Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:05

General

  • Target

    fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe

  • Size

    1.1MB

  • MD5

    7eced8064be89fccbcb7543e44e478b9

  • SHA1

    05b4486b4b6638b0e1c4b34b51c667738cea1f55

  • SHA256

    fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae

  • SHA512

    8031796340b87a923d82565fdc2de3f6d0337c82afcd54e6b8e8721b213b558bdb0d124ff1aa32d00d08b069cd9406d04727eba0840aca3e5b7a1197eb59a0b7

  • SSDEEP

    24576:ByCpVp8OSuqX+EZXVhYUayKbSZs4NCQBE1bIiYT/AfHtg+:0qH8OeX+Ev/OGZBNlEhtHt

Malware Config

Extracted

Family

redline

Botnet

ramon

C2

193.233.20.23:4123

Attributes
  • auth_value

    3197576965d9513f115338c233015b40

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe
    "C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4756
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3288
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3000
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4796

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe

          Filesize

          959KB

          MD5

          ea82f09c3a065083098c07d71c4e2b0e

          SHA1

          893096fde688c579bf20bd9b44c15f92baa77578

          SHA256

          0dbb4ffa238d218540bd524e5ea3709c138e8dc05a931e48c96ed7f74a6d3f5c

          SHA512

          7fd91fcdedd400619478009270aa2c4a9c6b480c946a765d62f4a3e03bfb61e39c6ed69312cecd5d37903ce3a25fab4f3dce55692ad28926697daa77b9dcba55

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe

          Filesize

          682KB

          MD5

          75c4c78128b3b41822c8b02c2b4937a8

          SHA1

          da93343b6b705a133a571e789efa5bb054a6086e

          SHA256

          4939acc5788245a8f4f001a13359fca9cfb84a496679cb2afb12e757e5a16cd1

          SHA512

          d6fb99399f62a63df2bce2e6d5ca27e73e849b1ef35689b047f31efda89d80ed417a22c26c4e1283f97e16f469b45b4d3bb80de5f15a802ee5314f2565bf60b9

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe

          Filesize

          399KB

          MD5

          b5ce76fc9be5b780f077b7caba6fe07c

          SHA1

          fe77d7bbafe9fa25b636ea50892da8230eccd934

          SHA256

          26856aab26df5d4128338f18c8d5e68524d904d12d61c5412ac94aeb0c7dc07b

          SHA512

          c953cd90f9f792fb3dfd6e000fdce7df6b45f26eb7819b87a3a665fd7f832bd15b3b3e5806b35f8cc9fe551c831a30f2b688d1a3cb95a7f11a8a4193e3cb667a

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe

          Filesize

          11KB

          MD5

          9df47b120c7025ec8ffdc3338bf3371a

          SHA1

          18c9a5590d838f935ea38598118558686094db80

          SHA256

          cc881b7786c962ef44b2394705f24fbf1f7964505b2d3322a522a62d838ff829

          SHA512

          a70ea602160af906fa5958b9d01ee0ddd93bda62c8f5c1ec2632471561df5290ecd8f428f0b3c87bb2fa8a5546bd9e2e5200faa708d62a3ee36df69390227dc4

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe

          Filesize

          374KB

          MD5

          ce6ca2dd2700dbacf6ba786698d5a344

          SHA1

          d257c23286fd31ed96f02d6ed2bbc6336c9d7ccf

          SHA256

          a063bd961d53854a4d95d2293c614f9bd9f0b50352a8f5304e56fa1f7e1824c3

          SHA512

          1887d1b1f1c601c2d939b79732d4d2fc4d1f4f886eb619f6cb9f6cca25d70a5d7f0d1b99e715822f5aad0d17a14cabac02ec11f2e3d38e871e8c55d587759bde

        • memory/3000-28-0x0000000000F30000-0x0000000000F3A000-memory.dmp

          Filesize

          40KB

        • memory/4796-82-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-72-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-36-0x0000000004EB0000-0x0000000004EF4000-memory.dmp

          Filesize

          272KB

        • memory/4796-38-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-40-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-96-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-84-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-54-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-37-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-100-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-98-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-94-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-92-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-90-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-88-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-86-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-34-0x0000000004CD0000-0x0000000004D16000-memory.dmp

          Filesize

          280KB

        • memory/4796-81-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-78-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-77-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-74-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-35-0x0000000007550000-0x0000000007AF4000-memory.dmp

          Filesize

          5.6MB

        • memory/4796-71-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-68-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-66-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-64-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-62-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-60-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-58-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-56-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-52-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-50-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-48-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-46-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-44-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-42-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

          Filesize

          248KB

        • memory/4796-943-0x0000000007B00000-0x0000000008118000-memory.dmp

          Filesize

          6.1MB

        • memory/4796-944-0x0000000007400000-0x000000000750A000-memory.dmp

          Filesize

          1.0MB

        • memory/4796-945-0x0000000008120000-0x0000000008132000-memory.dmp

          Filesize

          72KB

        • memory/4796-946-0x0000000008140000-0x000000000817C000-memory.dmp

          Filesize

          240KB

        • memory/4796-947-0x0000000008290000-0x00000000082DC000-memory.dmp

          Filesize

          304KB