Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:44

General

  • Target

    af12c1a05e2108674465d41a7a91c8f466d004ba9dde525f17bc5715a62e3fe3.exe

  • Size

    656KB

  • MD5

    a0d87123b314ead24067acf661d2b8ec

  • SHA1

    76d6604aef4a9f26ffeaad8026582df203cbf465

  • SHA256

    af12c1a05e2108674465d41a7a91c8f466d004ba9dde525f17bc5715a62e3fe3

  • SHA512

    d569e5c53f23398c8def55bff6e26813aa1797509d5d0f2c9b03fb53c5c2a25a6a3c02495ce75249205944f4feebfda5599f568998802cd36c3f1e3b0a7584f4

  • SSDEEP

    12288:lMrny903VhjTxhdJOxTyP2Y/8NVNIVAmJcqOfniQ:uyiNdhCDY/dnzO6Q

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af12c1a05e2108674465d41a7a91c8f466d004ba9dde525f17bc5715a62e3fe3.exe
    "C:\Users\Admin\AppData\Local\Temp\af12c1a05e2108674465d41a7a91c8f466d004ba9dde525f17bc5715a62e3fe3.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr982759.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr982759.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1812
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 1084
        3⤵
        • Program crash
        PID:2472
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu352695.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu352695.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1080
      • C:\Windows\Temp\1.exe
        "C:\Windows\Temp\1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 984
        3⤵
        • Program crash
        PID:5504
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1812 -ip 1812
    1⤵
      PID:1544
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1080 -ip 1080
      1⤵
        PID:5408

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr982759.exe

        Filesize

        254KB

        MD5

        2f5e95bae6338a9237217fd9d66c1619

        SHA1

        7345525e8c91ca99ce658554dca6ee22edc845fb

        SHA256

        45adf96b2ffd321bbfaeb234f2c7f4bbd4270a3da6fcec06a56f0d0e9528db59

        SHA512

        3834a6b1f1e26374946d83f8296c673eb1c2744e8f665c23fb0e12d9dca25fbda85eaad80cba88627e52f61e85e07ec53bbed5281e279c90c613eb837a6d1d6b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu352695.exe

        Filesize

        438KB

        MD5

        bcc9bcea37b0ee7e048fcc8ec68b89db

        SHA1

        fa6b0bed900af35aa644a7f6c65323af01114fee

        SHA256

        c577e44873246a2250e39c72de31b6b9bf620499000c1b1bbd0c360d9062b5fd

        SHA512

        55b06e7742b317c69e076e684bb7115be57bf600a4c8d5b41143f906941eedd8cf052abeb36e8760094fc4094f4689b8d02104e7f66f70cf84a37dc3ee05fa70

      • C:\Windows\Temp\1.exe

        Filesize

        168KB

        MD5

        03728fed675bcde5256342183b1d6f27

        SHA1

        d13eace7d3d92f93756504b274777cc269b222a2

        SHA256

        f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

        SHA512

        6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

      • memory/1080-72-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-68-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-2222-0x0000000000400000-0x00000000004DD000-memory.dmp

        Filesize

        884KB

      • memory/1080-2201-0x0000000005400000-0x0000000005432000-memory.dmp

        Filesize

        200KB

      • memory/1080-59-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-60-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-56-0x0000000004BC0000-0x0000000004C28000-memory.dmp

        Filesize

        416KB

      • memory/1080-62-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-64-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-70-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-74-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-78-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-80-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-83-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-84-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-86-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-88-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-90-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-92-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-76-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-66-0x00000000051E0000-0x0000000005240000-memory.dmp

        Filesize

        384KB

      • memory/1080-53-0x0000000000400000-0x00000000004DD000-memory.dmp

        Filesize

        884KB

      • memory/1080-55-0x0000000000400000-0x00000000004DD000-memory.dmp

        Filesize

        884KB

      • memory/1080-54-0x0000000000400000-0x00000000004DD000-memory.dmp

        Filesize

        884KB

      • memory/1080-57-0x0000000000400000-0x00000000004DD000-memory.dmp

        Filesize

        884KB

      • memory/1080-58-0x00000000051E0000-0x0000000005246000-memory.dmp

        Filesize

        408KB

      • memory/1812-22-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-24-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-47-0x0000000000400000-0x00000000004AF000-memory.dmp

        Filesize

        700KB

      • memory/1812-10-0x0000000000400000-0x00000000004AF000-memory.dmp

        Filesize

        700KB

      • memory/1812-44-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/1812-43-0x0000000000740000-0x0000000000840000-memory.dmp

        Filesize

        1024KB

      • memory/1812-9-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/1812-26-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-42-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-28-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-30-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-32-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-34-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-11-0x0000000000400000-0x00000000004AF000-memory.dmp

        Filesize

        700KB

      • memory/1812-38-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-18-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-40-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-48-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/1812-36-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-15-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-16-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-20-0x00000000025B0000-0x00000000025C2000-memory.dmp

        Filesize

        72KB

      • memory/1812-14-0x00000000025B0000-0x00000000025C8000-memory.dmp

        Filesize

        96KB

      • memory/1812-13-0x0000000004BA0000-0x0000000005144000-memory.dmp

        Filesize

        5.6MB

      • memory/1812-8-0x0000000000740000-0x0000000000840000-memory.dmp

        Filesize

        1024KB

      • memory/1812-12-0x00000000021A0000-0x00000000021BA000-memory.dmp

        Filesize

        104KB

      • memory/5024-2215-0x00000000006D0000-0x00000000006D6000-memory.dmp

        Filesize

        24KB

      • memory/5024-2216-0x0000000004FE0000-0x00000000055F8000-memory.dmp

        Filesize

        6.1MB

      • memory/5024-2217-0x0000000004AD0000-0x0000000004BDA000-memory.dmp

        Filesize

        1.0MB

      • memory/5024-2218-0x0000000002210000-0x0000000002222000-memory.dmp

        Filesize

        72KB

      • memory/5024-2219-0x0000000004A00000-0x0000000004A3C000-memory.dmp

        Filesize

        240KB

      • memory/5024-2220-0x0000000004A50000-0x0000000004A9C000-memory.dmp

        Filesize

        304KB

      • memory/5024-2214-0x0000000000020000-0x000000000004E000-memory.dmp

        Filesize

        184KB