Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 00:35

General

  • Target

    f75d7dc119562a4147c0b2b851f23a5ea602f8afc69b01431f6326badada222b.exe

  • Size

    1.0MB

  • MD5

    ccc0e02304d59945e0e89828bb90ee8c

  • SHA1

    14eb412ec9a39d1ebecb1ce716a8ec020af927ae

  • SHA256

    f75d7dc119562a4147c0b2b851f23a5ea602f8afc69b01431f6326badada222b

  • SHA512

    d67af69e7967fd6bc504ce41b55f0727e14bfe8b3268ccb85b12bdc4fbfa41f9d9eb09de85eeb6e43fcc98fdf14c2606399136176ce5c7e28d57ab364469a02e

  • SSDEEP

    24576:+ym14i3zV71y36LdxX7ZrA/IXc+81ZVk0:Nm1B7HdxXdrAwXcfBk

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

dezik

C2

77.91.124.145:4125

Attributes
  • auth_value

    afab3a79f84bd5003ef2824211bcf14e

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f75d7dc119562a4147c0b2b851f23a5ea602f8afc69b01431f6326badada222b.exe
    "C:\Users\Admin\AppData\Local\Temp\f75d7dc119562a4147c0b2b851f23a5ea602f8afc69b01431f6326badada222b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un143007.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un143007.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3728
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un718758.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un718758.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr074599.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr074599.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1472
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1084
            5⤵
            • Program crash
            PID:3016
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu317361.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu317361.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3180
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1524
            5⤵
            • Program crash
            PID:5856
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk168397.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk168397.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5712
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1472 -ip 1472
    1⤵
      PID:3604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3448 -ip 3448
      1⤵
        PID:6000

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un143007.exe

        Filesize

        801KB

        MD5

        e06742773d31085198854f575b1836f8

        SHA1

        6e932fc5f974b51d61cd62b948663eef7f29f96a

        SHA256

        70e8e6132c436aa1383d9659c75e7c6c2df99e4122eb655792ea8f6d6c43e35d

        SHA512

        16f60d6edd227a0fcf8028c5524c4bba70e403854eaccebdfacb68ab29686ef8da9a7a1b8b14d3af640a1ee142b61d67f253d3f502343e942448523e45fe5700

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk168397.exe

        Filesize

        168KB

        MD5

        c5ab4a92d7b28c9e63598bf2eeade8e2

        SHA1

        e436d4127b8b2ab606d9815543b0d13c5d3b9c83

        SHA256

        9fdf95fef12de09adfacb495304be004bdd286c24f5c65e4b476a9b77e3d16fb

        SHA512

        ebab87641725b6d1849969abce588c4e6d957da11492b24bd37ca88ca9f010cd53d054116ce67a46cc6f82622f99779a4bbfbd28c9b62eb545396ab56372cf86

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un718758.exe

        Filesize

        648KB

        MD5

        dfcad12707a38edf22439b2cb99a9547

        SHA1

        4d61ed35d4d327b63cf30fc79e6d27d775b7341e

        SHA256

        00d62480c93aba85cbbbd1d52e28f9e6d7ba949ae6f3243763e8606ac67bb65f

        SHA512

        cf972f2325cfcf0bc1ccf56f1ab1f6553eaf70828621dd817ec920684d3cc84a309d4dff72bb361b215f96cfbdbb96e26a5545cf9e21ad1e2e9cf24e7a12b3f8

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr074599.exe

        Filesize

        242KB

        MD5

        a9cd83a7e7d6417bb347e00d2dd3fbbd

        SHA1

        5eabe660a1e8d7e1aee3bede29da6cd4da5c616d

        SHA256

        f9a1dd637e9227a995968d8809e73094a2642f2bdbb086d6196b0c36ba2be873

        SHA512

        9338087c81bf8cc8b20a668381d7ef3da8627fc6c7d517235e281cad30e78da4d428721b95c0cde7bde35c4c141e9f39d7f4097fd46ba32dd18c09df9c5c29e3

