Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:47

General

  • Target

    9f1c64f6381933ad8cf08b18e7ce11018004abd56180d55a1b9ce7a93a63837f.exe

  • Size

    546KB

  • MD5

    e565df7d28ba6fe5ca6ae0f63eb913a2

  • SHA1

    d5847b6ccdd8f04ef33761ade897811e1d225c17

  • SHA256

    9f1c64f6381933ad8cf08b18e7ce11018004abd56180d55a1b9ce7a93a63837f

  • SHA512

    e0590d9af5d48ea88cd5a14d563f11708dd0862ae013663afe8014ca921033b700103b7bf78cecc6d3a815f18f1943ade8b1a650696faed0658fd8315b6df916

  • SSDEEP

    12288:XMrgy90RtTMd0SFQ7Ey72BTG4d3U5EnhtRwLXlEVZAnBQ7G:PyQTnS6YgGMEh0OVZ6OK

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f1c64f6381933ad8cf08b18e7ce11018004abd56180d55a1b9ce7a93a63837f.exe
    "C:\Users\Admin\AppData\Local\Temp\9f1c64f6381933ad8cf08b18e7ce11018004abd56180d55a1b9ce7a93a63837f.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9409.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9409.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2079.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2079.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2848
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2138.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2138.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9409.exe

    Filesize

    404KB

    MD5

    823aaea83bb9ba29236c804302b9eac1

    SHA1

    f420bdac9b422ddfb3437d2184b7aa9099d5d538

    SHA256

    6223de595f8c1f53e8d689cb73cc6513fa50179c4caf17dcb903c5a1bd53478e

    SHA512

    7535bc53748bf0b49e64b5bcd16a36b74e8466df5acd0c36a6d18789b4fff6b6c908b6b810015ff2eb1faabd03f70794e3cec257600763ecb829c3f671aab7b2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2079.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2138.exe

    Filesize

    358KB

    MD5

    7043450f71e92785a6aec0ee5237fba2

    SHA1

    8063e99e14142c56f0f409305322598d34c94367

    SHA256

    df634b1cdf6d9e3fb413d357c88c61faf05b11bcb4ca0c9e7c63a6c29b903a1c

    SHA512

    cea5d92c3f28f9e72808f798b9df387fc9eab56d4accead3837afddb04477740d7d15e2248d0defc162c23dc0a59a99c42b276bbe8117bdc63c1ef718f164355

  • memory/212-64-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-34-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-935-0x0000000005DE0000-0x0000000005E2C000-memory.dmp

    Filesize

    304KB

  • memory/212-22-0x0000000004CA0000-0x0000000004CE6000-memory.dmp

    Filesize

    280KB

  • memory/212-23-0x0000000004D30000-0x00000000052D4000-memory.dmp

    Filesize

    5.6MB

  • memory/212-24-0x00000000052E0000-0x0000000005324000-memory.dmp

    Filesize

    272KB

  • memory/212-30-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-42-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-88-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-86-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-84-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-82-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-80-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-76-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-74-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-72-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-70-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-68-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-66-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-934-0x0000000005C90000-0x0000000005CCC000-memory.dmp

    Filesize

    240KB

  • memory/212-56-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-933-0x0000000005C70000-0x0000000005C82000-memory.dmp

    Filesize

    72KB

  • memory/212-58-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-54-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-52-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-50-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-48-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-44-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-40-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-38-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-36-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-60-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-32-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-78-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-62-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-46-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-28-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-26-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-25-0x00000000052E0000-0x000000000531E000-memory.dmp

    Filesize

    248KB

  • memory/212-931-0x0000000005490000-0x0000000005AA8000-memory.dmp

    Filesize

    6.1MB

  • memory/212-932-0x0000000005B30000-0x0000000005C3A000-memory.dmp

    Filesize

    1.0MB

  • memory/2848-16-0x00007FFCD8FC3000-0x00007FFCD8FC5000-memory.dmp

    Filesize

    8KB

  • memory/2848-14-0x00007FFCD8FC3000-0x00007FFCD8FC5000-memory.dmp

    Filesize

    8KB

  • memory/2848-15-0x0000000000670000-0x000000000067A000-memory.dmp

    Filesize

    40KB