Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 04:10

General

  • Target

    9b1bf5607fc5c8e8377d5c02d8510cb1d820798603683e83351186ddba7c67ed.exe

  • Size

    1.0MB

  • MD5

    e64e0f08a31011d0c9a78bb6c3d49cd5

  • SHA1

    949034473e0fc54bbbba186393d607d169f140b0

  • SHA256

    9b1bf5607fc5c8e8377d5c02d8510cb1d820798603683e83351186ddba7c67ed

  • SHA512

    1923eb9416c8cbf0ea4e7f1652e65b012f3be7b050a61c1a23a5f5f8598f62a496c22f32271d86dade8d8d5d8499c812cd589c7301dec54e71d7ffb2aa24140d

  • SSDEEP

    24576:ByZ2gKT5HZJZTBmWi6F169Ggv/KcqyWEC1DnzTq:0ZUd5JbmWi6F1mzXzFgL

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

disa

C2

185.161.248.90:4125

Attributes
  • auth_value

    93f8c4ca7000e3381dd4b6b86434de05

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b1bf5607fc5c8e8377d5c02d8510cb1d820798603683e83351186ddba7c67ed.exe
    "C:\Users\Admin\AppData\Local\Temp\9b1bf5607fc5c8e8377d5c02d8510cb1d820798603683e83351186ddba7c67ed.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zien3032.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zien3032.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3224
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zido9935.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zido9935.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it145963.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it145963.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4836
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr658108.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr658108.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4760
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp351608.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp351608.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2700
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:3196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zien3032.exe

    Filesize

    723KB

    MD5

    6b4a4cc8b467c46b5c1a41fb2909378f

    SHA1

    ab4a3ec3eafba38fc52a53a8074491e1293b8fc3

    SHA256

    0af0effe386b3c8b606efe31a7b1a44db015be197a3804494cf4fcdcaa0468be

    SHA512

    a303b9364f75128d4564435290983038d27edc478e2ce654a9eff88bfafdd45aff446fcf19e49cce403073aa319e03e10a0c0f361478c08e0fa95bd2eb2d32dd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp351608.exe

    Filesize

    169KB

    MD5

    0568b4bb59a02a8c451b126b907ee577

    SHA1

    57a6f17320e728b6c30be5fa16915d2aeb4151e4

    SHA256

    74a46a9912cc3cdede4f6acdda68913f53c38e9ba2c97a03386a8a92d80027a0

    SHA512

    60d6aafd5b03d0ae930c6744f5c2b986e20aff57ea4f6cbfdc3eeb7b79ceec7f8c3edfe68b10492917d0cc67c20f92927e40d9854725370f16890c850f6805ac

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zido9935.exe

    Filesize

    569KB

    MD5

    657d9da5ffd62c69216ef5121af8fde0

    SHA1

    c089cd3d31244d40d307153cd27d6cbbf9665494

    SHA256

    f18ba27487f8c17f3f7a5ce3bdad3dca57b4c9cfb2947e5b4d6ee0c15b52c492

    SHA512

    7b2425e6d6594258212e7a2a9fe28f3be45d717818dbd8d81707c6a9167e4495103102824681b2e324db4d2fa554c36d670c5f5a71e11a8b7a3c816254aaaed4

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it145963.exe

    Filesize

    11KB

    MD5

    f2877240b3dd6bd57d49335879160cae

    SHA1

    c3b09356f3826971da2e316daa5de909212f0346

    SHA256

    243d3d6ac12883ab1faa1f4a73aee8eb24499eb523306a1c929aaae041662520

    SHA512

    07d3038e99bec6a1310f99f38e243efcef8e78eefee3962c08cd59f6cb67ef80b5c5b9c07af76d30d2f71b542339504e5237decec22771af35b860662a302527

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr658108.exe

    Filesize

    588KB

    MD5

    2980d76b80d7e1abf6a0a1bbe5371ee3

    SHA1

    b362468389bfbc76bb87afd016c2de2e583fdae5

    SHA256

    8ef72057648be6a0e583659a294bac049cd9797ed8c499bf3febc3a9f7a0cd50

    SHA512

    a7cab189cfbdf62c0738b2227df22da78784de370fa5520b9cf55c058fcabf46e96e655cfa5ff13b9499c140bd1a2bf7ea63ce7d1ba20dc190f416a1aa6e366a

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    03728fed675bcde5256342183b1d6f27

    SHA1

    d13eace7d3d92f93756504b274777cc269b222a2

    SHA256

    f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

    SHA512

    6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

  • memory/2192-67-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-55-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-31-0x0000000004E40000-0x0000000004EA6000-memory.dmp

    Filesize

    408KB

  • memory/2192-79-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-65-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-45-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-32-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-95-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-94-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-91-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-89-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-87-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-85-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-83-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-81-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-77-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-75-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-73-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-71-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-69-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-29-0x0000000004FB0000-0x0000000005018000-memory.dmp

    Filesize

    416KB

  • memory/2192-63-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-61-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-59-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-57-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-30-0x0000000005020000-0x00000000055C4000-memory.dmp

    Filesize

    5.6MB

  • memory/2192-53-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-51-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-49-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-47-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-43-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-41-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-39-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-37-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-35-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-33-0x0000000004E40000-0x0000000004EA0000-memory.dmp

    Filesize

    384KB

  • memory/2192-2174-0x0000000005760000-0x0000000005792000-memory.dmp

    Filesize

    200KB

  • memory/2700-2193-0x0000000000750000-0x0000000000780000-memory.dmp

    Filesize

    192KB

  • memory/2700-2194-0x00000000028B0000-0x00000000028B6000-memory.dmp

    Filesize

    24KB

  • memory/4760-2188-0x0000000000D60000-0x0000000000D8E000-memory.dmp

    Filesize

    184KB

  • memory/4760-2189-0x0000000005580000-0x0000000005586000-memory.dmp

    Filesize

    24KB

  • memory/4760-2195-0x0000000005D30000-0x0000000006348000-memory.dmp

    Filesize

    6.1MB

  • memory/4760-2196-0x0000000005820000-0x000000000592A000-memory.dmp

    Filesize

    1.0MB

  • memory/4760-2197-0x00000000055D0000-0x00000000055E2000-memory.dmp

    Filesize

    72KB

  • memory/4760-2198-0x0000000005750000-0x000000000578C000-memory.dmp

    Filesize

    240KB

  • memory/4760-2199-0x0000000005790000-0x00000000057DC000-memory.dmp

    Filesize

    304KB

  • memory/4836-21-0x00007FFFFB2F3000-0x00007FFFFB2F5000-memory.dmp

    Filesize

    8KB

  • memory/4836-22-0x0000000000080000-0x000000000008A000-memory.dmp

    Filesize

    40KB

  • memory/4836-23-0x00007FFFFB2F3000-0x00007FFFFB2F5000-memory.dmp

    Filesize

    8KB