Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:57

General

  • Target

    91504a59ef479454ea26990f2aa5c0156be1c10e432106d10514708aca1c0744.exe

  • Size

    525KB

  • MD5

    c946f07b336a628311104730c222c80a

  • SHA1

    12d14d61e6c3936d420f49cde99f0940c69a182f

  • SHA256

    91504a59ef479454ea26990f2aa5c0156be1c10e432106d10514708aca1c0744

  • SHA512

    8619aefc72339af4337d37b5851c6319e9967122b1a53ae4c5f0e2a0166435845bba275a8df30dc7fdf3229cf94a39ece71e819dff683f781bae9915cb5a3408

  • SSDEEP

    12288:tMrjy90/rCYCVYTvH2WkJAZdYxXeKTdA:yyHYzNkAKTG

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes
  • auth_value

    cddc991efd6918ad5321d80dac884b40

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91504a59ef479454ea26990f2aa5c0156be1c10e432106d10514708aca1c0744.exe
    "C:\Users\Admin\AppData\Local\Temp\91504a59ef479454ea26990f2aa5c0156be1c10e432106d10514708aca1c0744.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhkU1577jU.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhkU1577jU.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf16vQ43XI77.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf16vQ43XI77.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4212
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf50hv82Az26.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf50hv82Az26.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:576

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhkU1577jU.exe

          Filesize

          380KB

          MD5

          43def2f0da0abae6e6e253d8bdef0230

          SHA1

          8fcfc12f63b43041f932774c5369eff8eb70e291

          SHA256

          ecdc2e88bb2a0de26883466ba993c82ad091d6981cd605b3c9298b02d5844cbf

          SHA512

          081973d4a671a97c9477688930a0948b02c5f4f6a21662407fdcfcafadb2e0e5f204d3434cdb6edf87f3a76726ae7132d32b5fb86968842ba136fa4b64620347

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf16vQ43XI77.exe

          Filesize

          12KB

          MD5

          1a4f6ea8f6c717ff0fa970e6e06a89a6

          SHA1

          69d1ea6ced42ac42351468bc8db53363b77ea5bb

          SHA256

          fdd98c5016bb7de3f23ac9b7f01556a96d44f5890f7d60c3ae59be77b23926b5

          SHA512

          f68e63061e9e4d56063f4a5095ff6d5c8a5c2f76d187bb7d96f70301339d7db076f25297ba74b3776699a66c13671ab9cdad5ed0ce2ee335b2dda551dede6702

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf50hv82Az26.exe

          Filesize

          291KB

          MD5

          434e2d5a4767741895ef183a448da368

          SHA1

          1e1d795ae169d4068d8da31d1aa89027804a21a3

          SHA256

          ad32f3b0b1f7b775e4235d6969f27886cc2fafeeb1bd02853fde41ddee1db27a

          SHA512

          e50de394d28557d67ae62bba669dacf8afcc1c925cfd04dcbf07f14ff2c7939579d12337cc8ed822c82bdfcbfcd1114289eede2411113a17c8f92485a15e50f0

        • memory/576-68-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-38-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-935-0x0000000005B30000-0x0000000005B7C000-memory.dmp

          Filesize

          304KB

        • memory/576-22-0x00000000049A0000-0x00000000049E6000-memory.dmp

          Filesize

          280KB

        • memory/576-23-0x0000000004AC0000-0x0000000005064000-memory.dmp

          Filesize

          5.6MB

        • memory/576-24-0x0000000004A40000-0x0000000004A84000-memory.dmp

          Filesize

          272KB

        • memory/576-30-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-28-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-26-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-25-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-40-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-88-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-84-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-82-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-80-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-78-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-76-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-72-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-70-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-934-0x00000000059E0000-0x0000000005A1C000-memory.dmp

          Filesize

          240KB

        • memory/576-60-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-933-0x00000000059C0000-0x00000000059D2000-memory.dmp

          Filesize

          72KB

        • memory/576-65-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-59-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-56-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-54-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-52-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-50-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-48-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-46-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-44-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-66-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-36-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-34-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-32-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-86-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-74-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-63-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-42-0x0000000004A40000-0x0000000004A7E000-memory.dmp

          Filesize

          248KB

        • memory/576-931-0x00000000051E0000-0x00000000057F8000-memory.dmp

          Filesize

          6.1MB

        • memory/576-932-0x0000000005880000-0x000000000598A000-memory.dmp

          Filesize

          1.0MB

        • memory/4212-16-0x00007FFE0C3C3000-0x00007FFE0C3C5000-memory.dmp

          Filesize

          8KB

        • memory/4212-14-0x00007FFE0C3C3000-0x00007FFE0C3C5000-memory.dmp

          Filesize

          8KB

        • memory/4212-15-0x0000000000420000-0x000000000042A000-memory.dmp

          Filesize

          40KB