Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 00:40

General

  • Target

    984f8e6c7ad7ac4c89d98cd6946b5630369246a738492e160377a40b6780afca.exe

  • Size

    1.1MB

  • MD5

    b6cd3facadb987fd507fba64b6098e78

  • SHA1

    f153459f99f1fc4ab7e11030050701180e3e7e29

  • SHA256

    984f8e6c7ad7ac4c89d98cd6946b5630369246a738492e160377a40b6780afca

  • SHA512

    e4d4fb81dac520a500dc2915fc46bd84f8135b810c9ef0645c6cff7417114e8e4eaeb38e5b241b481cefd8474e4d45dbd6fe55d21c8d1cfa59efc61a73c2826c

  • SSDEEP

    24576:8yvT3ArusVvUb5l/NvjqMg+0aNCRRjY/+1Owt90atFOl4o:rvrArusVc5Rpv0mCbjHDt90a3D

Malware Config

Extracted

Family

redline

Botnet

rumfa

C2

193.233.20.24:4123

Attributes
  • auth_value

    749d02a6b4ef1fa2ad908e44ec2296dc

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\984f8e6c7ad7ac4c89d98cd6946b5630369246a738492e160377a40b6780afca.exe
    "C:\Users\Admin\AppData\Local\Temp\984f8e6c7ad7ac4c89d98cd6946b5630369246a738492e160377a40b6780afca.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plVX40lV62.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plVX40lV62.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4304
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plzP30pV87.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plzP30pV87.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plER26Go57.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plER26Go57.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plel48DI47.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plel48DI47.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1560
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bucI62hj56.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bucI62hj56.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3212
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caNf14GV61.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caNf14GV61.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plVX40lV62.exe

    Filesize

    997KB

    MD5

    774ec1b85e2464f6dd976f5b6d45b951

    SHA1

    6e4b495016df3bcc506f381aaff6f9c0db0349dc

    SHA256

    4f63b81561c55d2c60e6f1f817c98ac047c030f2601ea0680e09a58afd4d303c

    SHA512

    d5694da3dbc49085ff15f484ef2cf972f78023737d3f13602accd38d2d4cf96086056e66fe7abed5ae47719fa20da59bc68ac517640a8e91e9c2c46ce6aa1651

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plzP30pV87.exe

    Filesize

    894KB

    MD5

    1670fe2dbe107a0ba3686654fae3a45e

    SHA1

    116d8089e6f90247c212873f19e5aad458796628

    SHA256

    033ee569e3c02d815de203af44e906d6689e4450c0c6884544be6da7945aa778

    SHA512

    4d11865d0365c84236e88f36ff12abd0b1229b82b3d897b67fd20ace3497d3c4a1cf9bc16230a00027f2a2863e44ca9cb8f6744997dd920f19012baaa7613b9f

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plER26Go57.exe

    Filesize

    667KB

    MD5

    b3276b3addc278a3dd6ab5202a90ecf9

    SHA1

    e0accbc721bd261e1dd5f7ac9f33452312db9538

    SHA256

    10ae59c17e79537fa44eb36f1bd02a577e020019e5bb4c9446189c8b08457534

    SHA512

    e07c1b25f2e940600ee4c121bfca2e45f26db4000acaf42cb45ddba5b5f8a9a59c43faccf55d9d96f2015f3e65ee8f1403be859b86709042f18c0342dce60eb3

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plel48DI47.exe

    Filesize

    391KB

    MD5

    1adfa2e21a1b14455f10c6bdb3b5b7c8

    SHA1

    a64cd7a61ce216e6124d5e8515068db67041da93

    SHA256

    67c3953eb171e68d650a29107070cf67108f67fa540ac2a2a35796d074994404

    SHA512

    eb9662c30bad9d5481558660e5f1078e7851ee674744496164c97019129aeeea7ed040ab59f3b32f3ca7e5d69b2fff47f695b5b2b2326fcbef069385bd012ca2

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bucI62hj56.exe

    Filesize

    16KB

    MD5

    7a509dfc2f1613b8abb6a38067f5e702

    SHA1

    66a278d414da14ee48086943733e5f2090cdc50a

    SHA256

    079a657f4163edff371bfd164a82e0e02d2aae7efabd0967ea1437c4c608686c

    SHA512

    3d6a9438787e7e135def1877efe883b1e7542559b166925e30c8b8088a737d496ddc2cf68b96a8dc88988bc3a2d08f7b8a97c8227efc558418195a4594b8afb3

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caNf14GV61.exe

    Filesize

    302KB

    MD5

    47edc698fb60063cef4e63ee2d5d05bc

    SHA1

    8f7bc644d7a378df490ab77d7b3b9b2a25a870fa

    SHA256

    2561279e13e55b30c371c6d72c72bf9124697eec6395f1c1dfbbdd8ac3f5557f

    SHA512

    b6c7b5288217bd01efe5ee9ec396dc7471240749a9f8998ddec34f7a2a073bfaa062e4a72986d0dcb73e283dc60e0cfcd0885a2e68014598e86277dd80082715

  • memory/3212-35-0x0000000000760000-0x000000000076A000-memory.dmp

    Filesize

    40KB

  • memory/4672-81-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-73-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-43-0x0000000004B60000-0x0000000004BA4000-memory.dmp

    Filesize

    272KB

  • memory/4672-49-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-59-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-107-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-105-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-103-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-101-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-99-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-95-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-93-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-91-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-89-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-87-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-85-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-83-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-41-0x0000000004AA0000-0x0000000004AE6000-memory.dmp

    Filesize

    280KB

  • memory/4672-79-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-77-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-75-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-42-0x0000000004BC0000-0x0000000005164000-memory.dmp

    Filesize

    5.6MB

  • memory/4672-71-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-950-0x00000000051C0000-0x00000000057D8000-memory.dmp

    Filesize

    6.1MB

  • memory/4672-69-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-67-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-951-0x0000000005860000-0x000000000596A000-memory.dmp

    Filesize

    1.0MB

  • memory/4672-65-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-63-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-57-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-55-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-53-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-51-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-97-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-61-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-47-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-45-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-44-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/4672-952-0x00000000059A0000-0x00000000059B2000-memory.dmp

    Filesize

    72KB

  • memory/4672-953-0x0000000005AC0000-0x0000000005AFC000-memory.dmp

    Filesize

    240KB

  • memory/4672-954-0x0000000005B10000-0x0000000005B5C000-memory.dmp

    Filesize

    304KB