Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:57

General

  • Target

    329268e94726ae09ff3adc42fbb1cba6f03dd5b78b83269ef1f6b9cc9bd809e2.exe

  • Size

    893KB

  • MD5

    200923cc95d07a56aa0c81ffc0bbd52e

  • SHA1

    9c25a840571be43a634fcba5797aef965fe1309a

  • SHA256

    329268e94726ae09ff3adc42fbb1cba6f03dd5b78b83269ef1f6b9cc9bd809e2

  • SHA512

    ade12cc059d81c704c038f157f7830ffaf8d293bcf4949ca0bbcd1cdfef4563dfc0e7d555fffdc774aedc199ce4b0954f4ec471030e0f702cd95753d51836271

  • SSDEEP

    24576:ty49Yq3cajBAG6t6JF5L+w9DoqU67hNzezuVE+i:I4+q3HqHtuF5NG+dJ

Malware Config

Extracted

Family

redline

Botnet

dark

C2

185.161.248.73:4164

Attributes
  • auth_value

    ae85b01f66afe8770afeed560513fc2d

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\329268e94726ae09ff3adc42fbb1cba6f03dd5b78b83269ef1f6b9cc9bd809e2.exe
    "C:\Users\Admin\AppData\Local\Temp\329268e94726ae09ff3adc42fbb1cba6f03dd5b78b83269ef1f6b9cc9bd809e2.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st660619.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st660619.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25545826.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25545826.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3164
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp307356.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp307356.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3440
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 1268
          4⤵
          • Program crash
          PID:7088
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr133136.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr133136.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4432
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3440 -ip 3440
    1⤵
      PID:6904

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr133136.exe

            Filesize

            170KB

            MD5

            5e1a040f815327cc82ba1bbcd7401cf1

            SHA1

            9ad026b6a1b7be2b6a8a5e1df7cc4bfb1a53d9d3

            SHA256

            50deda287af2e5a0e86c9e939c2b1608023c0f62673e441737b5aec43bc72a89

            SHA512

            90f75b7603dba1c946c91ba64de9fde0ff8c6b6868619c183457d794200f74a1c8901e23b43e86e87916b351bb1017145ee7acae944c936cf2ac89e61f5963f2

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st660619.exe

            Filesize

            739KB

            MD5

            23009e21838ec5d3ea17a30274471fe2

            SHA1

            3f546f8afb483a245765883d58bf06db5fc755b0

            SHA256

            b97f6bef2b117ba7a49a9dfded9d6b967047532e4c1d580d41546510e682e531

            SHA512

            9ba2b0035095d74223ee59ad853f84104c3250012b93c5d85f7cea3e26cc53a20e413f762ec0d76c246c746d965184057aa3962854f0229cb8638de4c3875743

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25545826.exe

            Filesize

            302KB

            MD5

            2ef098324f80bd0a39afe42fa12528ac

            SHA1

            66c04eeb98b9bc6f20d8a3bb521ab49c46a9b58e

            SHA256

            b433bab5e7f94bb68a056809ac92540472857acfb2c16e6ae45158d8c4549869

            SHA512

            a7378666f1848296455c652f7911d939851555f3ec589c0f6860d215771d9cc3a3d6c25e54869bf3f7ebb74cbf9fed6ce24d8aba748da79200f37b76e11ab29b

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp307356.exe

            Filesize

            582KB

            MD5

            652e22edc6d54fd53f26ae5a0046381f

            SHA1

            ddbb69795df5d649508024b11ef9b27e322e2491

            SHA256

            d1cac64fc859349d033070a7300bc7bccd47e2dc824b6713eaa8913b5baa4f07

            SHA512

            0afaf4c1a553d7276e4fa641d3ed03a4e5732ab53259c773519a288b64841dca503978d16f8e489eb4af5b32c94ae417f069d857609d3dfba33a8cebe9400001

          • C:\Windows\Temp\1.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • memory/3164-2162-0x00000000008F0000-0x00000000008FA000-memory.dmp

            Filesize

            40KB

          • memory/3440-4317-0x00000000057C0000-0x0000000005852000-memory.dmp

            Filesize

            584KB

          • memory/3440-2168-0x0000000002680000-0x00000000026E8000-memory.dmp

            Filesize

            416KB

          • memory/3440-2169-0x0000000002990000-0x00000000029F6000-memory.dmp

            Filesize

            408KB

          • memory/3440-4316-0x0000000002BF0000-0x0000000002C22000-memory.dmp

            Filesize

            200KB

          • memory/4432-4327-0x0000000005430000-0x0000000005442000-memory.dmp

            Filesize

            72KB

          • memory/4432-4323-0x0000000000970000-0x00000000009A0000-memory.dmp

            Filesize

            192KB

          • memory/4432-4324-0x0000000005250000-0x0000000005256000-memory.dmp

            Filesize

            24KB

          • memory/4432-4325-0x00000000059F0000-0x0000000006008000-memory.dmp

            Filesize

            6.1MB

          • memory/4432-4326-0x0000000005500000-0x000000000560A000-memory.dmp

            Filesize

            1.0MB

          • memory/4432-4328-0x0000000005490000-0x00000000054CC000-memory.dmp

            Filesize

            240KB

          • memory/4432-4329-0x0000000005610000-0x000000000565C000-memory.dmp

            Filesize

            304KB

          • memory/4616-47-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-25-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-67-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-65-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-63-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-61-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-59-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-57-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-55-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-53-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-49-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-73-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-45-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-43-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-41-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-39-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-37-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-33-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-31-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-29-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-27-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-69-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-23-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-21-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-2148-0x0000000004BA0000-0x0000000004BAA000-memory.dmp

            Filesize

            40KB

          • memory/4616-2150-0x0000000073DB0000-0x0000000074560000-memory.dmp

            Filesize

            7.7MB

          • memory/4616-75-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-77-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-2163-0x0000000073DB0000-0x0000000074560000-memory.dmp

            Filesize

            7.7MB

          • memory/4616-80-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-81-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-83-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-20-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-35-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-51-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-71-0x0000000004A10000-0x0000000004A61000-memory.dmp

            Filesize

            324KB

          • memory/4616-19-0x0000000073DB0000-0x0000000074560000-memory.dmp

            Filesize

            7.7MB

          • memory/4616-18-0x0000000004A10000-0x0000000004A66000-memory.dmp

            Filesize

            344KB

          • memory/4616-17-0x0000000004BC0000-0x0000000005164000-memory.dmp

            Filesize

            5.6MB

          • memory/4616-16-0x0000000073DB0000-0x0000000074560000-memory.dmp

            Filesize

            7.7MB

          • memory/4616-15-0x00000000025F0000-0x0000000002648000-memory.dmp

            Filesize

            352KB

          • memory/4616-14-0x0000000073DBE000-0x0000000073DBF000-memory.dmp

            Filesize

            4KB