Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:55

General

  • Target

    d0660240a26a4aab588538cfeebfa4b36faf7c5e26ba7b18fb1f770b666c2cd5.exe

  • Size

    685KB

  • MD5

    68442cc029e9d9d9ecb88400529230e2

  • SHA1

    40eb9f77a55bb99e760477ab4ddb60eb1fdc5b18

  • SHA256

    d0660240a26a4aab588538cfeebfa4b36faf7c5e26ba7b18fb1f770b666c2cd5

  • SHA512

    527b8ec27b8aaf0649a19ddce28e4a9695d8a0070d35284aed72c8a293b17124d0591a3b74dbed21868de4c1288c746f16248379d5634c1c1af2aff4b0b1e3b4

  • SSDEEP

    12288:/Mrqy90ND0IkZzOb1D+nVV0nEurV8M807X+95l9u548IvwbyrDQ8B2x6N+jetqXc:ly4D0IZb1CnVVOJ7X+d1GiDLu9jGqb+Z

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0660240a26a4aab588538cfeebfa4b36faf7c5e26ba7b18fb1f770b666c2cd5.exe
    "C:\Users\Admin\AppData\Local\Temp\d0660240a26a4aab588538cfeebfa4b36faf7c5e26ba7b18fb1f770b666c2cd5.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDl6215.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDl6215.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr450428.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr450428.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1344
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku941231.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku941231.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4848
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5400
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 1548
          4⤵
          • Program crash
          PID:5584
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr901792.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr901792.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5712
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4848 -ip 4848
    1⤵
      PID:5536

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr901792.exe

            Filesize

            169KB

            MD5

            db4d794790518692501bfdad91b944f0

            SHA1

            d7957f26e12387c3efd9af1d9c6313ea1de03541

            SHA256

            6920f677b4268c4525e2fcaa5e8ca25cc7e2cc24fd0ba95eb9cdab5bbf785445

            SHA512

            620e1663d219c9c8083c39dd288ed7221d55dddab481377c1e35437003bdc9fdf82e59c5726ace770e86cf157222e9b55e068c57eab06398dcbc50fa0f8fc1e5

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDl6215.exe

            Filesize

            530KB

            MD5

            031f5005cee864c7caec9ec3cd7dc2fe

            SHA1

            3632a81c087f2e8659f9784bc735744c16de77c2

            SHA256

            f3d28398a013d1c84a10a1a065c51c08ff69a4f0bbdda7f54802f42c16e4ba4c

            SHA512

            3ce5fe3046285234d67e22ff801e4e592d594c39e7d1d01dafc0456df10c82655f58c795465ea364ff862c68bb6f5ecfb6c229d457c41287260c7f712a52fdc2

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr450428.exe

            Filesize

            12KB

            MD5

            fd87d9556f00a498035310a997f07392

            SHA1

            00a105297d292c5f483dff4b35936ddb56057219

            SHA256

            f4f19f83695d6839a9a7781efdc824862e2f1d0147976a0b15473b21a3498e27

            SHA512

            7facc920b829415820039923349edebda5a2cc5a131750e3139249e52bac975b476306df17fc8c216abefda352c4e15758328f381e42e87a31825051a1620832

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku941231.exe

            Filesize

            495KB

            MD5

            fb76f546d18be100d19ab53c765e7847

            SHA1

            43823c4bffb28a4f98e1fdccde53ccef919cd546

            SHA256

            1eb592222cb8c2b275242c5d6aac27c0031428eb6137b5ef0bd9decf89b4a160

            SHA512

            fb3b2071a6690c7dfbb63461396e809e45e702b32ef5dda799e6b9cd86bc8bdeba4de78cd416bd9ac0fe5ca8be5ada129182bc773aad1dca73c15e6ae397dafb

          • C:\Windows\Temp\1.exe

            Filesize

            168KB

            MD5

            1073b2e7f778788852d3f7bb79929882

            SHA1

            7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

            SHA256

            c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

            SHA512

            90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

          • memory/1344-14-0x00007FFEE80C3000-0x00007FFEE80C5000-memory.dmp

            Filesize

            8KB

          • memory/1344-15-0x00000000000B0000-0x00000000000BA000-memory.dmp

            Filesize

            40KB

          • memory/4848-21-0x0000000002700000-0x0000000002766000-memory.dmp

            Filesize

            408KB

          • memory/4848-22-0x00000000050D0000-0x0000000005674000-memory.dmp

            Filesize

            5.6MB

          • memory/4848-23-0x00000000028E0000-0x0000000002946000-memory.dmp

            Filesize

            408KB

          • memory/4848-81-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-87-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-85-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-83-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-79-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-77-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-75-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-73-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-71-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-69-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-67-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-65-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-61-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-59-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-57-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-55-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-53-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-49-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-47-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-45-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-43-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-41-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-39-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-37-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-33-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-31-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-29-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-27-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-63-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-51-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-35-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-25-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-24-0x00000000028E0000-0x000000000293F000-memory.dmp

            Filesize

            380KB

          • memory/4848-2104-0x0000000002B50000-0x0000000002B82000-memory.dmp

            Filesize

            200KB

          • memory/5400-2117-0x00000000006D0000-0x0000000000700000-memory.dmp

            Filesize

            192KB

          • memory/5400-2118-0x0000000000E50000-0x0000000000E56000-memory.dmp

            Filesize

            24KB

          • memory/5400-2119-0x0000000005720000-0x0000000005D38000-memory.dmp

            Filesize

            6.1MB

          • memory/5400-2120-0x0000000005210000-0x000000000531A000-memory.dmp

            Filesize

            1.0MB

          • memory/5400-2121-0x0000000004F40000-0x0000000004F52000-memory.dmp

            Filesize

            72KB

          • memory/5400-2122-0x0000000004FA0000-0x0000000004FDC000-memory.dmp

            Filesize

            240KB

          • memory/5400-2123-0x0000000005100000-0x000000000514C000-memory.dmp

            Filesize

            304KB

          • memory/5712-2128-0x0000000000870000-0x000000000089E000-memory.dmp

            Filesize

            184KB

          • memory/5712-2129-0x00000000012C0000-0x00000000012C6000-memory.dmp

            Filesize

            24KB