Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:11

General

  • Target

    ad959e9c37eb41b7e446dfaec08d4ec1f7b6ba5fdc1169c9cf28f83247308165.exe

  • Size

    811KB

  • MD5

    1a43269c7d4b0c9beae70560946f6eea

  • SHA1

    656c07e9a4f39a101e273718793c55e7fbf6903f

  • SHA256

    ad959e9c37eb41b7e446dfaec08d4ec1f7b6ba5fdc1169c9cf28f83247308165

  • SHA512

    d1568d623bca93ba298b53c6be68df9bbc8cd1ba693390d8868fc4bec749bc595529d8f93c26c30d3f9a58697e12e5726e846fc70003f9b3d3f0b1a7f3074c3b

  • SSDEEP

    12288:sMr1y90NOi69NI/nQD+xFk3oc9+/RU5dLksGf2lTPOgSGu7mN4WVWhSCjHg:5yOOiJoDGFuocHcfibOL7lWVWhSmHg

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Signatures

  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad959e9c37eb41b7e446dfaec08d4ec1f7b6ba5fdc1169c9cf28f83247308165.exe
    "C:\Users\Admin\AppData\Local\Temp\ad959e9c37eb41b7e446dfaec08d4ec1f7b6ba5fdc1169c9cf28f83247308165.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice7919.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice7919.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice3676.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice3676.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8199SX.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8199SX.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3644
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c35Cv75.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c35Cv75.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2400
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1108
            5⤵
            • Program crash
            PID:4656
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dtenT48.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dtenT48.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2400 -ip 2400
    1⤵
      PID:4956

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice7919.exe

            Filesize

            666KB

            MD5

            fb515767b6823875838f7142d7a8082c

            SHA1

            cd8626bf0d36f71896de65bcf6e3b15aa267c62c

            SHA256

            61bbdae159d82e281e7d03809097279e2adb4ffae88cf9344b60b1894f7c4054

            SHA512

            0b2d5c0ec449d0cd4cc1045e802cd738df23427b10e721c30750fd3dcc01c48375aaa2687062bf13cc00b34d46e391314ed2490f1ed034f4021005bb53758556

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dtenT48.exe

            Filesize

            308KB

            MD5

            a880c9d7c0d1ccce7f92baa98f475054

            SHA1

            ffab49943604c9d1ba69a176a75a34c0bb64cb4a

            SHA256

            ce706744b980b700a11083d910b9b0edccc29cf1eab2930590b9418837534570

            SHA512

            ccfc8136c4e12ed6aa6b5a58b144696d9fac23a67170ee17945ab1d9f06e795b71b516cf741fb962dec7a5e6c68d7d34a4e1fbb76c1dc4055342fe9ecb0341c6

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice3676.exe

            Filesize

            333KB

            MD5

            e4fb5f652d32dbe91f08cf8d46d2d14f

            SHA1

            e27f39321663a2fc63d8faf8d176822d49fc7e68

            SHA256

            6b3676523eb407fc888f2563607872b38811fcfb938c1c1162dd148e1bb1df60

            SHA512

            0f2d96b1b3a95d05bcd4f2379421f020aa21f511f8039a88f97be95ccf3cbaf7191b62864f59b09f99134e9f0994ca60373db25dfe8b5ef101b6db2fb594d9da

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8199SX.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c35Cv75.exe

            Filesize

            250KB

            MD5

            17b24c9cccfd2bf63e5a6b20f296e73f

            SHA1

            6be2813510668aab256fcfeae459c183e0ff3087

            SHA256

            509183b383457d2f25575164686a55ac608f58c047fbd77b1dcbef9c8ee11459

            SHA512

            3fd6f33676ff314a2a5594334c9830d306cfe2c03594dc19442fc90702a9d5a8d36ce76eced3dbc511e41fe60ca9110f39b71bb6504d01e3a20784bdc8c8158c

          • memory/2400-60-0x0000000000400000-0x00000000004BF000-memory.dmp

            Filesize

            764KB

          • memory/2400-53-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-29-0x0000000002330000-0x000000000234A000-memory.dmp

            Filesize

            104KB

          • memory/2400-30-0x0000000004BB0000-0x0000000005154000-memory.dmp

            Filesize

            5.6MB

          • memory/2400-31-0x0000000002600000-0x0000000002618000-memory.dmp

            Filesize

            96KB

          • memory/2400-32-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-41-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-59-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-57-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-55-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-62-0x0000000000400000-0x00000000004BF000-memory.dmp

            Filesize

            764KB

          • memory/2400-51-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-49-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-47-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-45-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-43-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-39-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-37-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-35-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2400-33-0x0000000002600000-0x0000000002612000-memory.dmp

            Filesize

            72KB

          • memory/2492-76-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-975-0x0000000005170000-0x0000000005788000-memory.dmp

            Filesize

            6.1MB

          • memory/2492-979-0x0000000005A90000-0x0000000005ADC000-memory.dmp

            Filesize

            304KB

          • memory/2492-978-0x0000000005900000-0x000000000593C000-memory.dmp

            Filesize

            240KB

          • memory/2492-84-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-70-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-80-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-102-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-100-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-98-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-96-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-92-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-67-0x00000000023C0000-0x0000000002406000-memory.dmp

            Filesize

            280KB

          • memory/2492-90-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-68-0x0000000004AA0000-0x0000000004AE4000-memory.dmp

            Filesize

            272KB

          • memory/2492-88-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-82-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-78-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-86-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-74-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-72-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-94-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-69-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

            Filesize

            248KB

          • memory/2492-977-0x00000000058E0000-0x00000000058F2000-memory.dmp

            Filesize

            72KB

          • memory/2492-976-0x00000000057A0000-0x00000000058AA000-memory.dmp

            Filesize

            1.0MB

          • memory/3644-22-0x0000000000A10000-0x0000000000A1A000-memory.dmp

            Filesize

            40KB

          • memory/3644-21-0x00007FF8647D3000-0x00007FF8647D5000-memory.dmp

            Filesize

            8KB

          • memory/3644-23-0x00007FF8647D3000-0x00007FF8647D5000-memory.dmp

            Filesize

            8KB