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu317361.exe

        Filesize

        427KB

        MD5

        3953945d244f0372c5897744aed4f964

        SHA1

        04c58f273c37b63292311b94f2573e903964e05f

        SHA256

        a1758069b120f8bbceeda056b3a9cf8b53e6db8233d38594b915295c5ce7114d

        SHA512

        49b6e2cfe78c8d201f803d1e729ef4985a5b641ab7b0f2da429c5dfd364977aa50e03dc81d3650e5526ada2c16cb4cc4fe63de86e82cc46262bb432f8bbd92c9

      • C:\Windows\Temp\1.exe

        Filesize

        168KB

        MD5

        1073b2e7f778788852d3f7bb79929882

        SHA1

        7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

        SHA256

        c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

        SHA512

        90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

      • memory/1472-62-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/1472-57-0x00000000005B0000-0x00000000005DD000-memory.dmp

        Filesize

        180KB

      • memory/1472-27-0x00000000025F0000-0x0000000002608000-memory.dmp

        Filesize

        96KB

      • memory/1472-37-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-55-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-53-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-22-0x00000000006F0000-0x00000000007F0000-memory.dmp

        Filesize

        1024KB

      • memory/1472-49-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-47-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-45-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-43-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-41-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-39-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-31-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-29-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-28-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-35-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-33-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/1472-56-0x00000000006F0000-0x00000000007F0000-memory.dmp

        Filesize

        1024KB

      • memory/1472-23-0x00000000005B0000-0x00000000005DD000-memory.dmp

        Filesize

        180KB

      • memory/1472-58-0x0000000000400000-0x00000000004AA000-memory.dmp

        Filesize

        680KB

      • memory/1472-59-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/1472-61-0x0000000000400000-0x00000000004AA000-memory.dmp

        Filesize

        680KB

      • memory/1472-25-0x0000000002460000-0x000000000247A000-memory.dmp

        Filesize

        104KB

      • memory/1472-24-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/1472-26-0x0000000004BC0000-0x0000000005164000-memory.dmp

        Filesize

        5.6MB

      • memory/1472-51-0x00000000025F0000-0x0000000002602000-memory.dmp

        Filesize

        72KB

      • memory/3180-2162-0x0000000000190000-0x00000000001C0000-memory.dmp

        Filesize

        192KB

      • memory/3180-2168-0x0000000004BC0000-0x0000000004C0C000-memory.dmp

        Filesize

        304KB

      • memory/3180-2167-0x0000000004B80000-0x0000000004BBC000-memory.dmp

        Filesize

        240KB

      • memory/3180-2166-0x0000000004A00000-0x0000000004A12000-memory.dmp

        Filesize

        72KB

      • memory/3180-2165-0x0000000004C50000-0x0000000004D5A000-memory.dmp

        Filesize

        1.0MB

      • memory/3180-2164-0x0000000005160000-0x0000000005778000-memory.dmp

        Filesize

        6.1MB

      • memory/3180-2163-0x0000000004970000-0x0000000004976000-memory.dmp

        Filesize

        24KB

      • memory/3448-102-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-2149-0x0000000005440000-0x0000000005472000-memory.dmp

        Filesize

        200KB

      • memory/3448-98-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-96-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-94-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-92-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-78-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-86-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-71-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-82-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-80-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-100-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-76-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-84-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-69-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-72-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-74-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-67-0x0000000004A20000-0x0000000004A86000-memory.dmp

        Filesize

        408KB

      • memory/3448-68-0x0000000005270000-0x00000000052D6000-memory.dmp

        Filesize

        408KB

      • memory/3448-88-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/3448-90-0x0000000005270000-0x00000000052CF000-memory.dmp

        Filesize

        380KB

      • memory/5712-2173-0x0000000000210000-0x000000000023E000-memory.dmp

        Filesize

        184KB

      • memory/5712-2174-0x0000000004A30000-0x0000000004A36000-memory.dmp

        Filesize

        24KB