Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:57

General

  • Target

    4d5d16a4a40511084473b6763484b89f87b84101a7562bd76938b6514a4e007eN.exe

  • Size

    516KB

  • MD5

    426a3f0dd5122b23c5858119205cf7d0

  • SHA1

    e0626ad2b1a6409ffbfe6576d9d79e578ca6128b

  • SHA256

    4d5d16a4a40511084473b6763484b89f87b84101a7562bd76938b6514a4e007e

  • SHA512

    d2964d3b46f992a0a77bd25184bfcce76000016e7319f61e58f1f40aac58796b69ef1e7730099a5bb220270497742acf6b723f16b372333bef7cac8c70e4723d

  • SSDEEP

    12288:6MrDy90IywERk7Rm559ohUohGcAxJQTrqjpT0o3RngDpmtmP:Zybp7Rm5SBfrmhBnEpmm

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d5d16a4a40511084473b6763484b89f87b84101a7562bd76938b6514a4e007eN.exe
    "C:\Users\Admin\AppData\Local\Temp\4d5d16a4a40511084473b6763484b89f87b84101a7562bd76938b6514a4e007eN.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro1997.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro1997.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1056
        3⤵
        • Program crash
        PID:1748
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu7015.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu7015.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4776
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5060 -ip 5060
    1⤵
      PID:1648

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro1997.exe

            Filesize

            236KB

            MD5

            2c46b23f6e60d09ad65379c8da54fa7c

            SHA1

            8e4e7f8cd4126467044fd50f1b740a1130504072

            SHA256

            ee837636a8be63f6ee234ba429bc220467fcfc33cc5a8b09cdc99782ba0e115c

            SHA512

            4e8f1ab884a83111139a4f442b48d5dbaa4527d98a74cad2371049aae1b75f89d49dd6d4181dcf201cc7646098f0abc411b07ce52f8330702b53178807512739

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu7015.exe

            Filesize

            294KB

            MD5

            ab63df80897e1655e7a8dc33c0daefe3

            SHA1

            be11009952c9734503d47bcff6f4e3815792ceaa

            SHA256

            5e2b8a884e6bfbb189647e94812e81cb1bc2f68c011a71ce4b5594d019fadb78

            SHA512

            5acfbeae205710e67355395e63f27f2a46178143060acd8dc20638491162648599f66d445ce70d65cba74ea2b9de57a3778eec0b126267d14e143f3258d3fd35

          • memory/4776-74-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-68-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-969-0x0000000005A40000-0x0000000005A8C000-memory.dmp

            Filesize

            304KB

          • memory/4776-968-0x00000000058F0000-0x000000000592C000-memory.dmp

            Filesize

            240KB

          • memory/4776-967-0x00000000058D0000-0x00000000058E2000-memory.dmp

            Filesize

            72KB

          • memory/4776-966-0x0000000005790000-0x000000000589A000-memory.dmp

            Filesize

            1.0MB

          • memory/4776-965-0x00000000050F0000-0x0000000005708000-memory.dmp

            Filesize

            6.1MB

          • memory/4776-54-0x0000000000400000-0x00000000004B8000-memory.dmp

            Filesize

            736KB

          • memory/4776-60-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-82-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-59-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-55-0x0000000000400000-0x00000000004B8000-memory.dmp

            Filesize

            736KB

          • memory/4776-64-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-66-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-53-0x0000000000400000-0x00000000004B8000-memory.dmp

            Filesize

            736KB

          • memory/4776-56-0x00000000025A0000-0x00000000025E6000-memory.dmp

            Filesize

            280KB

          • memory/4776-70-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-72-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-76-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-78-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-80-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-85-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-86-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-88-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-92-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-90-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-57-0x0000000000400000-0x00000000004B8000-memory.dmp

            Filesize

            736KB

          • memory/4776-62-0x0000000002660000-0x000000000269F000-memory.dmp

            Filesize

            252KB

          • memory/4776-58-0x0000000002660000-0x00000000026A4000-memory.dmp

            Filesize

            272KB

          • memory/5060-26-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-40-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-10-0x0000000000400000-0x00000000004AA000-memory.dmp

            Filesize

            680KB

          • memory/5060-9-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/5060-48-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/5060-47-0x0000000000400000-0x00000000004AA000-memory.dmp

            Filesize

            680KB

          • memory/5060-44-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/5060-43-0x00000000005E0000-0x00000000006E0000-memory.dmp

            Filesize

            1024KB

          • memory/5060-15-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-16-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-18-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-8-0x00000000005E0000-0x00000000006E0000-memory.dmp

            Filesize

            1024KB

          • memory/5060-20-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-22-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-24-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-28-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-30-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-32-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-34-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-36-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-38-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-42-0x00000000025F0000-0x0000000002602000-memory.dmp

            Filesize

            72KB

          • memory/5060-14-0x00000000025F0000-0x0000000002608000-memory.dmp

            Filesize

            96KB

          • memory/5060-13-0x0000000004C10000-0x00000000051B4000-memory.dmp

            Filesize

            5.6MB

          • memory/5060-12-0x0000000002290000-0x00000000022AA000-memory.dmp

            Filesize

            104KB

          • memory/5060-11-0x0000000000400000-0x00000000004AA000-memory.dmp

            Filesize

            680KB