083ec3c9ffdd1e84aecc6aae68cda0f7e9650cc4c7f1eda340c0055991

  • SSDEEP

    24576:hyA6tsxGj5Gh3BJ6+74LJNJ1O94KHyavf2+1C98IeumqS2bdj:UkGjAVxE9NJ1iJHvvf2D8IRZTb

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

C2

185.161.248.90:4125

Attributes
  • auth_value

    93f8c4ca7000e3381dd4b6b86434de05

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee14b6fb8112e867a5b075077fa5455d6443318605f9cd8c2fcb8807ec28cf69.exe
    "C:\Users\Admin\AppData\Local\Temp\ee14b6fb8112e867a5b075077fa5455d6443318605f9cd8c2fcb8807ec28cf69.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1872
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipD4508.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipD4508.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3276
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziEL4033.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziEL4033.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it488814.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it488814.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1380
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr109715.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr109715.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1144
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5452
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp190198.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp190198.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipD4508.exe

    Filesize

    723KB

    MD5

    8e553773aa18e58e87ab5599223d22eb

    SHA1

    15a9dbec5f96a0ae27c2bfa06ac303e496c3124d

    SHA256

    0d52c22c3d8cee989c38fdefd93a66fdfaeff249e2074254ef3944de1bd29020

    SHA512

    6ba6914fdf64ff414f1cf5b2e2707875e1655d1d70db004a60e965a33d6476bd813760c71408b61cace7f79dc3b8cd1065cf658957d505b9af972d448888a81b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp190198.exe

    Filesize

    169KB

    MD5

    e8a42884bd8abe9d58e9489fffefd238

    SHA1

    a319bf07f298587ed16d26304d98472898abb7c0

    SHA256

    a51a490c6f4f6a63f30f1bb921db5a1f16040810d4be9eb0c65317b870293cfe

    SHA512

    7a64af47af2bdc20576ae259d50d0e22ebba4a867e323d5aa677a03a26cb006a6f2e0204bb12eee70653ea7563b752e6a3ff8a4a67dce368c91fe1b63e09fe88

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziEL4033.exe

    Filesize

    569KB

    MD5

    2134c6b814b039e9b0149274a873de82

    SHA1

    1d9847f5516d14a12d846700ed434c4fb3daec40

    SHA256

    d0c8f298046e595d87008916c226201f6b4d9e8f6d03c6bf6b4fd18b9a346ebc

    SHA512

    cc20f440d6e6710b5e32d0b34e77d5b0eabbfcb22661a0f8cd6eb0eed741bc49bd9beb9c0b93ffbbb0cb8dbcf8ae2df242a701813fc2ebdd91d9d77251260027

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it488814.exe

    Filesize

    11KB

    MD5

    d6a68f1f4d9196c62a22c45bfcd81d1f

    SHA1

    c50e566d21576d0c2c3f24b4bcc41e4cf5337fec

    SHA256

    f2618bcf4048c4546f76f805f2c7c8da49b37038eaec6514125a63783dac432e

    SHA512

    3ab6fea14a937eed4b8ad0111635ded2a039be2b0575eb9167c74d9d74cc2cddc101e63deab1ae85cd3eb8796c893ee422e444f9b5e4e48f1107a864d5ebb13b

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr109715.exe

    Filesize

    588KB

    MD5

    ee8fff59c990bb7b24622197661a272d

    SHA1

    40d1b8fea7ecfcfc99cf344d7366c5652ec6fcfa

    SHA256

    4117daa21221afaccc409f06d776d06417e705edbd8a4821b819ba872ac994da

    SHA512

    e29cdafd9b2531ab4aec3d81245be46e394a0763b20f33ae8c053724ee9969ac932f7afd79589c4029afc9bd2bfe1d3b1abea2f319470db2ddb3cadc4bc255b2

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • memory/1144-63-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-53-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-31-0x0000000005540000-0x00000000055A6000-memory.dmp

    Filesize

    408KB

  • memory/1144-87-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-71-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-49-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-95-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-93-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-91-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-89-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-85-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-83-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-81-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-79-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-77-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-75-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-73-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-69-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-67-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-66-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-29-0x0000000004F20000-0x0000000004F88000-memory.dmp

    Filesize

    416KB

  • memory/1144-61-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-59-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-58-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-55-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-30-0x0000000004F90000-0x0000000005534000-memory.dmp

    Filesize

    5.6MB

  • memory/1144-51-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-47-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-45-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-44-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-41-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-39-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-37-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-35-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-33-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-32-0x0000000005540000-0x00000000055A0000-memory.dmp

    Filesize

    384KB

  • memory/1144-2174-0x0000000005760000-0x0000000005792000-memory.dmp

    Filesize

    200KB

  • memory/1380-21-0x00007FF99CD33000-0x00007FF99CD35000-memory.dmp

    Filesize

    8KB

  • memory/1380-22-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

    Filesize

    40KB

  • memory/1380-23-0x00007FF99CD33000-0x00007FF99CD35000-memory.dmp

    Filesize

    8KB

  • memory/5452-2187-0x0000000000520000-0x000000000054E000-memory.dmp

    Filesize

    184KB

  • memory/5452-2189-0x0000000004E00000-0x0000000004E06000-memory.dmp

    Filesize

    24KB

  • memory/5452-2195-0x0000000005480000-0x0000000005A98000-memory.dmp

    Filesize

    6.1MB

  • memory/5452-2196-0x0000000004F70000-0x000000000507A000-memory.dmp

    Filesize

    1.0MB

  • memory/5512-2193-0x0000000000440000-0x0000000000470000-memory.dmp

    Filesize

    192KB

  • memory/5512-2194-0x0000000000D80000-0x0000000000D86000-memory.dmp

    Filesize

    24KB

  • memory/5512-2197-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

    Filesize

    72KB

  • memory/5512-2198-0x0000000004E30000-0x0000000004E6C000-memory.dmp

    Filesize

    240KB

  • memory/5512-2199-0x0000000004E70000-0x0000000004EBC000-memory.dmp

    Filesize

    304KB