Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:36

General

  • Target

    913ec95ce0b8f6409bea020e5e1cba873c2239e01650415a32525b5cc0d5b6dd.exe

  • Size

    672KB

  • MD5

    62dd9da6c9d7288a1332cba5e24e2a39

  • SHA1

    528f1f357676367e4a130a7edbfabe41f7712731

  • SHA256

    913ec95ce0b8f6409bea020e5e1cba873c2239e01650415a32525b5cc0d5b6dd

  • SHA512

    2191497e2d705b093cc0d1eb2ba5c86649c88860303a28cdeb9f52c909323b8066957c83893360757199547b74a249eae6eb1abac168dce15d716b263e9d3b96

  • SSDEEP

    12288:vMrsy90m2sEyoiT/DQQZY0fgFpMBk9rduG8QJ3LquiItDV02q:/y5OiTLDG0fCMBk9YGJ3GupDPq

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\913ec95ce0b8f6409bea020e5e1cba873c2239e01650415a32525b5cc0d5b6dd.exe
    "C:\Users\Admin\AppData\Local\Temp\913ec95ce0b8f6409bea020e5e1cba873c2239e01650415a32525b5cc0d5b6dd.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3276
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un329431.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un329431.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7720.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7720.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1300
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 1088
          4⤵
          • Program crash
          PID:3312
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6622.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6622.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1300 -ip 1300
    1⤵
      PID:836

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un329431.exe

      Filesize

      530KB

      MD5

      1df5f927201918e0db2bbe4dcdb36da2

      SHA1

      fe8cfbcda0fb2ea3ae7b863dc3fcbf883c87c4ae

      SHA256

      0d7d488676e0406c8611d29a932dcc511f5972cd7b348f03f107f526fc425e8b

      SHA512

      f2e32adf050a62c3e5621045f5b4775abddc5252775a6e76f86273bd3844f63dc4ee0fdebff4fef36c0a518b82f7163e799c278f6b27b21d95bcd9f65c8f8541

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7720.exe

      Filesize

      301KB

      MD5

      6e0b64cddcaf6c7380af58b4ec4ff64f

      SHA1

      669ed2bce426e0f1f2cd2860b694f9ee872db952

      SHA256

      88204d56b35661eb94b8a6ed5983f0a866ca2eff4b6fa0ab70e0770ae4c7611e

      SHA512

      8ef1094001bc00247c385cc576a373fc26a91b1d35f2595362e6d431a454f4c553016be1475868056099160279780a4a15d611a3cdaa9f34e06e4e6cd4321064

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6622.exe

      Filesize

      359KB

      MD5

      64a27ebbd74f9d0595a042b2cda69c6e

      SHA1

      5158428757b2892206e5f41a4c97bd585cf41ff8

      SHA256

      0da0a5560522d6402c5a4ab05794c138eca722d0bf6ce9c5dde414ac6232166f

      SHA512

      8e6235183977424509d635852e11883efc756f87f8030824694909eedbdbff1e62657bd937fad549c540605a6c905f467bca709debfe8bd7acf13b5349a5304b

    • memory/1300-16-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/1300-15-0x0000000001CC0000-0x0000000001DC0000-memory.dmp

      Filesize

      1024KB

    • memory/1300-17-0x0000000000400000-0x0000000001AE3000-memory.dmp

      Filesize

      22.9MB

    • memory/1300-18-0x0000000003AC0000-0x0000000003ADA000-memory.dmp

      Filesize

      104KB

    • memory/1300-19-0x0000000000400000-0x0000000001AE3000-memory.dmp

      Filesize

      22.9MB

    • memory/1300-20-0x0000000006310000-0x00000000068B4000-memory.dmp

      Filesize

      5.6MB

    • memory/1300-21-0x00000000061C0000-0x00000000061D8000-memory.dmp

      Filesize

      96KB

    • memory/1300-49-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-47-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-45-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-43-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-41-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-39-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-37-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-35-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-33-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-31-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-29-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-27-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-25-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-23-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-22-0x00000000061C0000-0x00000000061D2000-memory.dmp

      Filesize

      72KB

    • memory/1300-50-0x0000000001CC0000-0x0000000001DC0000-memory.dmp

      Filesize

      1024KB

    • memory/1300-51-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/1300-54-0x0000000000400000-0x0000000001AE3000-memory.dmp

      Filesize

      22.9MB

    • memory/1300-55-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4796-60-0x0000000003900000-0x0000000003946000-memory.dmp

      Filesize

      280KB

    • memory/4796-61-0x0000000003C30000-0x0000000003C74000-memory.dmp

      Filesize

      272KB

    • memory/4796-67-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-69-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-81-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-65-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-63-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-62-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-96-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-93-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-91-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-89-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-87-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-85-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-83-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-968-0x0000000006730000-0x0000000006D48000-memory.dmp

      Filesize

      6.1MB

    • memory/4796-969-0x0000000006DD0000-0x0000000006EDA000-memory.dmp

      Filesize

      1.0MB

    • memory/4796-79-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-77-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-75-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-73-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-970-0x0000000006F10000-0x0000000006F22000-memory.dmp

      Filesize

      72KB

    • memory/4796-71-0x0000000003C30000-0x0000000003C6F000-memory.dmp

      Filesize

      252KB

    • memory/4796-971-0x0000000006F30000-0x0000000006F6C000-memory.dmp

      Filesize

      240KB

    • memory/4796-972-0x0000000007080000-0x00000000070CC000-memory.dmp

      Filesize

      304KB