Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:18

General

  • Target

    a27fdee3bd82b6eaa17bbb0859dfdbe493689712037e58a931f0b0d6194a469e.exe

  • Size

    525KB

  • MD5

    8c7f97a864afd24ba6fd66b65b5db246

  • SHA1

    5ee445b462b5e7f23afbd3dd681e779f076db43f

  • SHA256

    a27fdee3bd82b6eaa17bbb0859dfdbe493689712037e58a931f0b0d6194a469e

  • SHA512

    861ee6664b881821b0005d06b0d3f49078d53ec33a1029e90ae2ce8d687563db0e8e1f83964630e963b3f723d8c218305e5eeea30f86fc702de20d150701fc5f

  • SSDEEP

    12288:bMr8y90oBHcZs2YIdEnm1nW/lcEzC82tiHG:7yzdIJLnteG

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes
  • auth_value

    cddc991efd6918ad5321d80dac884b40

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a27fdee3bd82b6eaa17bbb0859dfdbe493689712037e58a931f0b0d6194a469e.exe
    "C:\Users\Admin\AppData\Local\Temp\a27fdee3bd82b6eaa17bbb0859dfdbe493689712037e58a931f0b0d6194a469e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhGE5018ma.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhGE5018ma.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:852
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf28nL43eS86.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf28nL43eS86.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2412
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf48gr78wj52.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf48gr78wj52.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2704

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhGE5018ma.exe

          Filesize

          380KB

          MD5

          02c864ce5b8c5eb2cf145f72fe73c5d0

          SHA1

          22d93ea9d58dd6cbb0ed406fc83eaee90f6c81f2

          SHA256

          7c3205244e76cc80ffa3cad2e4138fefd314479e3ed59ff67e5477516aa4e40d

          SHA512

          52b8787801f1d62b7a60265b1b54c028b04242bb03f4f27cbae7be0d3b360f49ca3943db0c227a77d37cd733fc73bd04d9cecbc10da199dd0faafc4cbd77e83f

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf28nL43eS86.exe

          Filesize

          12KB

          MD5

          8a3793d6f2f25c9119382380dae46ba4

          SHA1

          2deee8af4e98b1849cde7ee9722a419d69a36a87

          SHA256

          c9470a2786af60b9d763bb3ebe9513bff1a3151516803b8fe6105b999dd5d266

          SHA512

          bd9f9a08cf7c97e77d8b980d2c07c351e7ce64b17ada5ea702bd62178abce3f3a87eec8b10dc3ec78c94ca8c336803ca123e3c176ee019ac8ad58df4f953bafa

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf48gr78wj52.exe

          Filesize

          291KB

          MD5

          249978248eadf5f91425671a026f54a0

          SHA1

          80596f205182dcbeb05b93e5cdb77a067c723cf1

          SHA256

          0acc998717f3d96cb94c3160c2f07c54c5244d4d29df38db9ca0b5a71f219682

          SHA512

          aadc502c62ada1e529b0a11a335694cba325cb4d3ae1b85fac8d110238314b4f2bb6f4cae21bb15183a0252835bbc02a0d094c5911d0d7f1c74c4a1ba1167a14

        • memory/2412-14-0x00007FF8C0A03000-0x00007FF8C0A05000-memory.dmp

          Filesize

          8KB

        • memory/2412-15-0x0000000000060000-0x000000000006A000-memory.dmp

          Filesize

          40KB

        • memory/2412-16-0x00007FF8C0A03000-0x00007FF8C0A05000-memory.dmp

          Filesize

          8KB

        • memory/2704-60-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-48-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-24-0x0000000004CB0000-0x0000000004CF4000-memory.dmp

          Filesize

          272KB

        • memory/2704-38-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-88-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-86-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-82-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-80-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-79-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-76-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-74-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-72-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-68-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-66-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-64-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-62-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-22-0x0000000002790000-0x00000000027D6000-memory.dmp

          Filesize

          280KB

        • memory/2704-58-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-56-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-54-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-52-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-23-0x0000000004EB0000-0x0000000005454000-memory.dmp

          Filesize

          5.6MB

        • memory/2704-46-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-42-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-40-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-36-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-34-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-32-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-30-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-84-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-28-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-70-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-50-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-26-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-44-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-25-0x0000000004CB0000-0x0000000004CEE000-memory.dmp

          Filesize

          248KB

        • memory/2704-931-0x0000000005460000-0x0000000005A78000-memory.dmp

          Filesize

          6.1MB

        • memory/2704-932-0x0000000005A80000-0x0000000005B8A000-memory.dmp

          Filesize

          1.0MB

        • memory/2704-933-0x0000000004DF0000-0x0000000004E02000-memory.dmp

          Filesize

          72KB

        • memory/2704-934-0x0000000004E10000-0x0000000004E4C000-memory.dmp

          Filesize

          240KB

        • memory/2704-935-0x0000000005C90000-0x0000000005CDC000-memory.dmp

          Filesize

          304KB