Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 06:05

General

  • Target

    455f2a035fe625508f42a80dbfe70e176f934ee3aee4d3217e92c3611c632fb3.exe

  • Size

    687KB

  • MD5

    e6c787b3b118bc67f94a7ce4d0f8741a

  • SHA1

    45dfb9ca9ae71a771968ca8d6071822f0e96eef8

  • SHA256

    455f2a035fe625508f42a80dbfe70e176f934ee3aee4d3217e92c3611c632fb3

  • SHA512

    36a71af602e8204d010cdd7cafc4891dc982ba7d4f68af8b7e8957fa44754e38991a8034c7fbfa9136b3a7c71f6e37816a7b1f00a1cc5a80f98714bfc9482d4b

  • SSDEEP

    12288:RMrKy90BLO4jVk2+u9GmC75pLtPpCe8FOZTx9qO/qT7iVBPs6t3reK7VYCzZl95:jyeS4nwmC75JftjJqvikwn7VYCh5

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\455f2a035fe625508f42a80dbfe70e176f934ee3aee4d3217e92c3611c632fb3.exe
    "C:\Users\Admin\AppData\Local\Temp\455f2a035fe625508f42a80dbfe70e176f934ee3aee4d3217e92c3611c632fb3.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un727892.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un727892.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5940.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5940.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3932
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 1084
          4⤵
          • Program crash
          PID:2176
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1103.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1103.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3932 -ip 3932
    1⤵
      PID:2704
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:5428

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un727892.exe

            Filesize

            545KB

            MD5

            3112b78ddb90d640fd2c5cd42692c217

            SHA1

            cf0b905dad9021b266259196b28f9372d82a7d92

            SHA256

            81ff70ce4a7eceae84de26cddbb79e2968c39d3036392f80d7620d38bbd6b2fc

            SHA512

            b1b4cb0fac539fe87370314ce753ef9de8df5d52610c012f45688e7be041de934dfde79dc10b6818827eedccc4a2cbfcd497ab221b902f5af5bed660d74b78d3

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5940.exe

            Filesize

            324KB

            MD5

            12283bd19a29672b70ab4b5aaa7fa45b

            SHA1

            6b7f61f53e65462377c49877d39caa331e792975

            SHA256

            1b96eedabbbd447cebd379ba46ef41a7c4cc7ca28bbe404bc84e1cb5f7798c14

            SHA512

            d428bb47c414ba4e67e1e0e7df666fedbee79a03dae84408a3b23b056f99b10f832d2fa7db2b5feb0e140fbcc3123260f6b935cf1c5eb2ffd0a16e75341b62d1

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1103.exe

            Filesize

            383KB

            MD5

            a247649d8cb2268901226c0dc986c962

            SHA1

            6bd60ae0b971cab1ffb3cec1b8d765498e89b960

            SHA256

            9badb50837bd90a4a857b50fe1607d3d1da3d26abbe6f6ee361996c8e9b69b1b

            SHA512

            49ef05cca300b03ab94bbc8ddd3f590152b5418e8a7a6dec4da58f9c6f3b123eb4f40d8f7c02b8a9649c154447ca091ed047cb51800981838be79a86f2146057

          • memory/3932-15-0x0000000002C40000-0x0000000002D40000-memory.dmp

            Filesize

            1024KB

          • memory/3932-16-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3932-17-0x0000000004A40000-0x0000000004A5A000-memory.dmp

            Filesize

            104KB

          • memory/3932-18-0x00000000071B0000-0x0000000007754000-memory.dmp

            Filesize

            5.6MB

          • memory/3932-19-0x0000000007110000-0x0000000007128000-memory.dmp

            Filesize

            96KB

          • memory/3932-20-0x0000000000400000-0x0000000002B7E000-memory.dmp

            Filesize

            39.5MB

          • memory/3932-48-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-46-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-44-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-42-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-40-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-38-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-36-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-34-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-32-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-30-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-28-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-26-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-24-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-22-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-21-0x0000000007110000-0x0000000007122000-memory.dmp

            Filesize

            72KB

          • memory/3932-49-0x0000000002C40000-0x0000000002D40000-memory.dmp

            Filesize

            1024KB

          • memory/3932-51-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3932-50-0x0000000000400000-0x0000000002B7E000-memory.dmp

            Filesize

            39.5MB

          • memory/3932-53-0x0000000000400000-0x0000000002B7E000-memory.dmp

            Filesize

            39.5MB

          • memory/3932-54-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/4796-59-0x00000000070C0000-0x0000000007106000-memory.dmp

            Filesize

            280KB

          • memory/4796-60-0x0000000007180000-0x00000000071C4000-memory.dmp

            Filesize

            272KB

          • memory/4796-61-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-64-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-62-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-94-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-92-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-90-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-88-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-86-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-84-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-82-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-80-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-78-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-76-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-74-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-72-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-70-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-68-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-66-0x0000000007180000-0x00000000071BF000-memory.dmp

            Filesize

            252KB

          • memory/4796-967-0x00000000077D0000-0x0000000007DE8000-memory.dmp

            Filesize

            6.1MB

          • memory/4796-968-0x0000000007E60000-0x0000000007F6A000-memory.dmp

            Filesize

            1.0MB

          • memory/4796-969-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

            Filesize

            72KB

          • memory/4796-970-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

            Filesize

            240KB

          • memory/4796-971-0x0000000008110000-0x000000000815C000-memory.dmp

            Filesize

            304KB