Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:15

General

  • Target

    b1ef8a77390c2929441e4b5097c912759da99e15f1bf48d790ca8f0db819b5b2.exe

  • Size

    787KB

  • MD5

    e924881cd5d269936034a331a10960c6

  • SHA1

    5b3bb1c2502bb073b726a9e8e8e250f96ee1aaaf

  • SHA256

    b1ef8a77390c2929441e4b5097c912759da99e15f1bf48d790ca8f0db819b5b2

  • SHA512

    1e1ece4a9812585eec9fcea91808f06d21dc789145bf41794169d16fef91ab5245eea96e285117ee373746454fbe8b97ad73d7f21bead6caa1cd62f97fd9522a

  • SSDEEP

    12288:5Mrgy90dfl633DFc6Q3dlvJuRZKDAk9j3fY1ldFiwa9VaS:NyCd6HSX3dlvJwZuAKj3fEgwaDaS

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1ef8a77390c2929441e4b5097c912759da99e15f1bf48d790ca8f0db819b5b2.exe
    "C:\Users\Admin\AppData\Local\Temp\b1ef8a77390c2929441e4b5097c912759da99e15f1bf48d790ca8f0db819b5b2.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:372
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un795890.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un795890.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3715.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3715.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1376
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1004
          4⤵
          • Program crash
          PID:2100
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3408.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3408.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1424
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5672
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 1544
          4⤵
          • Program crash
          PID:5784
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si501416.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si501416.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5856
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1376 -ip 1376
    1⤵
      PID:3488
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1424 -ip 1424
      1⤵
        PID:5712

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si501416.exe

              Filesize

              168KB

              MD5

              effd9088e5a4c0915673ebdd00d85e7d

              SHA1

              412f90d32c89e8193371c4c04a0fc273a8b77574

              SHA256

              cad8e1a21485522122095ddabcb37e694c968449c5813f92ffa634f8bccbd47b

              SHA512

              584ad7bb23c1a9f423d737978c787f376d4ca2a3f9fadd39a660603f0e624b3b4d0f1734f5e27f06d3e99188634bbfba454ce43e813ed829fd2518e360573c96

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un795890.exe

              Filesize

              633KB

              MD5

              60abf9e419721a7682fc787f34db8b7f

              SHA1

              4a74f6f9b4623920ba2dfe7ce5cb80445e4e4a86

              SHA256

              da82603941288fe57a69499c4e06655e3ca7be494b41915cdc5714bdcb86810d

              SHA512

              64013c6247d4b1d1a9e5c89f73ac67ad58a99490ee94ab075a722e4d201727936d8cf802eab32608e0237c009d59838082bd79a4e6414ee3f013518c3a170d3e

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3715.exe

              Filesize

              230KB

              MD5

              ae4d5c598d757fc26e0924f6c8727c76

              SHA1

              451c2eb8671db4729af05de661f582965c88d810

              SHA256

              07d883fb6aa30562ab9d0503bdbd91e6bf91872eae45e18ed868664a4659446d

              SHA512

              d8448ba5e462cffb669d1c152ec2e345848a5251a48c8dd7f3b388e6d2078194a2f0f145de26097e9effed6cafc80f011684cb788ecceea0c2753072eb43d0ee

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3408.exe

              Filesize

              414KB

              MD5

              2a87622297c16d63a425839e53cfc29b

              SHA1

              2bf35e9f7c2c50699dc7d7da98714478a895c2c6

              SHA256

              30ef6bac870ed2a351aa857702c6555d415f844d346c933a2f32e3b5cb227385

              SHA512

              fe08bdb42ad71d499bff95eff886dedacaee0f483282526455ae37cff331607e09754cb0e02ac78069cf9e010201febcd8adf7d6275b433c7ea0b6a8d5f079ee

            • C:\Windows\Temp\1.exe

              Filesize

              168KB

              MD5

              1073b2e7f778788852d3f7bb79929882

              SHA1

              7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

              SHA256

              c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

              SHA512

              90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

            • memory/1376-15-0x00000000007C0000-0x00000000008C0000-memory.dmp

              Filesize

              1024KB

            • memory/1376-16-0x0000000000580000-0x00000000005AD000-memory.dmp

              Filesize

              180KB

            • memory/1376-17-0x0000000000400000-0x0000000000430000-memory.dmp

              Filesize

              192KB

            • memory/1376-18-0x0000000000400000-0x00000000004A8000-memory.dmp

              Filesize

              672KB

            • memory/1376-19-0x00000000007A0000-0x00000000007BA000-memory.dmp

              Filesize

              104KB

            • memory/1376-20-0x0000000004B10000-0x00000000050B4000-memory.dmp

              Filesize

              5.6MB

            • memory/1376-21-0x0000000002340000-0x0000000002358000-memory.dmp

              Filesize

              96KB

            • memory/1376-33-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-47-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-45-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-43-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-41-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-39-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-37-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-35-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-31-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-49-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-27-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-25-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-23-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-22-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-29-0x0000000002340000-0x0000000002352000-memory.dmp

              Filesize

              72KB

            • memory/1376-50-0x00000000007C0000-0x00000000008C0000-memory.dmp

              Filesize

              1024KB

            • memory/1376-51-0x0000000000580000-0x00000000005AD000-memory.dmp

              Filesize

              180KB

            • memory/1376-52-0x0000000000400000-0x0000000000430000-memory.dmp

              Filesize

              192KB

            • memory/1376-55-0x0000000000400000-0x00000000004A8000-memory.dmp

              Filesize

              672KB

            • memory/1376-56-0x0000000000400000-0x0000000000430000-memory.dmp

              Filesize

              192KB

            • memory/1424-61-0x0000000002400000-0x0000000002466000-memory.dmp

              Filesize

              408KB

            • memory/1424-62-0x00000000025D0000-0x0000000002636000-memory.dmp

              Filesize

              408KB

            • memory/1424-64-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-74-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-96-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-94-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-92-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-90-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-88-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-86-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-84-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-82-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-78-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-76-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-72-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-70-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-68-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-66-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-80-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-63-0x00000000025D0000-0x000000000262F000-memory.dmp

              Filesize

              380KB

            • memory/1424-2143-0x0000000004CF0000-0x0000000004D22000-memory.dmp

              Filesize

              200KB

            • memory/5672-2156-0x0000000000B60000-0x0000000000B90000-memory.dmp

              Filesize

              192KB

            • memory/5672-2157-0x0000000005340000-0x0000000005346000-memory.dmp

              Filesize

              24KB

            • memory/5672-2158-0x0000000005AC0000-0x00000000060D8000-memory.dmp

              Filesize

              6.1MB

            • memory/5672-2159-0x00000000055B0000-0x00000000056BA000-memory.dmp

              Filesize

              1.0MB

            • memory/5672-2160-0x00000000054E0000-0x00000000054F2000-memory.dmp

              Filesize

              72KB

            • memory/5672-2161-0x0000000005540000-0x000000000557C000-memory.dmp

              Filesize

              240KB

            • memory/5672-2162-0x00000000056C0000-0x000000000570C000-memory.dmp

              Filesize

              304KB

            • memory/5856-2167-0x00000000000C0000-0x00000000000EE000-memory.dmp

              Filesize

              184KB

            • memory/5856-2168-0x00000000049E0000-0x00000000049E6000-memory.dmp

              Filesize

              24KB