Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:17

General

  • Target

    f1e96eb4fa6af56f0366127f1b80da320fe2247fdefc0bd951343ebdf9bd0d1f.exe

  • Size

    489KB

  • MD5

    92715da1c21f041b86fc01e2b99c78b7

  • SHA1

    d56fb965d9676256b02bbd7926fb80dc7c3da6b4

  • SHA256

    f1e96eb4fa6af56f0366127f1b80da320fe2247fdefc0bd951343ebdf9bd0d1f

  • SHA512

    f2b46923258186d10b5ddbbaa8dba6d9b18097d7137eb88761d03d2c8428a8c0a01d1e3d014fd4abc85de26aaade53a5afd117b937fb409bd04acd426cbb6879

  • SSDEEP

    12288:YMr6y90YjMJzUoUU5c1u31WTf7Mamxoj2nIoxkSSJ:yyBI7X8TzMamxHnV3o

Malware Config

Extracted

Family

redline

Botnet

lulsa

C2

217.196.96.101:4132

Attributes
  • auth_value

    2bb8e3870ce0ad119d2840b124222121

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1e96eb4fa6af56f0366127f1b80da320fe2247fdefc0bd951343ebdf9bd0d1f.exe
    "C:\Users\Admin\AppData\Local\Temp\f1e96eb4fa6af56f0366127f1b80da320fe2247fdefc0bd951343ebdf9bd0d1f.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0011099.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0011099.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o7268346.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o7268346.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4100
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6137304.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6137304.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4852
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:868

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0011099.exe

          Filesize

          307KB

          MD5

          06763e4230c4281042b047ccfcbaf0a8

          SHA1

          c6394855ccd190244610b03aaa680df90783a862

          SHA256

          ea95f894a0d53f68f825d0a2e744db88d9d818e3f49e5633884f3842313e3cc9

          SHA512

          b47240aa84b5fe0096028b8e0500951d3ca4bc84d23923486bcb39808285f90e3efdf81a278ffc55d53e1bf2926d506a979f1c4e37d14313401cb5802fe8758e

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o7268346.exe

          Filesize

          181KB

          MD5

          440382d1d97b4e83336a47b520050cd6

          SHA1

          18965aa83d01228806df83b9b2b3e16193e2d6f8

          SHA256

          21b2925cfc627a4d78b2a9a7798b35d4a4694741d25a46ad9cd643d02f00a63c

          SHA512

          37b9871cfa2fa0c84888bcdc2ec7487510a881ded96fb5f4f4d54e90593cd96462cf8428494f8581e0e49eadf6cc7f7b68aad5dc756338bfe560579a8d16017a

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6137304.exe

          Filesize

          168KB

          MD5

          d9a15ce2c578fc659f30592b83f9d413

          SHA1

          949bdf817c229976266b691c6782d8af7cd5f4e0

          SHA256

          1c2accd44808e80a86aba6f6aead3ab3e632bc17e36758a8f3fb5588efc7359a

          SHA512

          032b1c09d234b1e2d314354fc1052cefd9f87580976404d8c970ac9515a828024fabe223eda20a3fdb9949153dabf0f2f22c9f3eb3b827ede6e485c100c1ac37

        • memory/4100-31-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-25-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-17-0x0000000074A60000-0x0000000075210000-memory.dmp

          Filesize

          7.7MB

        • memory/4100-18-0x0000000004A20000-0x0000000004FC4000-memory.dmp

          Filesize

          5.6MB

        • memory/4100-19-0x0000000004970000-0x0000000004988000-memory.dmp

          Filesize

          96KB

        • memory/4100-47-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-45-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-43-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-41-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-39-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-37-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-35-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-33-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-15-0x0000000002120000-0x000000000213A000-memory.dmp

          Filesize

          104KB

        • memory/4100-16-0x0000000074A60000-0x0000000075210000-memory.dmp

          Filesize

          7.7MB

        • memory/4100-29-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-21-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-23-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-27-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-20-0x0000000004970000-0x0000000004982000-memory.dmp

          Filesize

          72KB

        • memory/4100-48-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

          Filesize

          4KB

        • memory/4100-49-0x0000000074A60000-0x0000000075210000-memory.dmp

          Filesize

          7.7MB

        • memory/4100-51-0x0000000074A60000-0x0000000075210000-memory.dmp

          Filesize

          7.7MB

        • memory/4100-14-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

          Filesize

          4KB

        • memory/4852-55-0x00000000009C0000-0x00000000009F0000-memory.dmp

          Filesize

          192KB

        • memory/4852-56-0x0000000002BA0000-0x0000000002BA6000-memory.dmp

          Filesize

          24KB

        • memory/4852-57-0x000000000ADE0000-0x000000000B3F8000-memory.dmp

          Filesize

          6.1MB

        • memory/4852-58-0x000000000A960000-0x000000000AA6A000-memory.dmp

          Filesize

          1.0MB

        • memory/4852-59-0x000000000A890000-0x000000000A8A2000-memory.dmp

          Filesize

          72KB

        • memory/4852-60-0x000000000A8F0000-0x000000000A92C000-memory.dmp

          Filesize

          240KB

        • memory/4852-61-0x0000000004CE0000-0x0000000004D2C000-memory.dmp

          Filesize

          304KB