Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:36

General

  • Target

    c184dbb9f3891a327e64de36b10eefacc9695222fd7532e0d96093266eb932a4.exe

  • Size

    672KB

  • MD5

    f24c7605313ae7acbb341af402cdd73c

  • SHA1

    411c1a894ad258cd121f5e87a7958406aef59118

  • SHA256

    c184dbb9f3891a327e64de36b10eefacc9695222fd7532e0d96093266eb932a4

  • SHA512

    a82baeb888a5f200a5ab034f357e01dcfd149afbf387407714f078812feadca41210cacecd6d11604b388ffd9fa647abc07f47a3e2def73aff8d97954a857ffc

  • SSDEEP

    12288:KMrUy90pVpXC/bmKvBvbrqR7i0j3m3NvjIomIQ+Y0O/dpCkYY6Z5:iycX1KxbOFDTm9v8ohlCskm7

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c184dbb9f3891a327e64de36b10eefacc9695222fd7532e0d96093266eb932a4.exe
    "C:\Users\Admin\AppData\Local\Temp\c184dbb9f3891a327e64de36b10eefacc9695222fd7532e0d96093266eb932a4.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un320396.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un320396.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6351.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6351.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3956
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 1080
          4⤵
          • Program crash
          PID:4992
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0264.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0264.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4068
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3956 -ip 3956
    1⤵
      PID:2840
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:5188

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un320396.exe

      Filesize

      530KB

      MD5

      852eeaa450caf96d43b42f26af0620a2

      SHA1

      6445861ee7daa261a82340dc34146e03a529b9ad

      SHA256

      478a8eb9c2964ea2c9065a2d273b294c9cf302eff774057c4abb31d5a892ccf5

      SHA512

      68c761f8d35e82d445c75a0a12f95e6afd0dfdc7db596b218df517946b95e10044b6a553fc6a95dab10d0c8465e01c7fc7407e700584619cdea9286308cc67ff

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6351.exe

      Filesize

      259KB

      MD5

      59037a5e63f45c484ab5a3b43d03485b

      SHA1

      a73851b81de83c916c664472d75e5e61a0f762cd

      SHA256

      59e1d8ed2581dceb507cf50d0bc2a08a2b10ee57b81f55f58e01189a6076ad99

      SHA512

      e25db725830ba1458ebcff1602f2d3161991fcd7eaba730cfa7010b3546e15ddf5ccdf4d2f01d3fa5f3e62ad2b86e060da86caf4d0b910e2fb7b66f9e38516c3

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0264.exe

      Filesize

      318KB

      MD5

      dde4703ee3e3c33863fa3daba1d7dca2

      SHA1

      e65ee73b22140de68fe8bfd1fd36b9f23995a450

      SHA256

      ba150080b2ee0d52f2e92b9291d8c79cf16466ae1d4a0f8d75d94065d4b9cf7a

      SHA512

      3e83ceff6e9c25eebd1267ffb28ca48249b88bf9089a0c5fdace3a9b26a4e21cb2f2dba38296b0c5efe89eab6e39d6cf3d29536d882e1c6c699b270e493a8a67

    • memory/3956-15-0x0000000000710000-0x0000000000810000-memory.dmp

      Filesize

      1024KB

    • memory/3956-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/3956-16-0x0000000000640000-0x000000000066D000-memory.dmp

      Filesize

      180KB

    • memory/3956-18-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/3956-19-0x0000000002290000-0x00000000022AA000-memory.dmp

      Filesize

      104KB

    • memory/3956-20-0x0000000004B10000-0x00000000050B4000-memory.dmp

      Filesize

      5.6MB

    • memory/3956-21-0x00000000022F0000-0x0000000002308000-memory.dmp

      Filesize

      96KB

    • memory/3956-47-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-49-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-45-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-43-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-41-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-39-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-37-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-35-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-33-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-31-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-30-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-27-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-25-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-23-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-22-0x00000000022F0000-0x0000000002302000-memory.dmp

      Filesize

      72KB

    • memory/3956-50-0x0000000000710000-0x0000000000810000-memory.dmp

      Filesize

      1024KB

    • memory/3956-51-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/3956-54-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/3956-55-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4068-60-0x0000000002510000-0x0000000002556000-memory.dmp

      Filesize

      280KB

    • memory/4068-61-0x0000000004A90000-0x0000000004AD4000-memory.dmp

      Filesize

      272KB

    • memory/4068-67-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-75-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-95-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-93-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-91-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-89-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-87-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-85-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-83-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-81-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-79-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-73-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-71-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-69-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-77-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-65-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-63-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-62-0x0000000004A90000-0x0000000004ACF000-memory.dmp

      Filesize

      252KB

    • memory/4068-968-0x00000000050F0000-0x0000000005708000-memory.dmp

      Filesize

      6.1MB

    • memory/4068-969-0x0000000005790000-0x000000000589A000-memory.dmp

      Filesize

      1.0MB

    • memory/4068-970-0x00000000058D0000-0x00000000058E2000-memory.dmp

      Filesize

      72KB

    • memory/4068-971-0x00000000058F0000-0x000000000592C000-memory.dmp

      Filesize

      240KB

    • memory/4068-972-0x0000000005A40000-0x0000000005A8C000-memory.dmp

      Filesize

      304KB