Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:37

General

  • Target

    d6dc154ee4f7deb5d6ea4d517ef696b6da3819a06e91b574b1382cb36bd29466.exe

  • Size

    660KB

  • MD5

    a1868839dfa3db298827f2f0aa159c2d

  • SHA1

    b97940ceeff790552d1274eb41e1071cbee7948d

  • SHA256

    d6dc154ee4f7deb5d6ea4d517ef696b6da3819a06e91b574b1382cb36bd29466

  • SHA512

    f6a41544c222d1473337f0c8cafa93596bf87fd492ac4f6884543a52ee5a8171bdc72a3828c86950b582f872ed8ee971fc172e484dfee81169f5ea94a04af611

  • SSDEEP

    12288:vMrWy90QP0g7aw+kaY6oACkrI2zhwTe78M513cykrTDJoy9l3N7:dyXaw/wwS8M513cykXqq59

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

dozt

C2

77.91.124.145:4125

Attributes
  • auth_value

    857bdfe4fa14711025859d89f18b32cb

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6dc154ee4f7deb5d6ea4d517ef696b6da3819a06e91b574b1382cb36bd29466.exe
    "C:\Users\Admin\AppData\Local\Temp\d6dc154ee4f7deb5d6ea4d517ef696b6da3819a06e91b574b1382cb36bd29466.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZk7286.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZk7286.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr531728.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr531728.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4264
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku053516.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku053516.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2320
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6640
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 1152
          4⤵
          • Program crash
          PID:7020
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr412176.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr412176.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4220
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2320 -ip 2320
    1⤵
      PID:6896

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr412176.exe

      Filesize

      169KB

      MD5

      b2a714faf69503233508cce8cda1e251

      SHA1

      af306d5ae311826c4b19d26d696a21681238cbf9

      SHA256

      b5e216028f1cde2ad3dea20dd34fa5678161edbc5029bcb9a52fa217ff073d35

      SHA512

      25bf24a0b060b650160ee63bfb10dfbfa578694240ef685c63e10aa907604f1b8f388a0bf63fffbd84b55db0fbecfd63fbaa71d458789779a4667f049f6b4c35

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZk7286.exe

      Filesize

      506KB

      MD5

      faa38678142a9c6ebb9b880126a3ccc2

      SHA1

      b42b7f24f6b77579ed759c5f0de3c64ef1b4e745

      SHA256

      f864bf06db4bab702b2388ed7cac5ebda510b1dae9f5e47173e293c78aa4f548

      SHA512

      1e8c70148de394d5718d477083af5363a7e8987f0c42d3094133628de4cb290ed08ade1f42612f58a2f9c9056290693ffd84db59f5e2ab7befc93e04e1368aef

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr531728.exe

      Filesize

      14KB

      MD5

      45346337d024cda0ef18ef2cb4da67f6

      SHA1

      c3175487f29b84910512b414e6d0fc2d43328d07

      SHA256

      59e31739f6e1b95f9ce566b5231c93cabd69c1ce2831e33e1be9532d5e43ee1d

      SHA512

      d324bc0579966b4775742e9a469cb6728aab5f371b7dcb560a4e34af16e75b8bcb01034d52835063052e8ee2bbf3b3b6c350b5718c1df036e3c8d154d6706dd9

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku053516.exe

      Filesize

      426KB

      MD5

      70d8ecf871ee7c8ede9bf4efaf95df7b

      SHA1

      48421b6f2b9baeefc07022a62f20479f282e0308

      SHA256

      714a62b6cccb6e1bfe3e1f9c4e7163bd01f3ee7eef18e612d4cce3826dc68636

      SHA512

      d1f243b8a401ab6f03aecd1916f89d922411b8566634f89f88931d6d3734c75a815db90b808a3f2298cac5f2ab610c2570cfb094b400c1e7c5791fbc51d61474

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      1073b2e7f778788852d3f7bb79929882

      SHA1

      7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

      SHA256

      c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

      SHA512

      90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

    • memory/2320-56-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-25-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-24-0x0000000005330000-0x0000000005396000-memory.dmp

      Filesize

      408KB

    • memory/2320-32-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-28-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-26-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-46-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-44-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-88-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-84-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-82-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-42-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-76-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-74-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-72-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-68-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-66-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-64-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-62-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-60-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-48-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-22-0x0000000004CD0000-0x0000000004D36000-memory.dmp

      Filesize

      408KB

    • memory/2320-54-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-50-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-58-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-23-0x0000000004D80000-0x0000000005324000-memory.dmp

      Filesize

      5.6MB

    • memory/2320-78-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-40-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-38-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-36-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-34-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-30-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-86-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-80-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-70-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-52-0x0000000005330000-0x000000000538F000-memory.dmp

      Filesize

      380KB

    • memory/2320-2105-0x0000000005540000-0x0000000005572000-memory.dmp

      Filesize

      200KB

    • memory/4220-2129-0x0000000000AF0000-0x0000000000B20000-memory.dmp

      Filesize

      192KB

    • memory/4220-2130-0x0000000002E80000-0x0000000002E86000-memory.dmp

      Filesize

      24KB

    • memory/4264-14-0x00007FFF0C6E3000-0x00007FFF0C6E5000-memory.dmp

      Filesize

      8KB

    • memory/4264-15-0x00000000007B0000-0x00000000007BA000-memory.dmp

      Filesize

      40KB

    • memory/4264-16-0x00007FFF0C6E3000-0x00007FFF0C6E5000-memory.dmp

      Filesize

      8KB

    • memory/6640-2118-0x0000000000BE0000-0x0000000000C10000-memory.dmp

      Filesize

      192KB

    • memory/6640-2119-0x00000000054C0000-0x00000000054C6000-memory.dmp

      Filesize

      24KB

    • memory/6640-2120-0x0000000005BA0000-0x00000000061B8000-memory.dmp

      Filesize

      6.1MB

    • memory/6640-2121-0x0000000005690000-0x000000000579A000-memory.dmp

      Filesize

      1.0MB

    • memory/6640-2122-0x0000000005550000-0x0000000005562000-memory.dmp

      Filesize

      72KB

    • memory/6640-2123-0x00000000055C0000-0x00000000055FC000-memory.dmp

      Filesize

      240KB

    • memory/6640-2124-0x0000000005610000-0x000000000565C000-memory.dmp

      Filesize

      304KB