Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 00:38

General

  • Target

    edb2f3de75052ffdac9578ebaeaca66f2e7537f3fc5642b73e658b0feb7217fe.exe

  • Size

    479KB

  • MD5

    6bae01de1a58a8af27a31fce7a6dd75c

  • SHA1

    9ce431aee55ae29f9825e69883c2235cffc0cbc4

  • SHA256

    edb2f3de75052ffdac9578ebaeaca66f2e7537f3fc5642b73e658b0feb7217fe

  • SHA512

    18293a44a7b398bd26803f057793ad9c5c603fe0ccc3e8ea90d92daf3d9cb3131fc5b89edf84a8da3960bc4cd1566943b93bed14314c99460752072c2838f2ca

  • SSDEEP

    12288:hMrYy90rLM2IhVIvb77QBwu4VYWPbdhI/XYKp:xy3phMX7QBwu4VdPbcXYK

Malware Config

Extracted

Family

redline

Botnet

dona

C2

217.196.96.101:4132

Attributes
  • auth_value

    9fbb198992bbc83a84ab1f21384813e3

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edb2f3de75052ffdac9578ebaeaca66f2e7537f3fc5642b73e658b0feb7217fe.exe
    "C:\Users\Admin\AppData\Local\Temp\edb2f3de75052ffdac9578ebaeaca66f2e7537f3fc5642b73e658b0feb7217fe.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1565214.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1565214.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4530104.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4530104.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2456
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9419649.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9419649.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1340

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1565214.exe

    Filesize

    307KB

    MD5

    50cb385da0c18228d0c437fab967becf

    SHA1

    efae796b3bec758ecc5f8b36b7c03bd87e559795

    SHA256

    587f1589df6ea6534147bb137d104c99916e4aafd15c1554267caea0c13de883

    SHA512

    04f2d7110d4e3e58454b011fc15f2b971c9b579bfb45470985559624b92b494ebcbb1d4edba90f3cc097819179f0eff778f150df08dc87eea9d038a731178487

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4530104.exe

    Filesize

    179KB

    MD5

    1eefdeedee9de5a3ffedcd7560a3ce99

    SHA1

    95dd831c5b68be97e7cf238d4f4a8f39c6a308ce

    SHA256

    cfcc2ae431e01771e1d059539bc9f728c83f4ff690cbaf370eca8b2f33de9bfc

    SHA512

    842a915fc062d70d633ddba7c7ac979219325b36591e5ebb9c40085fe84a6174534a17681227ccae5204aad0f09979cd2b587c803540c6865c046c3f1b0648c1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9419649.exe

    Filesize

    168KB

    MD5

    a7fa568c08bd0c204c9a5f320b5d77cb

    SHA1

    de5d04b3eb09756f4f9da45a4e019cc819661a6a

    SHA256

    eef7b28de4261dc2ba85c8f516969603df7d494c42ccc8e870e9742b43fcba4a

    SHA512

    be86d5ca256c931ab771794fa5a67739ba18a0745266e00e4e72cef381e6bc6f98965d712dacdbf10a590bb4ec16343a4f131214e47a14b4b4a1e117783fab65

  • memory/1340-62-0x00000000056B0000-0x00000000056FC000-memory.dmp

    Filesize

    304KB

  • memory/1340-61-0x0000000005520000-0x000000000555C000-memory.dmp

    Filesize

    240KB

  • memory/1340-60-0x00000000054C0000-0x00000000054D2000-memory.dmp

    Filesize

    72KB

  • memory/1340-59-0x00000000055A0000-0x00000000056AA000-memory.dmp

    Filesize

    1.0MB

  • memory/1340-58-0x0000000005AB0000-0x00000000060C8000-memory.dmp

    Filesize

    6.1MB

  • memory/1340-57-0x0000000001180000-0x0000000001186000-memory.dmp

    Filesize

    24KB

  • memory/1340-56-0x0000000000A00000-0x0000000000A30000-memory.dmp

    Filesize

    192KB

  • memory/2456-34-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-19-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-42-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-40-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-38-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-36-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-47-0x00000000744F0000-0x0000000074CA0000-memory.dmp

    Filesize

    7.7MB

  • memory/2456-32-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-30-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-28-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-26-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-24-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-22-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-48-0x00000000744F0000-0x0000000074CA0000-memory.dmp

    Filesize

    7.7MB

  • memory/2456-49-0x00000000744FE000-0x00000000744FF000-memory.dmp

    Filesize

    4KB

  • memory/2456-50-0x00000000744F0000-0x0000000074CA0000-memory.dmp

    Filesize

    7.7MB

  • memory/2456-52-0x00000000744F0000-0x0000000074CA0000-memory.dmp

    Filesize

    7.7MB

  • memory/2456-45-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-46-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-20-0x0000000002420000-0x0000000002432000-memory.dmp

    Filesize

    72KB

  • memory/2456-17-0x00000000744F0000-0x0000000074CA0000-memory.dmp

    Filesize

    7.7MB

  • memory/2456-18-0x0000000002420000-0x0000000002438000-memory.dmp

    Filesize

    96KB

  • memory/2456-16-0x0000000004B90000-0x0000000005134000-memory.dmp

    Filesize

    5.6MB

  • memory/2456-15-0x0000000002090000-0x00000000020AA000-memory.dmp

    Filesize

    104KB

  • memory/2456-14-0x00000000744FE000-0x00000000744FF000-memory.dmp

    Filesize

    4KB