Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:47

General

  • Target

    ce580d7e396d4ea838280dc1df5c96ba15f12f48f636baed921d944c9070b993.exe

  • Size

    479KB

  • MD5

    00094a0be7cfc5ec649041acaf0a2439

  • SHA1

    4111726cfa214895355d03d618838ef07f5ac946

  • SHA256

    ce580d7e396d4ea838280dc1df5c96ba15f12f48f636baed921d944c9070b993

  • SHA512

    457de62acf095c342359c08adae77f752a55922c765340040bf50efb7068978c2d2abf9f0db2adef554337490acd2813a57926bd560824d8a5fd9d53029577b6

  • SSDEEP

    12288:iMrty90TxOs+EAB3Jfc6Hok/fPEo7UyIz10:XyRFJfc6bIl10

Malware Config

Extracted

Family

redline

Botnet

morty

C2

217.196.96.101:4132

Attributes
  • auth_value

    fe1a24c211cc8e5bf9ff11c737ce0e97

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ce580d7e396d4ea838280dc1df5c96ba15f12f48f636baed921d944c9070b993.exe
    "C:\Users\Admin\AppData\Local\Temp\ce580d7e396d4ea838280dc1df5c96ba15f12f48f636baed921d944c9070b993.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1928575.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1928575.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7111238.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7111238.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1376
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7654610.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7654610.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1928575.exe

    Filesize

    307KB

    MD5

    0f7d47a0299def03ca3ef88b86ed9b0c

    SHA1

    47e7fcb6b2b170b1293e164d96b8f7b9e388d93b

    SHA256

    54a3fde7e46d1272a10e4cd5afc50c2617b54df80e0c056c3efd1be38c49469d

    SHA512

    00f3841c6b96d351a73cff9bb4b9262c8b1be97be8f707749e2b1d84b3361f8f3ba4fec80a03d5feae2efa47e3ea232eba390868fdf1b0d63d731480a489611b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7111238.exe

    Filesize

    178KB

    MD5

    6d735b881e688fdad871d365b9658884

    SHA1

    254805a6938659202acd6ad816aa831b1c9b8aea

    SHA256

    e22287fb4c517a7aff4aa45c9167e5ff3d75cd6f388873ec50737ccef98f044c

    SHA512

    daf25fc101f8ca17f2a78660290f71206032e740736c15f133033fca39c07171ea0191bc21ee3880deae731d57de3ad3263225f96d946f8aad3715f0281d425d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7654610.exe

    Filesize

    168KB

    MD5

    31a1d5fc103ed9748d799939a341d64d

    SHA1

    d353f0437ebf301fec4eb0d4325720c834b0a7f4

    SHA256

    449cf4bf7bae17b69f23caa3686b66fb65f637ccae279860906bfebc23f99b05

    SHA512

    46c72d5c51224eb2f2c6c111cd04dc5151c1782e72d886697224c889078824afc97acd188f9aec83afe6bb3a26c6798c1fbf271bf02f23fdf6bd6bfb2706068a

  • memory/1376-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-17-0x0000000004C70000-0x0000000005214000-memory.dmp

    Filesize

    5.6MB

  • memory/1376-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

    Filesize

    96KB

  • memory/1376-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-47-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

  • memory/1376-48-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

  • memory/1376-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-15-0x00000000022E0000-0x00000000022FA000-memory.dmp

    Filesize

    104KB

  • memory/1376-16-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

  • memory/1376-19-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-44-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/1376-49-0x00000000748DE000-0x00000000748DF000-memory.dmp

    Filesize

    4KB

  • memory/1376-50-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

  • memory/1376-52-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

  • memory/1376-14-0x00000000748DE000-0x00000000748DF000-memory.dmp

    Filesize

    4KB

  • memory/3516-56-0x0000000000E10000-0x0000000000E3E000-memory.dmp

    Filesize

    184KB

  • memory/3516-57-0x00000000055F0000-0x00000000055F6000-memory.dmp

    Filesize

    24KB

  • memory/3516-58-0x0000000005E10000-0x0000000006428000-memory.dmp

    Filesize

    6.1MB

  • memory/3516-59-0x0000000005900000-0x0000000005A0A000-memory.dmp

    Filesize

    1.0MB

  • memory/3516-60-0x0000000005680000-0x0000000005692000-memory.dmp

    Filesize

    72KB

  • memory/3516-61-0x00000000057F0000-0x000000000582C000-memory.dmp

    Filesize

    240KB

  • memory/3516-62-0x0000000005840000-0x000000000588C000-memory.dmp

    Filesize

    304KB