Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:13

General

  • Target

    bb489493f5541d85f6db6a3994aedeb771b328771e32fd2e11bf91478e06e222.exe

  • Size

    666KB

  • MD5

    ef72dd5927435ab9770696e03f11f468

  • SHA1

    05564fe0a146b843546e161596d2865daced197b

  • SHA256

    bb489493f5541d85f6db6a3994aedeb771b328771e32fd2e11bf91478e06e222

  • SHA512

    6934624426dc19172763384897ea2bcedd729e1f11aa964f6e0f495641736582a3e8910f83be636aab0b6d7e40793271b5a8ec6d3c7db4ca2b297043b62f582e

  • SSDEEP

    12288:sMrfy902Ycb/CkbZz/4iX/ncXp4eMOClofEu1+pye4rUT7a/wSmlBlUqW:TyUcrCiZzAg9XOgo+yDriEwSmhUqW

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb489493f5541d85f6db6a3994aedeb771b328771e32fd2e11bf91478e06e222.exe
    "C:\Users\Admin\AppData\Local\Temp\bb489493f5541d85f6db6a3994aedeb771b328771e32fd2e11bf91478e06e222.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3660
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un625649.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un625649.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7030.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7030.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2416
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 1080
          4⤵
          • Program crash
          PID:3568
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7687.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7687.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:648
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2416 -ip 2416
    1⤵
      PID:3456

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un625649.exe

            Filesize

            524KB

            MD5

            07e5654e52af9e4b22f27cd2907441da

            SHA1

            6179fac37d84e0c0e7bb8faf8bca6c42675d1422

            SHA256

            eed7a271da921fb20df168191b36b3a5245c0fef3d264c897a946483f563b869

            SHA512

            1be3708c0c60ad7815bfb84239fb7c54b6c772faeb21e4e55bf562aec2f032720fa5b6d2b69bdbb6738e9f114a664eb110a3068fb2a7b38ec9ce64ca7a9ce775

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7030.exe

            Filesize

            294KB

            MD5

            376a5d2bfc0ba711d61c860f4a4b9124

            SHA1

            475468643ba679c7c3571382f0742b88aaedd576

            SHA256

            0df1acc4e2bbf5aa83fb4e4d742ad281f53a5a7647393c459a2310f2dff5b645

            SHA512

            daa9e6d1ae5bb07d07f39d765fbb1a48a71eb42e1029da8e445acc34750b2e81867dffb0f7d5a54e874b604fac14d90d559a92aa8ce64ad37c1dc661147df438

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7687.exe

            Filesize

            352KB

            MD5

            634712a262ed7d0c4aa0e1895fd73f30

            SHA1

            9a775983ae3f1f29f649b5c859a8a3cc2d8e4c9d

            SHA256

            2b537eb1c492ed896675dcf0e635844deab333aa64016e7c76bd5e2ca77ab88a

            SHA512

            dc56eb5d7c656ec6c9f4be964aa24e906cebc4fa9a99a42b7e613b8c93b5a19ff4138c7b80c7e07725998a763820428b78a1cb6af2ed8e09c5ba56c991a297c4

          • memory/648-73-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-79-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-969-0x0000000005BA0000-0x0000000005CAA000-memory.dmp

            Filesize

            1.0MB

          • memory/648-968-0x0000000005580000-0x0000000005B98000-memory.dmp

            Filesize

            6.1MB

          • memory/648-62-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-63-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-95-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-65-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-67-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-71-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-971-0x0000000004F50000-0x0000000004F8C000-memory.dmp

            Filesize

            240KB

          • memory/648-972-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

            Filesize

            304KB

          • memory/648-77-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-970-0x0000000004F30000-0x0000000004F42000-memory.dmp

            Filesize

            72KB

          • memory/648-81-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-84-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-85-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-87-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-89-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-91-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-93-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-75-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-69-0x0000000004E20000-0x0000000004E5F000-memory.dmp

            Filesize

            252KB

          • memory/648-61-0x0000000004E20000-0x0000000004E64000-memory.dmp

            Filesize

            272KB

          • memory/648-60-0x00000000026F0000-0x0000000002736000-memory.dmp

            Filesize

            280KB

          • memory/2416-43-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-55-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2416-54-0x0000000000400000-0x00000000007FE000-memory.dmp

            Filesize

            4.0MB

          • memory/2416-51-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2416-50-0x00000000008C0000-0x00000000009C0000-memory.dmp

            Filesize

            1024KB

          • memory/2416-23-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-25-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-27-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-29-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-31-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-33-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-35-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-37-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-39-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-41-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-45-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-47-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-49-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-22-0x0000000002680000-0x0000000002692000-memory.dmp

            Filesize

            72KB

          • memory/2416-21-0x0000000002680000-0x0000000002698000-memory.dmp

            Filesize

            96KB

          • memory/2416-20-0x0000000004F90000-0x0000000005534000-memory.dmp

            Filesize

            5.6MB

          • memory/2416-19-0x0000000002580000-0x000000000259A000-memory.dmp

            Filesize

            104KB

          • memory/2416-18-0x0000000000400000-0x00000000007FE000-memory.dmp

            Filesize

            4.0MB

          • memory/2416-16-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2416-17-0x0000000000400000-0x00000000007FE000-memory.dmp

            Filesize

            4.0MB

          • memory/2416-15-0x00000000008C0000-0x00000000009C0000-memory.dmp

            Filesize

            1024KB