Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:25

General

  • Target

    7057c5b820e32ecc3e8a8f07cbc7f7cd93165b00f19ef85c0c6f4556ada1c9b6.exe

  • Size

    693KB

  • MD5

    7f324fb5d7febf14003c308e68b21465

  • SHA1

    7fc5fe515ce585b516d5aeea9b6e40e772e174eb

  • SHA256

    7057c5b820e32ecc3e8a8f07cbc7f7cd93165b00f19ef85c0c6f4556ada1c9b6

  • SHA512

    1167706e37c93ecc40ea12480c8196f0d1579236ef94f4c8f7cb0cffad38a9cc7781329da47a02eb78221e98c6b0cc8634dab0a43faba0c74c3ba799da513075

  • SSDEEP

    12288:6MrIy90DDeyywSmKuf+K2+FtBg0wimcgQxDGwEOPa8crbl/EsXaA8:WyUDey2uWb+FtBgomw+Tbl/t8

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7057c5b820e32ecc3e8a8f07cbc7f7cd93165b00f19ef85c0c6f4556ada1c9b6.exe
    "C:\Users\Admin\AppData\Local\Temp\7057c5b820e32ecc3e8a8f07cbc7f7cd93165b00f19ef85c0c6f4556ada1c9b6.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nqi9270hJ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nqi9270hJ.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9449yW.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9449yW.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4880
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c79Al04.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c79Al04.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nqi9270hJ.exe

    Filesize

    548KB

    MD5

    7b7054e01004a1fdd70f4035e08fd5c5

    SHA1

    260f6a51667cb5e0f388d14eee51656803b2955c

    SHA256

    7599e5a93ad768ea55f073927846365ab31d2622a975b42dbfc42b1925848a91

    SHA512

    af90f8b3e9430ea83a3ff24ccb483cecd9fb6421fe95b2b03664f8430ca0e3da7f140165ffe067359805f6f4792914a6f38dc2d3b4eeabb2115ab84782a83acd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9449yW.exe

    Filesize

    323KB

    MD5

    ee43881ab62092621b2d2e22a0295878

    SHA1

    0339221e3f787602fea6a0541817565d751a293c

    SHA256

    2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

    SHA512

    df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c79Al04.exe

    Filesize

    380KB

    MD5

    cd30df0759fea97083bdf62f610ec081

    SHA1

    864bf5a66a31bf4bd217fa7c5496c9759211da26

    SHA256

    7ac406e27ae45f23178785c807d52d6cf2954038e445f33f09b1fc5fa0e78ce0

    SHA512

    13491b8f0b4a4c890f741825a8cf5903f857c33503a8f7ce61c543174693c9925f8ceb4847a92a148394d892adf8d9fed095cdac5cdbc9d84302f0f3c620883b

  • memory/2780-73-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-77-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-969-0x0000000005830000-0x000000000593A000-memory.dmp

    Filesize

    1.0MB

  • memory/2780-968-0x0000000005210000-0x0000000005828000-memory.dmp

    Filesize

    6.1MB

  • memory/2780-95-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-63-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-65-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-67-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-69-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-71-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-971-0x0000000005940000-0x000000000597C000-memory.dmp

    Filesize

    240KB

  • memory/2780-972-0x0000000005A80000-0x0000000005ACC000-memory.dmp

    Filesize

    304KB

  • memory/2780-75-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-970-0x0000000004C10000-0x0000000004C22000-memory.dmp

    Filesize

    72KB

  • memory/2780-79-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-81-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-83-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-85-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-87-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-89-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-93-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-91-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-62-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/2780-61-0x0000000004AD0000-0x0000000004B14000-memory.dmp

    Filesize

    272KB

  • memory/2780-60-0x0000000002540000-0x0000000002586000-memory.dmp

    Filesize

    280KB

  • memory/4880-41-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-55-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/4880-54-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/4880-51-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/4880-50-0x0000000000640000-0x0000000000740000-memory.dmp

    Filesize

    1024KB

  • memory/4880-49-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-23-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-25-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-27-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-29-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-31-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-34-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-36-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-37-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-39-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-43-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-45-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-47-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-22-0x0000000004A70000-0x0000000004A82000-memory.dmp

    Filesize

    72KB

  • memory/4880-21-0x0000000004A70000-0x0000000004A88000-memory.dmp

    Filesize

    96KB

  • memory/4880-20-0x0000000004B20000-0x00000000050C4000-memory.dmp

    Filesize

    5.6MB

  • memory/4880-19-0x00000000022F0000-0x000000000230A000-memory.dmp

    Filesize

    104KB

  • memory/4880-18-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/4880-16-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/4880-17-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/4880-15-0x0000000000640000-0x0000000000740000-memory.dmp

    Filesize

    1024KB