Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 06:06

General

  • Target

    43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe

  • Size

    713KB

  • MD5

    fdd495aa140c9585374c84a70a9699ff

  • SHA1

    7dc4d87c575d03672e840bb44893c8489dd4d463

  • SHA256

    43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c

  • SHA512

    c5b8710c922d3633a4d25fe117034418360df8e71177ba3436a53523c59c9cecc29179e942915e30290aa203c60beb8d649e0b5ee54b7338d24e5235288d06a0

  • SSDEEP

    12288:38oWJCJY3DCEhwEiaYJVx4rdv1GV5uREe6TFgpEAMSgQ6nC8DEsLRhjKWYIBoFi:32oYGEhGa6VxUdtGrKEcAFQ6RRlBBoM

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 34 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe
    "C:\Users\Admin\AppData\Local\Temp\43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2740
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2752

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exe

          Filesize

          407KB

          MD5

          cabb3463f51c332c467c2ff736fe05bb

          SHA1

          aadc455ffed9978efd77f729064bb0d4b178f595

          SHA256

          4fad65b6cabba38e0ec7b35cd8a81c916f5d73b24e5428a2107e115a1daad86d

          SHA512

          b4146c8234fdfcbf3fdceee02951896dc408f98ffc93a255239e1e6943a1a960c8f29ffaffd70e14fcd4d4c18f64b83603efef8e7615f330082880e6c0aff9d4

        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exe

          Filesize

          11KB

          MD5

          5fa07e8ccf055edf11bd2372900432f0

          SHA1

          ddc5d6fc54d06df47d85955411b5036334f194a0

          SHA256

          81e8f55b18c82e85455874813ef9da8e01a50963ee05cf8a8763c05b146037c6

          SHA512

          353b21e2294e81b3b324e9e2ad7157fbe8ad0ad5e51f2020d1ab080783c20c11ee176240f8a06b37bfc70f694a272981c3fea65729415d7bd0ecd00a7ae272ea

        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exe

          Filesize

          380KB

          MD5

          6e32a72abf890a2c9a13c750398cc48d

          SHA1

          0e684f0273666a9129c94c15c7426dcf803928f4

          SHA256

          8e26a07ce5e3e1a02b7f5eb9f6c8ef802ebc58fb8b2d9c2dd03b63cedfb76082

          SHA512

          a52d4cb4d29f9c5d7029c168ca693b9b844525866eb6944ff72274ae6ba83a2657bade67028e15d16abc2e62a0b20f4470db769fa501ad34624790c9cc08aa77

        • memory/376-0-0x0000000000310000-0x0000000000391000-memory.dmp

          Filesize

          516KB

        • memory/376-2-0x0000000002BE0000-0x0000000002C6B000-memory.dmp

          Filesize

          556KB

        • memory/376-1-0x0000000000310000-0x0000000000391000-memory.dmp

          Filesize

          516KB

        • memory/376-7-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/376-23-0x0000000002BE0000-0x0000000002C6B000-memory.dmp

          Filesize

          556KB

        • memory/376-25-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/376-24-0x0000000000400000-0x0000000002BE0000-memory.dmp

          Filesize

          39.9MB

        • memory/2740-22-0x0000000000130000-0x000000000013A000-memory.dmp

          Filesize

          40KB

        • memory/2752-95-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-83-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-57-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-55-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-53-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-51-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-49-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-47-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-45-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-99-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-97-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-36-0x0000000004D30000-0x0000000004D76000-memory.dmp

          Filesize

          280KB

        • memory/2752-94-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-91-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-89-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-87-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-85-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-37-0x0000000004D70000-0x0000000004DB4000-memory.dmp

          Filesize

          272KB

        • memory/2752-81-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-79-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-77-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-75-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-73-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-71-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-69-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-67-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-65-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-63-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-61-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-43-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-41-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-39-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-38-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB

        • memory/2752-59-0x0000000004D70000-0x0000000004DAF000-memory.dmp

          Filesize

          252KB