Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:16

General

  • Target

    27cf3cf0d1d34cc9df5c5dd63eb8a0e4dd48b60f39b9ba33b4cb4a0c6fb9d0ca.exe

  • Size

    479KB

  • MD5

    1a9546516eac421b88e4e157540eee9e

  • SHA1

    bf271a750e9fc7a3ca1223a2ad302facb160016b

  • SHA256

    27cf3cf0d1d34cc9df5c5dd63eb8a0e4dd48b60f39b9ba33b4cb4a0c6fb9d0ca

  • SHA512

    82577e9daab5cd724e0657d0dd58ce2ae594fcc5764fd8944b572dd5de92a3f0e7f54e9dedd29b131292541a1eaa809ff84c1578f2cbd3c68ff260ac2b1cc333

  • SSDEEP

    12288:tMrXy90p6BRv3hIG+THTWRy8/1bTZJqXD8:eyu6zhBoGQD8

Malware Config

Extracted

Family

redline

Botnet

murka

C2

217.196.96.101:4132

Attributes
  • auth_value

    878a0681ac6ad0e4eb10ef9db07abdd9

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27cf3cf0d1d34cc9df5c5dd63eb8a0e4dd48b60f39b9ba33b4cb4a0c6fb9d0ca.exe
    "C:\Users\Admin\AppData\Local\Temp\27cf3cf0d1d34cc9df5c5dd63eb8a0e4dd48b60f39b9ba33b4cb4a0c6fb9d0ca.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9829224.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9829224.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7464081.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7464081.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2948
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7349453.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7349453.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2876

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9829224.exe

          Filesize

          307KB

          MD5

          fee75afe7ae5e52c69896233b4253eef

          SHA1

          f9c74f84ceef0b467d91018db4261dd0f35a98a7

          SHA256

          86a2465e3b850731242d53feeadfbf775a16daa46d5d1b59ad86c452dfa4295a

          SHA512

          155e899e579676e9ac4ed70f048cf61caf042ddd409fa11d14141c982b12a4a6a1b2a91b5469fa838b9093c70edb93a2c97dda6d8adb2de42c50f6e9975a9e9c

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7464081.exe

          Filesize

          181KB

          MD5

          85fce7e808f9f4d0cace7537f3990d8a

          SHA1

          5c0a66e370e473beca270a60fcb4a64e7c7af483

          SHA256

          c53c6d6b01452a36410b0b5a65419c03700898fb0076981656a7934c0c167ac6

          SHA512

          0dd8457ff53e99be5deaba6d75f8601595e8fc6f42ca08055daf8bf152c13d9e75328cd676490678bf995f164a7693996e6f12871511e1ffddab686e2a8f8b95

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7349453.exe

          Filesize

          168KB

          MD5

          91f424ee7e05e87d57a7dcd83e1a9358

          SHA1

          e45b6e0fc5b51020fb1ddf14121e11c643478b4e

          SHA256

          d0fb1780f8072834a6d223e44b84c683c7543642bf1ba47cde4c5e9f1690438b

          SHA512

          d11e231e4a25edc1889e3662cf66651e018424cb30bb37fc5db1b8ed457a4150d5108d38160d4c6b544964232e9f4fd8c9c30fba7281cdc0ebb175fba008f628

        • memory/2876-62-0x0000000004D00000-0x0000000004D4C000-memory.dmp

          Filesize

          304KB

        • memory/2876-61-0x0000000004CC0000-0x0000000004CFC000-memory.dmp

          Filesize

          240KB

        • memory/2876-60-0x0000000004C40000-0x0000000004C52000-memory.dmp

          Filesize

          72KB

        • memory/2876-59-0x0000000004DD0000-0x0000000004EDA000-memory.dmp

          Filesize

          1.0MB

        • memory/2876-58-0x00000000052E0000-0x00000000058F8000-memory.dmp

          Filesize

          6.1MB

        • memory/2876-57-0x00000000023D0000-0x00000000023D6000-memory.dmp

          Filesize

          24KB

        • memory/2876-56-0x00000000002D0000-0x0000000000300000-memory.dmp

          Filesize

          192KB

        • memory/2948-36-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-22-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-46-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-44-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-42-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-40-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-38-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-34-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-32-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-28-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-26-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-24-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-21-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-48-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-49-0x000000007421E000-0x000000007421F000-memory.dmp

          Filesize

          4KB

        • memory/2948-50-0x0000000074210000-0x00000000749C0000-memory.dmp

          Filesize

          7.7MB

        • memory/2948-52-0x0000000074210000-0x00000000749C0000-memory.dmp

          Filesize

          7.7MB

        • memory/2948-30-0x00000000024B0000-0x00000000024C2000-memory.dmp

          Filesize

          72KB

        • memory/2948-20-0x0000000074210000-0x00000000749C0000-memory.dmp

          Filesize

          7.7MB

        • memory/2948-18-0x00000000024B0000-0x00000000024C8000-memory.dmp

          Filesize

          96KB

        • memory/2948-19-0x0000000074210000-0x00000000749C0000-memory.dmp

          Filesize

          7.7MB

        • memory/2948-16-0x0000000074210000-0x00000000749C0000-memory.dmp

          Filesize

          7.7MB

        • memory/2948-17-0x00000000049A0000-0x0000000004F44000-memory.dmp

          Filesize

          5.6MB

        • memory/2948-15-0x00000000022B0000-0x00000000022CA000-memory.dmp

          Filesize

          104KB

        • memory/2948-14-0x000000007421E000-0x000000007421F000-memory.dmp

          Filesize

          4KB