Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 06:06

General

  • Target

    43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe

  • Size

    713KB

  • MD5

    fdd495aa140c9585374c84a70a9699ff

  • SHA1

    7dc4d87c575d03672e840bb44893c8489dd4d463

  • SHA256

    43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c

  • SHA512

    c5b8710c922d3633a4d25fe117034418360df8e71177ba3436a53523c59c9cecc29179e942915e30290aa203c60beb8d649e0b5ee54b7338d24e5235288d06a0

  • SSDEEP

    12288:38oWJCJY3DCEhwEiaYJVx4rdv1GV5uREe6TFgpEAMSgQ6nC8DEsLRhjKWYIBoFi:32oYGEhGa6VxUdtGrKEcAFQ6RRlBBoM

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 34 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe
    "C:\Users\Admin\AppData\Local\Temp\43d21e135859ecc1b67e1c599d1a1755d2aabee9e35063ff4f056ef96f8de13c.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1876
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4056
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:640

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exe

          Filesize

          407KB

          MD5

          cabb3463f51c332c467c2ff736fe05bb

          SHA1

          aadc455ffed9978efd77f729064bb0d4b178f595

          SHA256

          4fad65b6cabba38e0ec7b35cd8a81c916f5d73b24e5428a2107e115a1daad86d

          SHA512

          b4146c8234fdfcbf3fdceee02951896dc408f98ffc93a255239e1e6943a1a960c8f29ffaffd70e14fcd4d4c18f64b83603efef8e7615f330082880e6c0aff9d4

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exe

          Filesize

          11KB

          MD5

          5fa07e8ccf055edf11bd2372900432f0

          SHA1

          ddc5d6fc54d06df47d85955411b5036334f194a0

          SHA256

          81e8f55b18c82e85455874813ef9da8e01a50963ee05cf8a8763c05b146037c6

          SHA512

          353b21e2294e81b3b324e9e2ad7157fbe8ad0ad5e51f2020d1ab080783c20c11ee176240f8a06b37bfc70f694a272981c3fea65729415d7bd0ecd00a7ae272ea

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exe

          Filesize

          380KB

          MD5

          6e32a72abf890a2c9a13c750398cc48d

          SHA1

          0e684f0273666a9129c94c15c7426dcf803928f4

          SHA256

          8e26a07ce5e3e1a02b7f5eb9f6c8ef802ebc58fb8b2d9c2dd03b63cedfb76082

          SHA512

          a52d4cb4d29f9c5d7029c168ca693b9b844525866eb6944ff72274ae6ba83a2657bade67028e15d16abc2e62a0b20f4470db769fa501ad34624790c9cc08aa77

        • memory/640-74-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-34-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-943-0x0000000008110000-0x000000000815C000-memory.dmp

          Filesize

          304KB

        • memory/640-942-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

          Filesize

          240KB

        • memory/640-941-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

          Filesize

          72KB

        • memory/640-940-0x0000000007E60000-0x0000000007F6A000-memory.dmp

          Filesize

          1.0MB

        • memory/640-939-0x00000000077C0000-0x0000000007DD8000-memory.dmp

          Filesize

          6.1MB

        • memory/640-33-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-68-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-70-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-30-0x00000000070D0000-0x0000000007116000-memory.dmp

          Filesize

          280KB

        • memory/640-31-0x0000000007180000-0x0000000007724000-memory.dmp

          Filesize

          5.6MB

        • memory/640-32-0x0000000007770000-0x00000000077B4000-memory.dmp

          Filesize

          272KB

        • memory/640-58-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-94-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-92-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-91-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-88-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-86-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-84-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-80-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-78-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-77-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-82-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-36-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-72-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-66-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-64-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-62-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-60-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-56-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-54-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-52-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-50-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-48-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-46-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-44-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-42-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-40-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/640-38-0x0000000007770000-0x00000000077AF000-memory.dmp

          Filesize

          252KB

        • memory/1716-3-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/1716-1-0x00000000047F0000-0x000000000487F000-memory.dmp

          Filesize

          572KB

        • memory/1716-23-0x0000000000400000-0x0000000002BE0000-memory.dmp

          Filesize

          39.9MB

        • memory/1716-2-0x0000000004880000-0x000000000490B000-memory.dmp

          Filesize

          556KB

        • memory/1716-22-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/1716-21-0x0000000004880000-0x000000000490B000-memory.dmp

          Filesize

          556KB

        • memory/1716-20-0x00000000047F0000-0x000000000487F000-memory.dmp

          Filesize

          572KB

        • memory/4056-25-0x00007FFEF6813000-0x00007FFEF6815000-memory.dmp

          Filesize

          8KB

        • memory/4056-19-0x0000000000100000-0x000000000010A000-memory.dmp

          Filesize

          40KB

        • memory/4056-18-0x00007FFEF6813000-0x00007FFEF6815000-memory.dmp

          Filesize

          8KB