Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:11

General

  • Target

    96f270fcf9c22d1df331e9f459ea5262964841786bb25aa7fd111885998347e9.exe

  • Size

    923KB

  • MD5

    ce1b323889e147d55b52560df82a8590

  • SHA1

    179ea2a6a6ef4a7dd1f86c9a6ce2da63862aebc2

  • SHA256

    96f270fcf9c22d1df331e9f459ea5262964841786bb25aa7fd111885998347e9

  • SHA512

    5f6aec0ce25affab4d96d214111c856e19ea420d6f827e6a1fd415e037a2fe7bfdded7ebabdea2032cac93c3a6b20adb56f4eb9d5f08d28110a8c9fc2089f9b8

  • SSDEEP

    24576:IyFFoz7u17SvbRJ41a4GvUIjLALgrh+u+nOoGikc:PgIo4EJFwgr4u+nOB

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

dezik

C2

77.91.124.145:4125

Attributes
  • auth_value

    afab3a79f84bd5003ef2824211bcf14e

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96f270fcf9c22d1df331e9f459ea5262964841786bb25aa7fd111885998347e9.exe
    "C:\Users\Admin\AppData\Local\Temp\96f270fcf9c22d1df331e9f459ea5262964841786bb25aa7fd111885998347e9.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKW1252.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKW1252.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3480
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziWW2239.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziWW2239.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it781127.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it781127.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4604
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr930471.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr930471.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4852
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3476
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1380
            5⤵
            • Program crash
            PID:4880
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp404542.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp404542.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5088
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4852 -ip 4852
    1⤵
      PID:2480

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKW1252.exe

            Filesize

            659KB

            MD5

            76a43f10b0617f77e09540b338bfeb77

            SHA1

            a9eec2aa4a9f6320336ccdfaa55388c7e6184159

            SHA256

            bdc9d1e700b5690e2e737d05d1619b38141245f86acfc73d55e6a52f00172cd1

            SHA512

            82ddc904ba7121a922377b9151e9d041af046b4f4ddd0d0db8f72a0a0346e8bb270da73fe86eb5ce3688feee5eaf1ee22e50ae223fdde3cd9248f932a45efa91

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp404542.exe

            Filesize

            168KB

            MD5

            c5ab4a92d7b28c9e63598bf2eeade8e2

            SHA1

            e436d4127b8b2ab606d9815543b0d13c5d3b9c83

            SHA256

            9fdf95fef12de09adfacb495304be004bdd286c24f5c65e4b476a9b77e3d16fb

            SHA512

            ebab87641725b6d1849969abce588c4e6d957da11492b24bd37ca88ca9f010cd53d054116ce67a46cc6f82622f99779a4bbfbd28c9b62eb545396ab56372cf86

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziWW2239.exe

            Filesize

            506KB

            MD5

            104bf092be7ac9152795f90bd1c7aa6e

            SHA1

            0e8a80030e18fc2f3080184bdb89f5424e8ddb0e

            SHA256

            79cbbc47a254fbb8669bd668a657e5ce9f18424fc072f1b40cf7aa2db6c2ef72

            SHA512

            1c5c6a62bfdc6f4c9ea609692954b6106944681360c23164f6a73a81035a860f7283353212130b24a93079ade869c9a072b2d92d161d745358f3acd87276cd1c

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it781127.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr930471.exe

            Filesize

            419KB

            MD5

            a19b886f1a83d96a208b17efc16a50d7

            SHA1

            cd61596f3edaadc58d98a26cbea4a275546faa74

            SHA256

            e85b9ad64066c4d668bdabdd5295e26c376248cc2f4a67e9b9b17dd08654431e

            SHA512

            b7b84c590e09186ed663fdeaba720d63bc09ffa624f4d2ee3c58eb773834f6f70fb96de89295d5093d8099a73b9737ed20b78456f35c71109ff00aa74f22b671

          • C:\Windows\Temp\1.exe

            Filesize

            168KB

            MD5

            1073b2e7f778788852d3f7bb79929882

            SHA1

            7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

            SHA256

            c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

            SHA512

            90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

          • memory/3476-2131-0x0000000005640000-0x000000000568C000-memory.dmp

            Filesize

            304KB

          • memory/3476-2127-0x0000000005A40000-0x0000000006058000-memory.dmp

            Filesize

            6.1MB

          • memory/3476-2126-0x00000000014C0000-0x00000000014C6000-memory.dmp

            Filesize

            24KB

          • memory/3476-2125-0x0000000000AD0000-0x0000000000B00000-memory.dmp

            Filesize

            192KB

          • memory/3476-2130-0x00000000054A0000-0x00000000054DC000-memory.dmp

            Filesize

            240KB

          • memory/3476-2129-0x0000000005440000-0x0000000005452000-memory.dmp

            Filesize

            72KB

          • memory/3476-2128-0x0000000005530000-0x000000000563A000-memory.dmp

            Filesize

            1.0MB

          • memory/4604-21-0x00007FFEBC2D3000-0x00007FFEBC2D5000-memory.dmp

            Filesize

            8KB

          • memory/4604-22-0x0000000000090000-0x000000000009A000-memory.dmp

            Filesize

            40KB

          • memory/4604-23-0x00007FFEBC2D3000-0x00007FFEBC2D5000-memory.dmp

            Filesize

            8KB

          • memory/4852-79-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-57-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-71-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-95-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-93-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-89-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-87-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-85-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-83-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-81-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-33-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-77-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-75-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-69-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-67-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-65-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-63-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-61-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-59-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-32-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-55-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-53-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-51-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-49-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-47-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-45-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-41-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-39-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-35-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-43-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-31-0x0000000005300000-0x0000000005366000-memory.dmp

            Filesize

            408KB

          • memory/4852-30-0x0000000004D10000-0x00000000052B4000-memory.dmp

            Filesize

            5.6MB

          • memory/4852-29-0x00000000024A0000-0x0000000002506000-memory.dmp

            Filesize

            408KB

          • memory/4852-37-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-91-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-73-0x0000000005300000-0x000000000535F000-memory.dmp

            Filesize

            380KB

          • memory/4852-2112-0x0000000005530000-0x0000000005562000-memory.dmp

            Filesize

            200KB

          • memory/5088-2136-0x0000000000470000-0x000000000049E000-memory.dmp

            Filesize

            184KB

          • memory/5088-2137-0x00000000024C0000-0x00000000024C6000-memory.dmp

            Filesize

            24KB