Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:14

General

  • Target

    fd97cf9b0f70f4b0bdd9165bfc2dddc770f6a5d3800b265845821be0d0a4b26e.exe

  • Size

    787KB

  • MD5

    40c0e0d4a657bd213faebee33b1ea725

  • SHA1

    e833a6140993f78c4a3e82702d56da449ac78857

  • SHA256

    fd97cf9b0f70f4b0bdd9165bfc2dddc770f6a5d3800b265845821be0d0a4b26e

  • SHA512

    7bdb7538685acaa309ea78a377c74897a71f25b38fc301f1984288d66ff197780b2039c738aed6447a90e4c5bcdab92a76aacffe6fb7a562edf78883c6273547

  • SSDEEP

    12288:cMr2y90EryjxfmUALGgZmwzQqs1+9SjJwfcZDiWcoXX7m1mfZjl1X8RC0Gh:CyWlYtfQqsAwjJWcZDiWcmcmhrM05

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd97cf9b0f70f4b0bdd9165bfc2dddc770f6a5d3800b265845821be0d0a4b26e.exe
    "C:\Users\Admin\AppData\Local\Temp\fd97cf9b0f70f4b0bdd9165bfc2dddc770f6a5d3800b265845821be0d0a4b26e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un928469.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un928469.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:644
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8712.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8712.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4728
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1004
          4⤵
          • Program crash
          PID:1124
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5910.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5910.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4892
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1372
          4⤵
          • Program crash
          PID:5576
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si170791.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si170791.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5456
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4728 -ip 4728
    1⤵
      PID:4020
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1336 -ip 1336
      1⤵
        PID:4600

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si170791.exe

              Filesize

              168KB

              MD5

              2e77140d3268487bacba06ad470ced7c

              SHA1

              60005771c74c10782ecfb0ebcd5104aca6dd2c59

              SHA256

              fddedf063b92342e105ee0d4cbb213da45b1f00ff5930a2918d6c613aa1a6ec0

              SHA512

              d39dc31eef51933333224f8d481291b6ea0e369487f9db71c59c27f5fa0c79a57e57b18d421ffc8a719a4a132f3b62cac0d2e3a62f0c9e9b7ece2eebc9ceaf44

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un928469.exe

              Filesize

              633KB

              MD5

              475b3d0044b14a73218c1adf32db5d5f

              SHA1

              9e4a447dfb09984657efed0e93bf2401611d9874

              SHA256

              5a2c5704cbd20924e7861e280b254dfda4d55131c746b87252fc31af0ad7664b

              SHA512

              fe4f6a354cd686392b817b3a4bde6fd10a76124cfe58cded887f820c2e17a3f00d1e9a38dfd8213bf06666d65ce6127e02a977fd7e077e042dc73310e6eccd17

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8712.exe

              Filesize

              231KB

              MD5

              aefab3d4e565ded3438a4b0ca2297803

              SHA1

              94c6299c5b47e472656fb46df0eff666f3cc22c3

              SHA256

              139522c22f1a08b6d2d7c7547b2269f31a9cf38b436797e3d64761e36ecbec40

              SHA512

              e251a9d549ae207f6acf533ba4db564b4d8ff306a52e1fa8bd88e5fcb5691695ab753ef08cd883b6983d5bf6363b48279533131b99009ba67eddfc27c4b17037

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5910.exe

              Filesize

              414KB

              MD5

              3a9ee7e41a4dc46de748e2c8d70296b0

              SHA1

              311236fff6c392b5842f64df629051d7eff44c50

              SHA256

              634bfffb23e3c9e695f7b6afd18446e51c1a5db900fb1db2af86be7ea6ec1806

              SHA512

              33317c855e3d37c524cf2b8722bf2c7b690efe87f85526be5b260721d0f9b38f01568f441f38a1685cc7a78123de956e7c4645a9fee503cf53615fbbf74c2844

            • C:\Windows\Temp\1.exe

              Filesize

              168KB

              MD5

              1073b2e7f778788852d3f7bb79929882

              SHA1

              7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

              SHA256

              c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

              SHA512

              90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

            • memory/1336-74-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-68-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-2143-0x0000000004B50000-0x0000000004B82000-memory.dmp

              Filesize

              200KB

            • memory/1336-82-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-80-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-70-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-72-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-76-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-78-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-63-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-86-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-88-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-90-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-92-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-94-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-96-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-64-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-84-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-66-0x0000000002570000-0x00000000025CF000-memory.dmp

              Filesize

              380KB

            • memory/1336-62-0x0000000002570000-0x00000000025D6000-memory.dmp

              Filesize

              408KB

            • memory/1336-61-0x0000000002380000-0x00000000023E6000-memory.dmp

              Filesize

              408KB

            • memory/4728-45-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-55-0x0000000000400000-0x00000000004A8000-memory.dmp

              Filesize

              672KB

            • memory/4728-56-0x0000000000400000-0x0000000000430000-memory.dmp

              Filesize

              192KB

            • memory/4728-18-0x0000000000400000-0x00000000004A8000-memory.dmp

              Filesize

              672KB

            • memory/4728-17-0x0000000000400000-0x0000000000430000-memory.dmp

              Filesize

              192KB

            • memory/4728-50-0x00000000004B0000-0x00000000005B0000-memory.dmp

              Filesize

              1024KB

            • memory/4728-23-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-19-0x00000000022A0000-0x00000000022BA000-memory.dmp

              Filesize

              104KB

            • memory/4728-25-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-27-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-29-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-31-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-33-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-35-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-38-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-39-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-52-0x0000000000400000-0x0000000000430000-memory.dmp

              Filesize

              192KB

            • memory/4728-42-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-16-0x00000000005B0000-0x00000000005DD000-memory.dmp

              Filesize

              180KB

            • memory/4728-51-0x00000000005B0000-0x00000000005DD000-memory.dmp

              Filesize

              180KB

            • memory/4728-47-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-49-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-22-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4728-21-0x00000000022F0000-0x0000000002308000-memory.dmp

              Filesize

              96KB

            • memory/4728-20-0x0000000004D10000-0x00000000052B4000-memory.dmp

              Filesize

              5.6MB

            • memory/4728-15-0x00000000004B0000-0x00000000005B0000-memory.dmp

              Filesize

              1024KB

            • memory/4728-43-0x00000000022F0000-0x0000000002302000-memory.dmp

              Filesize

              72KB

            • memory/4892-2157-0x00000000023E0000-0x00000000023E6000-memory.dmp

              Filesize

              24KB

            • memory/4892-2156-0x0000000000050000-0x0000000000080000-memory.dmp

              Filesize

              192KB

            • memory/4892-2159-0x0000000004B90000-0x0000000004C9A000-memory.dmp

              Filesize

              1.0MB

            • memory/4892-2160-0x00000000048C0000-0x00000000048D2000-memory.dmp

              Filesize

              72KB

            • memory/4892-2161-0x0000000004920000-0x000000000495C000-memory.dmp

              Filesize

              240KB

            • memory/4892-2162-0x0000000004A80000-0x0000000004ACC000-memory.dmp

              Filesize

              304KB

            • memory/4892-2158-0x00000000050A0000-0x00000000056B8000-memory.dmp

              Filesize

              6.1MB

            • memory/5456-2167-0x0000000000F20000-0x0000000000F4E000-memory.dmp

              Filesize

              184KB

            • memory/5456-2168-0x0000000003100000-0x0000000003106000-memory.dmp

              Filesize

              24KB