Analysis

  • max time kernel
    142s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:13

General

  • Target

    cea2f8215e3d2a79fcc0437ac6122424053e0460509d41b3d7fd3a942ffdec80.exe

  • Size

    836KB

  • MD5

    94c41b5e0871315431a47c0459c3df92

  • SHA1

    9c39bfc5af37dc8568e0547d07605361c8175835

  • SHA256

    cea2f8215e3d2a79fcc0437ac6122424053e0460509d41b3d7fd3a942ffdec80

  • SHA512

    c86275c06cfec1ff468aff68282207d3df66fd19c4945e15c292f9498750b418a7eafbb44c056d53d58e27241d026ea291e53acd397bc703810ae6ffc742d304

  • SSDEEP

    12288:yMrpy902dWBjXNCt7YLYncP8qACn8HCMjAgh+tqjrlVv+Qixhm0u6qkpTvKMcON:jykjXwpYkngq0fAVhjjbBixnHqkBKxk

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Signatures

  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cea2f8215e3d2a79fcc0437ac6122424053e0460509d41b3d7fd3a942ffdec80.exe
    "C:\Users\Admin\AppData\Local\Temp\cea2f8215e3d2a79fcc0437ac6122424053e0460509d41b3d7fd3a942ffdec80.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9268.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9268.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\unio7093.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\unio7093.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4244
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pro8848.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pro8848.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2544
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu3442.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu3442.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2156
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 1080
            5⤵
            • Program crash
            PID:1392
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rRs66s72.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rRs66s72.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1336
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2156 -ip 2156
    1⤵
      PID:1972

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9268.exe

            Filesize

            694KB

            MD5

            5bf1de849799919c89d508d67d197fed

            SHA1

            b3b36d8cde8eccb36fbe9a3a0ab9ace405950f30

            SHA256

            c14070826b846d1e318a40b32035b071c706ca8a3d1cdc30a66d480227a64741

            SHA512

            8bb438cfc278024188e11148faa32c8be0beeac1d6fd4ea86a537d7c898961421c18cfadefafc3c36eb46499cfa21eec38f23a2ea287c9fbbde7750697a14e2e

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rRs66s72.exe

            Filesize

            391KB

            MD5

            a1e23a1d5cc681538995c968254f13c4

            SHA1

            9c852fd322c2c7af275a269a1f28eea7835d1907

            SHA256

            dfa15dea61c738aabd9d5455d2b1013b8615b710202998f6dded7d1fe6004e00

            SHA512

            0e072b2b3367e9515447eeb22af945a18587d47192e2e0db1440a40570b5bd6ca4024f3073392058bdd59f83af129d8b8c5a113d60d213b1f4b980a13fa0a877

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\unio7093.exe

            Filesize

            344KB

            MD5

            b6e50e43ee5ae81437808cbf267d325c

            SHA1

            ab92399388166d5bf769df469ef2dca88ed20276

            SHA256

            a1e1abafb5879f8c8222c21e44ec970e06eba5cec807e7e86367d2f468df1195

            SHA512

            7b03cadd7c64dd95d740c510d6ad93251840bec3abdeb1e11bd3b37d80429d68ff8e6ffa6b7c10c60325c5bdf6f03e2b6c5274a3d7173fe20bb587ebae8cca5b

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pro8848.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu3442.exe

            Filesize

            334KB

            MD5

            833e6d44e166e731d590e497cc505629

            SHA1

            f3864db90e21544452776ba4dd8102a4c52e8ac9

            SHA256

            8377949a0e4fee4f9002960a0243112ed6fc162ade625c319211ef6227c74569

            SHA512

            c0f006751a9b6ddd5388a26551964b56fd8b1fe0401b70e181a064b4b7c5cd4f58eeb3d4ae81bd9a28fce0e320a2ced1c6fec18b8733e57aaaf4ac1d10bebc6c

          • memory/1336-84-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-78-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-979-0x00000000080C0000-0x000000000810C000-memory.dmp

            Filesize

            304KB

          • memory/1336-978-0x0000000008080000-0x00000000080BC000-memory.dmp

            Filesize

            240KB

          • memory/1336-977-0x0000000007350000-0x0000000007362000-memory.dmp

            Filesize

            72KB

          • memory/1336-976-0x0000000007210000-0x000000000731A000-memory.dmp

            Filesize

            1.0MB

          • memory/1336-975-0x0000000007960000-0x0000000007F78000-memory.dmp

            Filesize

            6.1MB

          • memory/1336-69-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-70-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-68-0x0000000004CA0000-0x0000000004CE4000-memory.dmp

            Filesize

            272KB

          • memory/1336-72-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-74-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-76-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-96-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-80-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-82-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-86-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-88-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-90-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-93-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-94-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-98-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-100-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/1336-67-0x0000000004B70000-0x0000000004BB6000-memory.dmp

            Filesize

            280KB

          • memory/1336-102-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

            Filesize

            248KB

          • memory/2156-53-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-45-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-29-0x0000000004980000-0x000000000499A000-memory.dmp

            Filesize

            104KB

          • memory/2156-30-0x0000000007400000-0x00000000079A4000-memory.dmp

            Filesize

            5.6MB

          • memory/2156-60-0x0000000000400000-0x0000000002B03000-memory.dmp

            Filesize

            39.0MB

          • memory/2156-35-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-37-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-39-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-33-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-31-0x0000000004D90000-0x0000000004DA8000-memory.dmp

            Filesize

            96KB

          • memory/2156-43-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-55-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-47-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-49-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-51-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-62-0x0000000000400000-0x0000000002B03000-memory.dmp

            Filesize

            39.0MB

          • memory/2156-57-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-59-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-41-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2156-32-0x0000000004D90000-0x0000000004DA2000-memory.dmp

            Filesize

            72KB

          • memory/2544-21-0x00007FFEC6003000-0x00007FFEC6005000-memory.dmp

            Filesize

            8KB

          • memory/2544-22-0x0000000000650000-0x000000000065A000-memory.dmp

            Filesize

            40KB

          • memory/2544-23-0x00007FFEC6003000-0x00007FFEC6005000-memory.dmp

            Filesize

            8KB