Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:44

General

  • Target

    ca0acff592494132389b9d0604769c8bf72462c526d23b9c44d0c05512f8da93.exe

  • Size

    814KB

  • MD5

    6f5f3f58c516439e7dee0b626706c41c

  • SHA1

    5b2f74f045cba13e36ff26bbb4b9ec67f2a639ef

  • SHA256

    ca0acff592494132389b9d0604769c8bf72462c526d23b9c44d0c05512f8da93

  • SHA512

    e75efbd96ce7872827a1dc36f89ef97a4ed944da4b0567be36630e1d0517d1af2b0031099e595f15f99563c4a9f55b1ffef94adfe76d4bf19f513f00acf53168

  • SSDEEP

    12288:YMr8y90RBL6U7skFNqO05JaaGlPdckaVpWfyivOtzhJonk6iyn0OdC6fWjpD8AoV:EyI1UkaOqilPxaVDivO0qy0OdX0Ib

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca0acff592494132389b9d0604769c8bf72462c526d23b9c44d0c05512f8da93.exe
    "C:\Users\Admin\AppData\Local\Temp\ca0acff592494132389b9d0604769c8bf72462c526d23b9c44d0c05512f8da93.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un492162.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un492162.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4952.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4952.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5072
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1004
          4⤵
          • Program crash
          PID:2588
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7109.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7109.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2872
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4740
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 1376
          4⤵
          • Program crash
          PID:5384
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si959341.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si959341.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5728
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5072 -ip 5072
    1⤵
      PID:4428
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2872 -ip 2872
      1⤵
        PID:3752

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si959341.exe

              Filesize

              169KB

              MD5

              431c85d48f449c8ef14d544c312bf925

              SHA1

              5b4949d806f85d1d003acce4d6728da4911a3856

              SHA256

              cdbefdcb9b74b27294932ecb43f2608f097a17b0d9e3bf65b20ea31b101c6a11

              SHA512

              481d2803523e995d017c96d1bf5298b5de433458f9bbe7e4729a54a8a58a9431d37505cfaf3b8f86f27ab985c8d34ba23feeb965bf371ae3471a238c270ed26e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un492162.exe

              Filesize

              660KB

              MD5

              6b374084032be67bedfdcc082de439a0

              SHA1

              2ca5793c18f07d0c456c81e53057e470c3dcb31b

              SHA256

              b756f24e4cbf6b6151d95e0d25bcaa1d59f58de5742b3c5b08373c90f1604648

              SHA512

              0a67dc400573295eab47f6fbf36159d212e619a70c37fb41be6e1e2d53ef308393666e7d4a1141c537aeaa27a90d299dbc05a19ee61fa04819a99055d983f92f

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4952.exe

              Filesize

              332KB

              MD5

              9bc12f29b331507bdb5f607bdecbd64a

              SHA1

              db23d36642f7b3f086d3e26ee82d525c6002f4c6

              SHA256

              783ce6f1acfd8266d672a9ddf2193154f2a14cfdb911df082b53dbb3c8cfeacc

              SHA512

              c22fe639e5561035c02bc0208fa0393810b8b1a313a04cb48c66ace6d947485d05d8696d6bcb8a18adaf171a72ecac4aa3dcf0554f3dd431b6936d4a0703c6d4

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7109.exe

              Filesize

              515KB

              MD5

              fedb9535573fa0657e99313221c438df

              SHA1

              e065225b34ed492635f682b04c104c81016ca9a4

              SHA256

              e938b8e76cf47d16377b3a76fa9e96cd7b131d3ef747aee7e52ada6c2ca2f94a

              SHA512

              ebe84b74ff6bcce9d470de27e8458a26a221ee65d915d2ee6c204f617a15a2c220607b93fe51d7150461574b972693ef0e8a156902856b6573bdcb71f8cd53f0

            • C:\Windows\Temp\1.exe

              Filesize

              168KB

              MD5

              1073b2e7f778788852d3f7bb79929882

              SHA1

              7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

              SHA256

              c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

              SHA512

              90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

            • memory/2872-82-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-74-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-2143-0x00000000050A0000-0x00000000050D2000-memory.dmp

              Filesize

              200KB

            • memory/2872-72-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-90-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-76-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-78-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-84-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-86-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-68-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-92-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-94-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-96-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-63-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-64-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-80-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-70-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-88-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-66-0x0000000002A30000-0x0000000002A8F000-memory.dmp

              Filesize

              380KB

            • memory/2872-62-0x0000000002A30000-0x0000000002A96000-memory.dmp

              Filesize

              408KB

            • memory/2872-61-0x00000000028C0000-0x0000000002926000-memory.dmp

              Filesize

              408KB

            • memory/4740-2156-0x0000000000980000-0x00000000009B0000-memory.dmp

              Filesize

              192KB

            • memory/4740-2166-0x00000000053D0000-0x000000000541C000-memory.dmp

              Filesize

              304KB

            • memory/4740-2161-0x0000000005390000-0x00000000053CC000-memory.dmp

              Filesize

              240KB

            • memory/4740-2160-0x00000000052F0000-0x0000000005302000-memory.dmp

              Filesize

              72KB

            • memory/4740-2159-0x0000000005460000-0x000000000556A000-memory.dmp

              Filesize

              1.0MB

            • memory/4740-2158-0x0000000005970000-0x0000000005F88000-memory.dmp

              Filesize

              6.1MB

            • memory/4740-2157-0x00000000052A0000-0x00000000052A6000-memory.dmp

              Filesize

              24KB

            • memory/5072-29-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-23-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-47-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-33-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-35-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-37-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-39-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-41-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-52-0x0000000000400000-0x0000000000430000-memory.dmp

              Filesize

              192KB

            • memory/5072-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-51-0x0000000000970000-0x000000000099D000-memory.dmp

              Filesize

              180KB

            • memory/5072-43-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-22-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-27-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-21-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

              Filesize

              96KB

            • memory/5072-20-0x0000000004EA0000-0x0000000005444000-memory.dmp

              Filesize

              5.6MB

            • memory/5072-15-0x0000000000A30000-0x0000000000B30000-memory.dmp

              Filesize

              1024KB

            • memory/5072-19-0x0000000002780000-0x000000000279A000-memory.dmp

              Filesize

              104KB

            • memory/5072-25-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

              Filesize

              72KB

            • memory/5072-50-0x0000000000A30000-0x0000000000B30000-memory.dmp

              Filesize

              1024KB

            • memory/5072-17-0x0000000000400000-0x0000000000430000-memory.dmp

              Filesize

              192KB

            • memory/5072-18-0x0000000000400000-0x0000000000807000-memory.dmp

              Filesize

              4.0MB

            • memory/5072-55-0x0000000000400000-0x0000000000807000-memory.dmp

              Filesize

              4.0MB

            • memory/5072-16-0x0000000000970000-0x000000000099D000-memory.dmp

              Filesize

              180KB

            • memory/5072-56-0x0000000000400000-0x0000000000430000-memory.dmp

              Filesize

              192KB

            • memory/5728-2167-0x0000000000CA0000-0x0000000000CCE000-memory.dmp

              Filesize

              184KB

            • memory/5728-2168-0x0000000001320000-0x0000000001326000-memory.dmp

              Filesize

              24KB