Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:03

General

  • Target

    8bbaa36dd1b3b7298167c143d285e319b886adac33ea0d0c9c8156d836d0224e.exe

  • Size

    481KB

  • MD5

    98c8595ece67bbabbf4f48b590ef5022

  • SHA1

    620fedcd3d3f8f9a6b063e728410ed57d13e48b6

  • SHA256

    8bbaa36dd1b3b7298167c143d285e319b886adac33ea0d0c9c8156d836d0224e

  • SHA512

    fb9d514c6b80287230c79fcae816fdf9b183f22516b2258d7123b0374e61d6077df47a72f7e90b650630dcc97cbc5388e338027d08aa7085e197615019baa846

  • SSDEEP

    12288:7Mrby90ZTTU1dn5zK96HgDSAdtNcg0XOsVo:MyM8pADSev0+sVo

Malware Config

Extracted

Family

redline

Botnet

misfa

C2

217.196.96.101:4132

Attributes
  • auth_value

    be2e6d9f1a5e54a81340947b20e561c1

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bbaa36dd1b3b7298167c143d285e319b886adac33ea0d0c9c8156d836d0224e.exe
    "C:\Users\Admin\AppData\Local\Temp\8bbaa36dd1b3b7298167c143d285e319b886adac33ea0d0c9c8156d836d0224e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0945503.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0945503.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5569309.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5569309.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4600
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3926594.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3926594.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3304

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0945503.exe

          Filesize

          309KB

          MD5

          29fff0ddc29923dcaed6c3583f191011

          SHA1

          fb97079be80def69d388c4f82e48c009584d09ac

          SHA256

          4ab5875b4605ffe4c65a0c70da4588e10668c26a213617f6b46d304ede12f911

          SHA512

          3ee6116d30e5ea719b2ff6a3bf41edf6524b254261e7ffc422f2b20c55e33b8bfcdf25c782fc5d6f40f4f2c4dcef8b7d28591cf4308ce4d934818634073087ee

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5569309.exe

          Filesize

          177KB

          MD5

          8b8dfdc32650ccedf8224311f7a5a4bd

          SHA1

          589e705b77abc103366a29aed8d9a889fe7102f7

          SHA256

          ba01134ca6f1a08bd8aecc1d39602df2222c32f9573a45a201816aef167f3ba4

          SHA512

          389e4f1e3457b814aff95ff4117e22cf7d0ff53e1d9d272ebc5afbd5ba322d86abf514f98f225d3c7240713687f7490057219f06c01d6e1ba9ff857f868b1c96

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3926594.exe

          Filesize

          168KB

          MD5

          4c6de1b3b1272da63915c9c604076ebc

          SHA1

          ed3f175d95122f7b319f5acb899cdce0d11ed8e4

          SHA256

          e1678c4cc6d400fb193390b0a52505e6a32c88cbdc9b3e2194768332b893940c

          SHA512

          75d494d854fc19b0f156b25ef89fe3e0b3f421f7dfa47be498352a5e7532ba5f03df1ab369bf7d2ce7acbc0f32508a9cf711235b4a46856cafe07c6474de6f21

        • memory/3304-62-0x0000000004DB0000-0x0000000004DFC000-memory.dmp

          Filesize

          304KB

        • memory/3304-61-0x0000000004C20000-0x0000000004C5C000-memory.dmp

          Filesize

          240KB

        • memory/3304-60-0x0000000004C00000-0x0000000004C12000-memory.dmp

          Filesize

          72KB

        • memory/3304-59-0x0000000004EC0000-0x0000000004FCA000-memory.dmp

          Filesize

          1.0MB

        • memory/3304-58-0x00000000053D0000-0x00000000059E8000-memory.dmp

          Filesize

          6.1MB

        • memory/3304-57-0x0000000002520000-0x0000000002526000-memory.dmp

          Filesize

          24KB

        • memory/3304-56-0x0000000000380000-0x00000000003AE000-memory.dmp

          Filesize

          184KB

        • memory/4600-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-48-0x0000000073D50000-0x0000000074500000-memory.dmp

          Filesize

          7.7MB

        • memory/4600-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-19-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-47-0x0000000073D50000-0x0000000074500000-memory.dmp

          Filesize

          7.7MB

        • memory/4600-41-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-49-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

          Filesize

          4KB

        • memory/4600-50-0x0000000073D50000-0x0000000074500000-memory.dmp

          Filesize

          7.7MB

        • memory/4600-52-0x0000000073D50000-0x0000000074500000-memory.dmp

          Filesize

          7.7MB

        • memory/4600-45-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4600-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

          Filesize

          96KB

        • memory/4600-17-0x0000000004C50000-0x00000000051F4000-memory.dmp

          Filesize

          5.6MB

        • memory/4600-16-0x0000000073D50000-0x0000000074500000-memory.dmp

          Filesize

          7.7MB

        • memory/4600-15-0x00000000025A0000-0x00000000025BA000-memory.dmp

          Filesize

          104KB

        • memory/4600-14-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

          Filesize

          4KB