Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:49

General

  • Target

    0c423daf50ac1d1fb18455637a8b1189aa8527cb9fcecca2afe24d69234bcd34.exe

  • Size

    577KB

  • MD5

    8f856af40106052a7932d73c444accc7

  • SHA1

    c77233fff2ed7df7703ab79b83e8988caa41b49f

  • SHA256

    0c423daf50ac1d1fb18455637a8b1189aa8527cb9fcecca2afe24d69234bcd34

  • SHA512

    ae9a0544cc6692d3422b9da3b9b101ceec066b4efa112fc58a513e8bafe948091436038466272fad4b1983ba4aff67a1b85cc26e7d5d244d45fbc706cf1847b6

  • SSDEEP

    12288:4Mriy90Sahimz7AuxqVtc0kyjYtPkxhGneUpuI1fAWd4X:ayjsVAuxYyustPkSeUMIxAR

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c423daf50ac1d1fb18455637a8b1189aa8527cb9fcecca2afe24d69234bcd34.exe
    "C:\Users\Admin\AppData\Local\Temp\0c423daf50ac1d1fb18455637a8b1189aa8527cb9fcecca2afe24d69234bcd34.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r2859dx.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r2859dx.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1964
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 1040
        3⤵
        • Program crash
        PID:4072
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w70Jm00.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w70Jm00.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2104
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1964 -ip 1964
    1⤵
      PID:4692
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:2832

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r2859dx.exe

            Filesize

            322KB

            MD5

            8141937b23cd1895e561d8e90fdeeff3

            SHA1

            6f810e9e480564f5837461f8ccdd07c951a1bece

            SHA256

            ddda10348c77cf0a1539c3a42ce4f71e2c1895ab9b77348256e0a1f01c0936b6

            SHA512

            40957cd33c4be1dab98ac0c40424c868aa3be6f6265fa28df050e5a4844ac6324acb93770bc6cb7cafedabc93fab9b9179a6e6525f6b3dd6fa9e31b4d5da5bec

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w70Jm00.exe

            Filesize

            323KB

            MD5

            a18bc052dac76e8b0b9945594d2e8eab

            SHA1

            9342f954e199cb1e8375daf861d91b877f1c6ad9

            SHA256

            d8a2a5c2cc4691861d4f8409f2877cac35b3e82ae94b90a45160ae204a4cf7d2

            SHA512

            898156d3be9e60ae438033b2b9d9d30891781cb43841dd00e3dc6431d9ae458d61fd060348a6780d5d594b08c2a67978a62e81a37d7d777c8c8d5868ebdd33b6

          • memory/1964-10-0x0000000000400000-0x00000000004D4000-memory.dmp

            Filesize

            848KB

          • memory/1964-9-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/1964-8-0x00000000006F0000-0x00000000007F0000-memory.dmp

            Filesize

            1024KB

          • memory/1964-11-0x0000000000400000-0x00000000004D4000-memory.dmp

            Filesize

            848KB

          • memory/1964-12-0x00000000023A0000-0x00000000023BA000-memory.dmp

            Filesize

            104KB

          • memory/1964-13-0x0000000004AA0000-0x0000000005044000-memory.dmp

            Filesize

            5.6MB

          • memory/1964-14-0x00000000025A0000-0x00000000025B8000-memory.dmp

            Filesize

            96KB

          • memory/1964-15-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-18-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-42-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-41-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-38-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-36-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-34-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-32-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-30-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-28-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-26-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-24-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-22-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-20-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-16-0x00000000025A0000-0x00000000025B2000-memory.dmp

            Filesize

            72KB

          • memory/1964-43-0x00000000006F0000-0x00000000007F0000-memory.dmp

            Filesize

            1024KB

          • memory/1964-44-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/1964-47-0x0000000000400000-0x00000000004D4000-memory.dmp

            Filesize

            848KB

          • memory/1964-48-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2104-53-0x0000000000400000-0x000000000046D000-memory.dmp

            Filesize

            436KB

          • memory/2104-54-0x0000000000400000-0x000000000046D000-memory.dmp

            Filesize

            436KB

          • memory/2104-56-0x0000000000400000-0x000000000046D000-memory.dmp

            Filesize

            436KB

          • memory/2104-55-0x0000000004990000-0x00000000049D6000-memory.dmp

            Filesize

            280KB

          • memory/2104-57-0x0000000004A50000-0x0000000004A94000-memory.dmp

            Filesize

            272KB

          • memory/2104-65-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-73-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-91-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-89-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-87-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-85-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-81-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-79-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-77-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-75-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-71-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-69-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-67-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-63-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-61-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-83-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-59-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-58-0x0000000004A50000-0x0000000004A8E000-memory.dmp

            Filesize

            248KB

          • memory/2104-964-0x0000000005230000-0x0000000005848000-memory.dmp

            Filesize

            6.1MB

          • memory/2104-965-0x0000000005880000-0x000000000598A000-memory.dmp

            Filesize

            1.0MB

          • memory/2104-966-0x00000000059C0000-0x00000000059D2000-memory.dmp

            Filesize

            72KB

          • memory/2104-967-0x00000000059E0000-0x0000000005A1C000-memory.dmp

            Filesize

            240KB

          • memory/2104-968-0x0000000005B30000-0x0000000005B7C000-memory.dmp

            Filesize

            304KB