Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:56

General

  • Target

    8083a15c972bda5bcbba44e9db10abc8b38528948166828bc6567845e4835231.exe

  • Size

    682KB

  • MD5

    ccb03bf02f686ffb7e2c18d744ffa957

  • SHA1

    b6e431156cd186046c37321cf8aa004e8c697293

  • SHA256

    8083a15c972bda5bcbba44e9db10abc8b38528948166828bc6567845e4835231

  • SHA512

    29f40001ec5a58e13b2f87df652324ed2354d38dc9d7e91606b84d0df8a63e1e2495d3ebf07dc4d0123ed198a83e652458094eb52dde9b8f806352f0958c4df4

  • SSDEEP

    12288:0MrCy90RJPQxFfs1kGxNCH+RDQbkiBWZPuk/CO4PqNeSxX:my04KxLpQb3WLCO4PqNeSxX

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8083a15c972bda5bcbba44e9db10abc8b38528948166828bc6567845e4835231.exe
    "C:\Users\Admin\AppData\Local\Temp\8083a15c972bda5bcbba44e9db10abc8b38528948166828bc6567845e4835231.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un211849.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un211849.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4106.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4106.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1732
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2332.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2332.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1968
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:4964

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un211849.exe

          Filesize

          540KB

          MD5

          bc47b904ad3bb3642ef2ac372a9e91e9

          SHA1

          d75df21a370259181fa644bd48fab4c85caf8508

          SHA256

          27e7a72c028e0fcbeeee3c56e633e53d54dff30e2b408552a3ebb5c190063923

          SHA512

          8e61fe3a35ff9b1872721f4efb21c86c690b251d7fe801237620cd9b6fd49c4ded75d2c98884c02f39b2b9ea825399dd957b765fa3cbd056162c04a704c85799

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4106.exe

          Filesize

          322KB

          MD5

          062310268515bd203315e18af3126c8f

          SHA1

          bcb30b3f6e99a727def58e0b0d5c6b878b70c07c

          SHA256

          2860e7cb01aa294da160b86bf9b0d7f2825ea4a715781de38e3933291ec7760b

          SHA512

          8219b23a987117f4d7944d10d7e97cc4e66d75334aa2cb0d279414ecd4e5cb881f69d449cea85a2873fb9e9518bf0d7cb6f37ba5876a046a114ca7af4d096948

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2332.exe

          Filesize

          379KB

          MD5

          1fa44b0bf5e51dc2c9e229867a466066

          SHA1

          5e0eb2ba56044d1ed3accaebf3762e6a27e460c4

          SHA256

          92ab1f51a393d8ea89fe677c262574127608089600b81f23e22e969b645cc5b3

          SHA512

          d5f8b7c255cd79f985a2fbad44025eb91b43e02a6ccda00ee9f122cd7338d0e419985b03659fe342a93661b814b471df09543d561286cb73f31ca7d2951ce545

        • memory/1732-15-0x0000000002F00000-0x0000000003000000-memory.dmp

          Filesize

          1024KB

        • memory/1732-16-0x0000000002C50000-0x0000000002C7D000-memory.dmp

          Filesize

          180KB

        • memory/1732-17-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/1732-18-0x00000000046D0000-0x00000000046EA000-memory.dmp

          Filesize

          104KB

        • memory/1732-19-0x0000000007210000-0x00000000077B4000-memory.dmp

          Filesize

          5.6MB

        • memory/1732-20-0x0000000007130000-0x0000000007148000-memory.dmp

          Filesize

          96KB

        • memory/1732-21-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-48-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-46-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-44-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-42-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-40-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-38-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-36-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-34-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-32-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-30-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-28-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-26-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-24-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-22-0x0000000007130000-0x0000000007142000-memory.dmp

          Filesize

          72KB

        • memory/1732-49-0x0000000002F00000-0x0000000003000000-memory.dmp

          Filesize

          1024KB

        • memory/1732-50-0x0000000002C50000-0x0000000002C7D000-memory.dmp

          Filesize

          180KB

        • memory/1732-52-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/1732-51-0x0000000000400000-0x0000000002B7E000-memory.dmp

          Filesize

          39.5MB

        • memory/1732-55-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/1732-54-0x0000000000400000-0x0000000002B7E000-memory.dmp

          Filesize

          39.5MB

        • memory/1968-60-0x0000000002FA0000-0x0000000002FE6000-memory.dmp

          Filesize

          280KB

        • memory/1968-61-0x0000000004E70000-0x0000000004EB4000-memory.dmp

          Filesize

          272KB

        • memory/1968-67-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-95-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-93-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-91-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-89-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-87-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-85-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-83-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-81-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-79-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-77-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-75-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-73-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-71-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-69-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-65-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-63-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-62-0x0000000004E70000-0x0000000004EAE000-memory.dmp

          Filesize

          248KB

        • memory/1968-968-0x0000000007820000-0x0000000007E38000-memory.dmp

          Filesize

          6.1MB

        • memory/1968-969-0x0000000007E60000-0x0000000007F6A000-memory.dmp

          Filesize

          1.0MB

        • memory/1968-970-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

          Filesize

          72KB

        • memory/1968-971-0x0000000008000000-0x000000000803C000-memory.dmp

          Filesize

          240KB

        • memory/1968-972-0x0000000008150000-0x000000000819C000-memory.dmp

          Filesize

          304KB