Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 20:32

General

  • Target

    6025eef877d4beaa2dc37d0e011929ccff1b8bcb3f93fb2e5cd7b1dcb00b4d4b.exe

  • Size

    836KB

  • MD5

    2eeef679dabce901807bb7d7af869e53

  • SHA1

    de69cb1a0be0b3e3870d4ec370f8b72edb4b10dd

  • SHA256

    6025eef877d4beaa2dc37d0e011929ccff1b8bcb3f93fb2e5cd7b1dcb00b4d4b

  • SHA512

    3771fe75a608149841a2cab0f7889b3178278c2e4300d69d7bee41b1976694fd9115bcce6a31742fbcbfa6e417c80effe7fe01f834039d3fae8a7235b44b0661

  • SSDEEP

    12288:JMr5y90oBNUIEE48azJWzEOrQLSbqQ5Hd3ICLv+vYtDWvzIExWJqsf1/hKe5:EyxQ6YKEOPbqoHhICLvYYcsd3S+

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Signatures

  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6025eef877d4beaa2dc37d0e011929ccff1b8bcb3f93fb2e5cd7b1dcb00b4d4b.exe
    "C:\Users\Admin\AppData\Local\Temp\6025eef877d4beaa2dc37d0e011929ccff1b8bcb3f93fb2e5cd7b1dcb00b4d4b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba4835.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba4835.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba8925.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba8925.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4056
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8328xP.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8328xP.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:540
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h44Ar04.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h44Ar04.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1480
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1064
            5⤵
            • Program crash
            PID:1220
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iBGAA79.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iBGAA79.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4160
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1480 -ip 1480
    1⤵
      PID:448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba4835.exe

      Filesize

      694KB

      MD5

      6ceee864892dfe375ca3b8f1ecde0ef1

      SHA1

      b24f10f3ce2f87120ba896f384ebe958b830dad0

      SHA256

      89c22fcf920d4c2cc169e02cc86724fc7fead2391230d4f59f312b1ae99ddc7b

      SHA512

      3c64e5bfba0c257fe285cc78cc93f89245419528c77cc1b84eb8e7c9c3b8af1d11d28b8f45c18792eafadd4d9f334bb2c3ccb746fc88eb18d741060da39094a2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iBGAA79.exe

      Filesize

      391KB

      MD5

      8ab77f9061984a87d29561e8e7c8f405

      SHA1

      ede3490b7f8d9df1fdfc094ee5f1439fa230f836

      SHA256

      e247b4911ae840c4304b36efffeb2a91662227ef49f06f02ff3316da99e68edc

      SHA512

      34f663b30b141b29cf4f5e6be51907c0498a68052d618c5d08d58baa064bf9624bb964049873553f0d9ec16b826ababe41f8ed156387e825c186de62a27b0cc5

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba8925.exe

      Filesize

      344KB

      MD5

      56fd52c58288556bd61f89fce4b08607

      SHA1

      5abefc1ad602253d98a3c7ecf377df755e8a715d

      SHA256

      8bccc599b256d1f9c207e6acc884048118736e865355556e134d670560788159

      SHA512

      6d54156f52f580a9d8a715ccc6f5e1ff6a2a5feca6aa8e012a10d4e24ae372245ec976a3dbf87ab02256d00286bcf5d697b4d5beb3ac5390bb85ea1ed1af24ec

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8328xP.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h44Ar04.exe

      Filesize

      333KB

      MD5

      d472b8c40c2643d66d15deb029b1db19

      SHA1

      0dad68552bd9aaf2c6e690a87b1249c2055adaee

      SHA256

      8f0211de21a86af8b706ae7fca6c94ea5b6257893d34aa633ca1f72c32b342bb

      SHA512

      5aa84956ec14dcabd71290118b1c39d81a2d6ac0769a36b3cce5624c4658791773dca6623e153962f6d828d639449868f48fa32fa3a0c247c49b2f66c1eeea07

    • memory/540-21-0x00007FF9DDC33000-0x00007FF9DDC35000-memory.dmp

      Filesize

      8KB

    • memory/540-22-0x0000000000E20000-0x0000000000E2A000-memory.dmp

      Filesize

      40KB

    • memory/540-23-0x00007FF9DDC33000-0x00007FF9DDC35000-memory.dmp

      Filesize

      8KB

    • memory/1480-60-0x0000000000400000-0x0000000002B03000-memory.dmp

      Filesize

      39.0MB

    • memory/1480-31-0x0000000007660000-0x0000000007678000-memory.dmp

      Filesize

      96KB

    • memory/1480-32-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-39-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-59-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-57-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-55-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-54-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-52-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-49-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-47-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-45-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-43-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-37-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-35-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-33-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-41-0x0000000007660000-0x0000000007672000-memory.dmp

      Filesize

      72KB

    • memory/1480-30-0x0000000007070000-0x0000000007614000-memory.dmp

      Filesize

      5.6MB

    • memory/1480-29-0x00000000048B0000-0x00000000048CA000-memory.dmp

      Filesize

      104KB

    • memory/1480-62-0x0000000000400000-0x0000000002B03000-memory.dmp

      Filesize

      39.0MB

    • memory/4160-78-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-80-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-72-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-68-0x00000000076D0000-0x0000000007714000-memory.dmp

      Filesize

      272KB

    • memory/4160-102-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-100-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-98-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-94-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-92-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-90-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-88-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-86-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-84-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-67-0x0000000004AA0000-0x0000000004AE6000-memory.dmp

      Filesize

      280KB

    • memory/4160-76-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-74-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-70-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-69-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-96-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-82-0x00000000076D0000-0x000000000770E000-memory.dmp

      Filesize

      248KB

    • memory/4160-975-0x0000000007890000-0x0000000007EA8000-memory.dmp

      Filesize

      6.1MB

    • memory/4160-976-0x0000000007F30000-0x000000000803A000-memory.dmp

      Filesize

      1.0MB

    • memory/4160-977-0x0000000008070000-0x0000000008082000-memory.dmp

      Filesize

      72KB

    • memory/4160-978-0x0000000008090000-0x00000000080CC000-memory.dmp

      Filesize

      240KB

    • memory/4160-979-0x00000000081E0000-0x000000000822C000-memory.dmp

      Filesize

      304KB