Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:45

General

  • Target

    25713f2eb1d6852e44abb388f659e1f949ab714d63c002f4044b8ad37ca0ad7b.exe

  • Size

    542KB

  • MD5

    862714656b92bb716d401c7e74153667

  • SHA1

    36b3a2e8c7f2220739bb49f266341eaa877eea41

  • SHA256

    25713f2eb1d6852e44abb388f659e1f949ab714d63c002f4044b8ad37ca0ad7b

  • SHA512

    e2223bb9feb79dd2e4a5b412ea8c4f5a3843160f505a8ff9d2aa54ac963b46fe3b247d118dd64c6004a99021669d3b448140fe71df1e3f775a6df1f54e9ae869

  • SSDEEP

    12288:2MrWy90xyq0k3Mvfx5qlQ4RDeBGhHP11yD7vZJ8G7S:oylq0k8fx6Q4QQ11ovQh

Malware Config

Extracted

Family

redline

Botnet

rumfa

C2

193.233.20.24:4123

Attributes
  • auth_value

    749d02a6b4ef1fa2ad908e44ec2296dc

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25713f2eb1d6852e44abb388f659e1f949ab714d63c002f4044b8ad37ca0ad7b.exe
    "C:\Users\Admin\AppData\Local\Temp\25713f2eb1d6852e44abb388f659e1f949ab714d63c002f4044b8ad37ca0ad7b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vHF5763XK.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vHF5763XK.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw81Rg32Io81.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw81Rg32Io81.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1788
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tUm65kT53.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tUm65kT53.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vHF5763XK.exe

    Filesize

    398KB

    MD5

    14ecd016d126d08997cf96db39e85f29

    SHA1

    c4206732bf2675be06ac9847ca2ec3df940f9aec

    SHA256

    0fc9e3916b028c0b902c52ce092fa211c13e9ac84cf70297ea8d7a82ac051a53

    SHA512

    1ee0eb2ee3d7910b269da1985cb8bb66247a9334da0c364de2c4dd1b1e36dd78c4af9fe992079797d5228345bedc8e41b47cb8bb4c71fe74052ff512068ff089

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw81Rg32Io81.exe

    Filesize

    14KB

    MD5

    bd3547c2b032e5a79ab2fdd17a00823f

    SHA1

    cc612054eac7e33abf09fc1a62924dfdeddaef29

    SHA256

    fb5a009c3a476ddfa384779e520772909785167d5665158179431bb24f750e97

    SHA512

    b4bc2d51c4607a7f091a9a33b4d7f1e0e12d1b69a24ab1df2cfae20bf97435faa0ed88eb381789178848d2fdcfdb0c863ac21e5a17c1e8dc7b29c160048d206e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tUm65kT53.exe

    Filesize

    367KB

    MD5

    1d723ff94958004611f8d9036d32a484

    SHA1

    494b2b1df04dd00bd4a6582ca026b45ed1e26f5e

    SHA256

    ce58c79e2d8396ebc000387ba86ec87273d28bd7dfa8310c49c59b22c7de42af

    SHA512

    9738bf0e92ad9b1f526a48a4262410186a961e0aa9e04ef1ecc4769b29d92339f46e331a65810ce72b27df319260ac8aba0636742690e95bc34f6d59fbf2ff61

  • memory/1788-14-0x00007FFFD67E3000-0x00007FFFD67E5000-memory.dmp

    Filesize

    8KB

  • memory/1788-15-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

    Filesize

    40KB

  • memory/1788-16-0x00007FFFD67E3000-0x00007FFFD67E5000-memory.dmp

    Filesize

    8KB

  • memory/4492-70-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-59-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-24-0x0000000007900000-0x0000000007944000-memory.dmp

    Filesize

    272KB

  • memory/4492-26-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-76-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-66-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-42-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-25-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-88-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-86-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-84-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-82-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-80-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-78-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-74-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-72-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-22-0x00000000072D0000-0x0000000007316000-memory.dmp

    Filesize

    280KB

  • memory/4492-69-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-64-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-62-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-60-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-23-0x0000000007310000-0x00000000078B4000-memory.dmp

    Filesize

    5.6MB

  • memory/4492-56-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-54-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-52-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-50-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-48-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-46-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-44-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-40-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-38-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-36-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-34-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-32-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-30-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-28-0x0000000007900000-0x000000000793E000-memory.dmp

    Filesize

    248KB

  • memory/4492-931-0x0000000007940000-0x0000000007F58000-memory.dmp

    Filesize

    6.1MB

  • memory/4492-932-0x0000000007FE0000-0x00000000080EA000-memory.dmp

    Filesize

    1.0MB

  • memory/4492-933-0x0000000008120000-0x0000000008132000-memory.dmp

    Filesize

    72KB

  • memory/4492-934-0x0000000008240000-0x000000000827C000-memory.dmp

    Filesize

    240KB

  • memory/4492-935-0x0000000008290000-0x00000000082DC000-memory.dmp

    Filesize

    304KB