Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:53

General

  • Target

    c1916b134a54ab42d21b046192ed9d367444bb84506281bd561bc161159ff49b.exe

  • Size

    1.5MB

  • MD5

    68e593e4dada3f0fc34fc8b9e2d9379a

  • SHA1

    ee1b1858e8054afc2b7628e34f185b9ed2b592f7

  • SHA256

    c1916b134a54ab42d21b046192ed9d367444bb84506281bd561bc161159ff49b

  • SHA512

    5788cc5e9f5c2fa9a0a2061ed33bc8222795bd0f2ab9541605f255339462dbfeb899decd1958be75e015ac400aeda54da2843c8e0122e174bdd72672f6c1d409

  • SSDEEP

    24576:SykDSg4piChMmMCb2CqR57p5WbPmUKupDfR22uSjks2wKrKHtwJK:5kv4dNM2lqz7pV4R22uSjL2vyo

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes
  • auth_value

    3d2870537d84a4c6d7aeecd002871c51

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1916b134a54ab42d21b046192ed9d367444bb84506281bd561bc161159ff49b.exe
    "C:\Users\Admin\AppData\Local\Temp\c1916b134a54ab42d21b046192ed9d367444bb84506281bd561bc161159ff49b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3663892.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3663892.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3136
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7239244.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7239244.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9677373.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9677373.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4708
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5653127.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5653127.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2944
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9015258.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9015258.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4396
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1088
                7⤵
                • Program crash
                PID:676
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8967198.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8967198.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4796
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4396 -ip 4396
    1⤵
      PID:3516

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3663892.exe

            Filesize

            1.4MB

            MD5

            7d5c6eeb67777c246fb4b86e1a403336

            SHA1

            f998a4706f127dd2ab2caf1d90cd35e0c88ea108

            SHA256

            3f833e1f58b77d4c6f85309706469514c6e398d12783dd0f89bc172c75b2b4d1

            SHA512

            9d03e49de6f14aea44321467b0a5b9ace42a59ef011eb0807240bf797af1678fc21e2821a7e22bec4498dfecb6ddbb7ad508f1aa984d6c60c67da3eb8ccf86fe

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7239244.exe

            Filesize

            912KB

            MD5

            dc11587d04dcdebaa64ebe50f3aba6b4

            SHA1

            8ba53d2e8f23fe067aca320e7d639791a79a286c

            SHA256

            9bd2d6992dac5fb3184332efea0a309a79df29163e426a37d635101530094184

            SHA512

            735d676ba6fc996677714de881e5f0df0ce118bde2584df329fbb32b0c81d26cbaa52d2ef8d131dc25dea3ef6e71f5c730c50ce119a897dcaa9a37569a7bd302

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9677373.exe

            Filesize

            707KB

            MD5

            cecdc554ff195e2383acf4df8da404cc

            SHA1

            31a897b61c8fea673da1b8cb3c3f5ed3b5378fcc

            SHA256

            e51ffee075d544dc28f798f968f8f415b5c881d2a792d5529c863f3e73886744

            SHA512

            308529c6f7b0c2ecf8eda2d4e208a7679f5f3cb02c951327e1ce9f3b0f660430fc26724625887e0af5d86fa48b4eb1a9079ba29f31a58fc5aa3552ebc0e6475e

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5653127.exe

            Filesize

            416KB

            MD5

            df795b4430191b628541437ecb92e144

            SHA1

            c5b978054b646ceaef170530b7a915fc85470aa2

            SHA256

            ec9143a1499660c53b1456a5971928e21798faedb760aa184dc14b357630eb5c

            SHA512

            31dfad3ff935829e12b962e766d322175f99aa4a7addcd17418087fb10cc7faa6fe0a54ae78c5a66cf966ab299bcf1f5ecda0b9e4f6c602d2908411b721c8e39

          • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9015258.exe

            Filesize

            360KB

            MD5

            22f1b3c9ae47dd2d1b1f758000e20063

            SHA1

            49b249376f77ef2f9b426f7b20dc69c5f0755505

            SHA256

            d8ae2f70a80affba24c38f225775055d0e19cb0b998595c56cf77baee3af8ce5

            SHA512

            4be279f5a3db5d4aa3c44492bb798d17b469d89a9f920dddd87853c4f64a4520af59c8ee9046e9f98a07c7583be2de1d4134263f1fbea4db4ca4b7e793ea690e

          • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b8967198.exe

            Filesize

            168KB

            MD5

            8a300f51018b0b635df40751a4f37293

            SHA1

            d55621636ec7778f1669b2c0afd14497385361aa

            SHA256

            e4365d94646b676bbbcb23bce7f68a255d7ef1d5c81afee6795b51c1ffcc2ab2

            SHA512

            31eaba93dcfd370e8ddb4a71fd2b2cf09e0d2bbd2c354b68797dccf04fef36a9ec3c1308c25ee1034e59a69393d7b996af9c43690ba9face3dd14f2db8586617

          • memory/4396-52-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-44-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-42-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-48-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-64-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-62-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-60-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-59-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-56-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-54-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-37-0x0000000004D80000-0x0000000005324000-memory.dmp

            Filesize

            5.6MB

          • memory/4396-50-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-46-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-38-0x0000000002790000-0x00000000027A8000-memory.dmp

            Filesize

            96KB

          • memory/4396-66-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-39-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-40-0x0000000002790000-0x00000000027A2000-memory.dmp

            Filesize

            72KB

          • memory/4396-67-0x0000000000400000-0x00000000006F4000-memory.dmp

            Filesize

            3.0MB

          • memory/4396-69-0x0000000000400000-0x00000000006F4000-memory.dmp

            Filesize

            3.0MB

          • memory/4396-36-0x00000000024E0000-0x00000000024FA000-memory.dmp

            Filesize

            104KB

          • memory/4796-73-0x0000000000AF0000-0x0000000000B20000-memory.dmp

            Filesize

            192KB

          • memory/4796-74-0x00000000014F0000-0x00000000014F6000-memory.dmp

            Filesize

            24KB

          • memory/4796-75-0x000000000AF10000-0x000000000B528000-memory.dmp

            Filesize

            6.1MB

          • memory/4796-76-0x000000000AA90000-0x000000000AB9A000-memory.dmp

            Filesize

            1.0MB

          • memory/4796-77-0x000000000A9C0000-0x000000000A9D2000-memory.dmp

            Filesize

            72KB

          • memory/4796-78-0x000000000AA20000-0x000000000AA5C000-memory.dmp

            Filesize

            240KB

          • memory/4796-79-0x0000000004E30000-0x0000000004E7C000-memory.dmp

            Filesize

            304KB