Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 03:59

General

  • Target

    d9f61f0e80dc8a5f9c1481a6734867cb110c2673b78a7d13f63fd7b35c07bea0.exe

  • Size

    1.0MB

  • MD5

    4218e2d7a9d79c3cf25bc5e0e22ad024

  • SHA1

    3cc7734166e94e420914da48d6f44c7409704217

  • SHA256

    d9f61f0e80dc8a5f9c1481a6734867cb110c2673b78a7d13f63fd7b35c07bea0

  • SHA512

    276ee90260125f1a64992ddcb09ac5bdbeb4beb12285f164f51ad7b763e1721e4921dd65a192281854b3f29262ab55db47ce78a6bd4ce7e5006f39a4d091e064

  • SSDEEP

    24576:kyJjq2nLq0gMC311q9+Tn8hwTWbSNGUOa/:zBq2nOMC3112GnU0AUOa

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

C2

185.161.248.90:4125

Attributes
  • auth_value

    93f8c4ca7000e3381dd4b6b86434de05

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9f61f0e80dc8a5f9c1481a6734867cb110c2673b78a7d13f63fd7b35c07bea0.exe
    "C:\Users\Admin\AppData\Local\Temp\d9f61f0e80dc8a5f9c1481a6734867cb110c2673b78a7d13f63fd7b35c07bea0.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibS3935.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibS3935.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziMj6245.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziMj6245.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it286958.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it286958.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1160
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr038880.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr038880.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1116
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5384
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp590316.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp590316.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibS3935.exe

    Filesize

    723KB

    MD5

    79ae5dd82dccde59f8df629c4c679deb

    SHA1

    984cc968a2b9b6651f31224d01eea10b78c8bcef

    SHA256

    84895d1b1ef1ec9f6f8e108d64207502b76d22388107be11cf901329f639ef1d

    SHA512

    fd9ec0989c0fe817505a1c422502e36e73039bc345d01d263c2340e815051ebc559667721aaf32d911f75a7e0ab9a211a63cb3ab23f477938be96e45da0a1302

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp590316.exe

    Filesize

    169KB

    MD5

    f0a769f50b612023a4abc6031dcc1e4d

    SHA1

    9383515026c8b4f60e22b742374225f4b7642436

    SHA256

    c8628f6b24334d2a3a75b74037c98d39935c13eacaadf4c082316a55bc2bedcb

    SHA512

    d94e09197619fd44f54b0e762aaf5c280b1da8f0f56cb8fb70cf79684af34040be8d18a618c8a4605285da0f3417534928ac7f26c17d8fb52cc68276a912fdfb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziMj6245.exe

    Filesize

    569KB

    MD5

    80a83d02b627f0cc971f01f5f8fb3537

    SHA1

    0fada6a77092fd586d8075fc6ce56fb080effdac

    SHA256

    3bfbae003e3855608fe5dec6b117eff108ce1d44bdc0cf0e29ad9b66aa2e9bcf

    SHA512

    8dbdf19ebf6489cf99ed190368d9e05c9e76db10ab07caf78597e3aa10c6441baa5fbe99c2d27e95e43dd93d66aebb9aa4cd3706411e33a78cd2c465781a6fd0

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it286958.exe

    Filesize

    11KB

    MD5

    9b43665fa86d1099ea442a2d72f30757

    SHA1

    b6e5bc76c36b2a90fb5e66e3b37c92381184c7c6

    SHA256

    99bf34d38b2931df778696c2f6ffe4d9483db530136ab79439fb5d9295c63648

    SHA512

    4f397667dfd7ab349c9d5a04b947d29cc2eee3e6ba04450b3e70a992d826b1722b5aa371d081db2b0760f7f9a327036577a21ea31e783e92284f4da59c6812f3

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr038880.exe

    Filesize

    588KB

    MD5

    1c6383d9183c7cc21cb7faee31aae0bb

    SHA1

    7576e283433896733fa78b77170da9129647eca7

    SHA256

    33313578eec22c0ba22abcc2673aeb7edefa0c11660cdb53a21b63572634e21d

    SHA512

    57830d144d358332873306f0ad26ee2502563c7e1f4190b932f19d0ad471e8b3ab2027fd035e7083dfcfef1412d7920270a72170587f05879042b5d7daf19f2f

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • memory/1116-84-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-76-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-30-0x0000000005520000-0x0000000005586000-memory.dmp

    Filesize

    408KB

  • memory/1116-90-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-78-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-58-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-48-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-46-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-44-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-42-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-40-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-38-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-36-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-34-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-32-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-31-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-94-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-92-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-88-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-86-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-28-0x0000000004EB0000-0x0000000004F18000-memory.dmp

    Filesize

    416KB

  • memory/1116-82-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-80-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-29-0x0000000004F30000-0x00000000054D4000-memory.dmp

    Filesize

    5.6MB

  • memory/1116-74-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-72-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-71-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-68-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-66-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-64-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-62-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-60-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-56-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-55-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-52-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-50-0x0000000005520000-0x0000000005580000-memory.dmp

    Filesize

    384KB

  • memory/1116-2173-0x0000000005760000-0x0000000005792000-memory.dmp

    Filesize

    200KB

  • memory/1160-22-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

    Filesize

    40KB

  • memory/1160-21-0x00007FFD64923000-0x00007FFD64925000-memory.dmp

    Filesize

    8KB

  • memory/2248-2192-0x00000000009B0000-0x00000000009E0000-memory.dmp

    Filesize

    192KB

  • memory/2248-2193-0x00000000010F0000-0x00000000010F6000-memory.dmp

    Filesize

    24KB

  • memory/2248-2196-0x0000000005320000-0x0000000005332000-memory.dmp

    Filesize

    72KB

  • memory/2248-2197-0x0000000005390000-0x00000000053CC000-memory.dmp

    Filesize

    240KB

  • memory/2248-2198-0x00000000053E0000-0x000000000542C000-memory.dmp

    Filesize

    304KB

  • memory/5384-2187-0x0000000000320000-0x000000000034E000-memory.dmp

    Filesize

    184KB

  • memory/5384-2188-0x0000000004C40000-0x0000000004C46000-memory.dmp

    Filesize

    24KB

  • memory/5384-2194-0x0000000005280000-0x0000000005898000-memory.dmp

    Filesize

    6.1MB

  • memory/5384-2195-0x0000000004D70000-0x0000000004E7A000-memory.dmp

    Filesize

    1.0MB