Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 06:13

General

  • Target

    3792f24bb214aace5fa9b8ddd4d67b2e327e3f0f92296f11eb76e5d5732c1870.exe

  • Size

    479KB

  • MD5

    cd7f03dca0915b8580f927443a7e9f0c

  • SHA1

    1d8fe1ea3c406ef81a782428c397fcae8f4dda03

  • SHA256

    3792f24bb214aace5fa9b8ddd4d67b2e327e3f0f92296f11eb76e5d5732c1870

  • SHA512

    ee44bd4aa198b3c5db1c9e70832cf3e4ea2a96b0889c21c8cc2b78b12802d60c6dd12386bf50a66c319410c7840967926c061bede58fc53b54dc13ab0a188f40

  • SSDEEP

    6144:Kuy+bnr+/p0yN90QEkXEYwGZxRwv797gztQKyADdStBTNqpCtHh8o3jr5xbNn6e0:+Mr7y90lY9G7rKyAItpApCBGU5TX0

Malware Config

Extracted

Family

redline

Botnet

maher

C2

217.196.96.101:4132

Attributes
  • auth_value

    c57763165f68aabcf4874e661a1ffbac

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3792f24bb214aace5fa9b8ddd4d67b2e327e3f0f92296f11eb76e5d5732c1870.exe
    "C:\Users\Admin\AppData\Local\Temp\3792f24bb214aace5fa9b8ddd4d67b2e327e3f0f92296f11eb76e5d5732c1870.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3921378.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3921378.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5845182.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5845182.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1548
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1130488.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1130488.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3328
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:1824

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3921378.exe

          Filesize

          307KB

          MD5

          7acf75193a8cea548abad73bd043b376

          SHA1

          3a3c490fd02e9499da1b1a55c806084026d7a741

          SHA256

          e4727012f16f2b378310bdd1f14f3fc559a64644a62919204d751b60e97f1b12

          SHA512

          0d7786cb1f65ec438befc51b0c97c4935cf3267cbf278c14bcad9b250641d23f84cd4d1fb7215952589430308f2ffae5f58d51f9a999b19e9192965895422691

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5845182.exe

          Filesize

          179KB

          MD5

          10fcba7830f50cee75aef0a49d9220de

          SHA1

          b1511ebe7f43d34f834d461880aa5b9b9c2ec482

          SHA256

          fe2dbd1b465217ae251b16f932afadb0af719438a4494be47b539a280218da37

          SHA512

          0d80616d84289de672f1587bdeabdc3285896bf4df2ce8a0b26423d57785b825a95be6918d59cc611a39025d82d007ac0867d9d1d2c11ee2fb8afbd67515122d

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1130488.exe

          Filesize

          168KB

          MD5

          be7e4d8cc6c9b7f2835528b4abc92363

          SHA1

          2d15c615d8239c0d673bc1f0358bd1b7efc0cbe5

          SHA256

          1a914ef75e161e88315f1a745ed3232002c688281fcf3aa7b9aca4a8591df7b9

          SHA512

          f0486cecf479e6e18029c210d288282961ba1bd247004605f42455c2d4e93f5add6f22bd3f7f077a7df9c83bb8220318520710ec403901e3e7a8dc7d1d10f691

        • memory/1548-34-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-27-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-17-0x0000000004B10000-0x00000000050B4000-memory.dmp

          Filesize

          5.6MB

        • memory/1548-19-0x0000000002630000-0x0000000002648000-memory.dmp

          Filesize

          96KB

        • memory/1548-20-0x0000000073F60000-0x0000000074710000-memory.dmp

          Filesize

          7.7MB

        • memory/1548-18-0x0000000073F60000-0x0000000074710000-memory.dmp

          Filesize

          7.7MB

        • memory/1548-48-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-46-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-28-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-42-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-40-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-38-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-36-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-15-0x00000000023A0000-0x00000000023BA000-memory.dmp

          Filesize

          104KB

        • memory/1548-16-0x0000000073F60000-0x0000000074710000-memory.dmp

          Filesize

          7.7MB

        • memory/1548-32-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-44-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-30-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-24-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-22-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-21-0x0000000002630000-0x0000000002642000-memory.dmp

          Filesize

          72KB

        • memory/1548-49-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

          Filesize

          4KB

        • memory/1548-50-0x0000000073F60000-0x0000000074710000-memory.dmp

          Filesize

          7.7MB

        • memory/1548-52-0x0000000073F60000-0x0000000074710000-memory.dmp

          Filesize

          7.7MB

        • memory/1548-14-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

          Filesize

          4KB

        • memory/3328-56-0x00000000005D0000-0x0000000000600000-memory.dmp

          Filesize

          192KB

        • memory/3328-57-0x0000000002780000-0x0000000002786000-memory.dmp

          Filesize

          24KB

        • memory/3328-58-0x0000000005690000-0x0000000005CA8000-memory.dmp

          Filesize

          6.1MB

        • memory/3328-59-0x0000000005180000-0x000000000528A000-memory.dmp

          Filesize

          1.0MB

        • memory/3328-60-0x0000000005090000-0x00000000050A2000-memory.dmp

          Filesize

          72KB

        • memory/3328-61-0x00000000050F0000-0x000000000512C000-memory.dmp

          Filesize

          240KB

        • memory/3328-62-0x0000000005290000-0x00000000052DC000-memory.dmp

          Filesize

          304KB