Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 03:47

General

  • Target

    1a0828fed03acdea67533938f738513f78b651b15cd95732c72c43dd4d7bf8c3.exe

  • Size

    1.0MB

  • MD5

    a48ef4d79dbfc3507be1416f8da627c2

  • SHA1

    9648a076d3097591037420a2f796659018131fb1

  • SHA256

    1a0828fed03acdea67533938f738513f78b651b15cd95732c72c43dd4d7bf8c3

  • SHA512

    20dc23f4a5721fec2660b3b77635a6a5ac613ebb090c32179c8db61199e26d34591fa9d241c2160e4b2ec98fd06e502d9b17bc195b3110087c164873b5737f1f

  • SSDEEP

    24576:LyBG2jgl5VzHyvokFWd9xEafLusuhDiv:+BmVzSAzsD9hDi

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diza

C2

185.161.248.90:4125

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a0828fed03acdea67533938f738513f78b651b15cd95732c72c43dd4d7bf8c3.exe
    "C:\Users\Admin\AppData\Local\Temp\1a0828fed03acdea67533938f738513f78b651b15cd95732c72c43dd4d7bf8c3.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicE4334.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicE4334.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zieK6979.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zieK6979.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3520
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it384369.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it384369.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2428
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr864583.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr864583.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2984
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5308
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1468
            5⤵
            • Program crash
            PID:5544
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp088804.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp088804.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5668
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2984 -ip 2984
    1⤵
      PID:5452

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicE4334.exe

      Filesize

      723KB

      MD5

      4d600138e8f55047e67c7b0aefc21df7

      SHA1

      690580333793f3aedd1b0f7bc96f02502d42f557

      SHA256

      a5e9cd36a620848360801587d8a9e0a11f365b6da8d8b4aa2cab4f4841656598

      SHA512

      b26949ff0057541a4f7d64b69d40abd57c24382ce69e17ec5ec7d52d13d8291646dffc58a831c998e4c1fec1b1fa258b09625e9cb4fb20316ae33058e404724b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp088804.exe

      Filesize

      168KB

      MD5

      c52ebada00a59ec1f651a0e9fbcef2eb

      SHA1

      e1941278df76616f1ca3202ef2a9f99d2592d52f

      SHA256

      35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

      SHA512

      6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zieK6979.exe

      Filesize

      569KB

      MD5

      d779604352a4ebd7e034074bd76dfeec

      SHA1

      ce7c10bb997a89227374e58d5e86d73f1b5e74d2

      SHA256

      e6f442c8593a03e4672c50420cc7027b9f257239502f4df962d19809219a5bcc

      SHA512

      068382812fbc0ed9492c52a3c7cd4fd1fcbb362411dd798266eef8efa90502ff0095c69820b5e05c14c1785521a7fdf10246dd88e68107441816931485e2368f

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it384369.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr864583.exe

      Filesize

      588KB

      MD5

      4ce843d51085af06483f0603d730130e

      SHA1

      1156f207cc6609f74a2517e7a8ec1667006235a0

      SHA256

      96cac5d375ccb8335d4a231fdf23d09e7b203ab3a55c175543fd7177d50836b4

      SHA512

      6d5fc3fb2e53ed5148190f983d0b359fb18993d8f385cb3a1c82c13d98f0e5ae70eb88097055cfb8ad395764e3583ba6fe1f736af3502966f675d82417d28988

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      03728fed675bcde5256342183b1d6f27

      SHA1

      d13eace7d3d92f93756504b274777cc269b222a2

      SHA256

      f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

      SHA512

      6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

    • memory/2428-21-0x00007FFC59F03000-0x00007FFC59F05000-memory.dmp

      Filesize

      8KB

    • memory/2428-22-0x0000000000940000-0x000000000094A000-memory.dmp

      Filesize

      40KB

    • memory/2428-23-0x00007FFC59F03000-0x00007FFC59F05000-memory.dmp

      Filesize

      8KB

    • memory/2984-29-0x00000000027F0000-0x0000000002858000-memory.dmp

      Filesize

      416KB

    • memory/2984-30-0x0000000005010000-0x00000000055B4000-memory.dmp

      Filesize

      5.6MB

    • memory/2984-31-0x00000000055C0000-0x0000000005626000-memory.dmp

      Filesize

      408KB

    • memory/2984-67-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-81-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-95-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-93-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-91-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-89-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-87-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-83-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-79-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-77-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-75-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-73-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-71-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-69-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-65-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-63-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-61-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-59-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-57-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-55-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-53-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-49-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-47-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-45-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-43-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-41-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-39-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-37-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-35-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-85-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-51-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-33-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-32-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/2984-2174-0x0000000005790000-0x00000000057C2000-memory.dmp

      Filesize

      200KB

    • memory/5308-2187-0x0000000000B70000-0x0000000000B9E000-memory.dmp

      Filesize

      184KB

    • memory/5308-2188-0x0000000002BD0000-0x0000000002BD6000-memory.dmp

      Filesize

      24KB

    • memory/5308-2189-0x0000000005B50000-0x0000000006168000-memory.dmp

      Filesize

      6.1MB

    • memory/5308-2190-0x0000000005640000-0x000000000574A000-memory.dmp

      Filesize

      1.0MB

    • memory/5308-2191-0x00000000053E0000-0x00000000053F2000-memory.dmp

      Filesize

      72KB

    • memory/5308-2192-0x0000000005570000-0x00000000055AC000-memory.dmp

      Filesize

      240KB

    • memory/5308-2193-0x00000000055B0000-0x00000000055FC000-memory.dmp

      Filesize

      304KB

    • memory/5668-2198-0x0000000000670000-0x00000000006A0000-memory.dmp

      Filesize

      192KB

    • memory/5668-2199-0x0000000001090000-0x0000000001096000-memory.dmp

      Filesize

      24KB