Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:27

General

  • Target

    db08ceb7774d4313593607d0940166a34b23f820b0c3ae6f0bf3fdf1efc9c1fb.exe

  • Size

    814KB

  • MD5

    79757af02d2983836ac7701cfd872e6c

  • SHA1

    483c12e81cd65d013144a6fd3e6432b92e6dc656

  • SHA256

    db08ceb7774d4313593607d0940166a34b23f820b0c3ae6f0bf3fdf1efc9c1fb

  • SHA512

    4bfb486744e279f931967a2e3c84f3a2f2a431537d8a1fd8bc25ca036d2b29e4dd5623d95e2f2bba9d50c3e104e0b1ba5deafca6a42b83f6981e0ec649031353

  • SSDEEP

    24576:zy1mvHd919R7YZbXVWVTbMyDkoUoM41Xeee:GIv99voqT1Ke

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db08ceb7774d4313593607d0940166a34b23f820b0c3ae6f0bf3fdf1efc9c1fb.exe
    "C:\Users\Admin\AppData\Local\Temp\db08ceb7774d4313593607d0940166a34b23f820b0c3ae6f0bf3fdf1efc9c1fb.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un923068.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un923068.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4428
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8116.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8116.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:752
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 1080
          4⤵
          • Program crash
          PID:4280
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7488.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7488.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5188
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1368
          4⤵
          • Program crash
          PID:5864
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si421498.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si421498.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1288
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 752 -ip 752
    1⤵
      PID:2104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4084 -ip 4084
      1⤵
        PID:5304
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:1904

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si421498.exe

        Filesize

        169KB

        MD5

        4c170de9445862e42a95e37e56d4c2a4

        SHA1

        2cbb804339b25d51718715c44c1d9f17e78d4fc3

        SHA256

        453f9e8e0522830c92d3ced373dd3880c25e2e2563ea91879c7defa392a28778

        SHA512

        8a48dbc3f2a3e6423d8628d4f1c76f754f270af5ba47ce7929baefd13866f04eafb6ef2a71be7c7a8bfccbd0fe226317c1227772e54e5104524df4faf8fe07d2

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un923068.exe

        Filesize

        661KB

        MD5

        6aa709db9721ebcea95016173847b913

        SHA1

        35f6371a415c8b280a50d3e860a1dca90c54c5a7

        SHA256

        88a7f7f30fa954e111f1ec9b98eba1a79a0451a5108ae02eeb182f70168d567c

        SHA512

        7784418d150a392005c397a61d891926c32cf94628e860257069e9b9059ef16909b9063f1d41123d9946af4f93184b6342f7fbd5c67c4e1f459de91ab3eb2725

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8116.exe

        Filesize

        312KB

        MD5

        75bdd59545539c71d9aed8b4233ddf05

        SHA1

        3d1079ed02c02a67b4c6bed653008d55827c753b

        SHA256

        dbf297c2cef81aa6c051dadb2c70856b634b0288e715e7597f2f04b4d9648d53

        SHA512

        299be71af53e1a8061933e1ec91d9452acb45e7be86f8e00a4ed3b792984a7383e78573a33190c194daaa26d9fbcfde2084bf13825917181c9983c3e42474c8d

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7488.exe

        Filesize

        495KB

        MD5

        0b82c1ee16013438479168dba6304175

        SHA1

        45ef07aa1a75d24c8defe7c811338884ab694645

        SHA256

        9177e93ed2b96446a606a02b040f03c41003ee8edfc08fe3aa37da6934d96f4f

        SHA512

        cb0279b50b1abb2ff477dbf3f107688fcb1fa87ac6d41a6e02b106cfd4ec8ccf3a22511dca9e4b73697c8210f07ba0ed48a2461258098ad1c3fc08981f1a19ea

      • C:\Windows\Temp\1.exe

        Filesize

        168KB

        MD5

        1073b2e7f778788852d3f7bb79929882

        SHA1

        7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

        SHA256

        c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

        SHA512

        90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

      • memory/752-56-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/752-25-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-17-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/752-18-0x0000000000400000-0x0000000000802000-memory.dmp

        Filesize

        4.0MB

      • memory/752-19-0x00000000026C0000-0x00000000026DA000-memory.dmp

        Filesize

        104KB

      • memory/752-20-0x0000000004E40000-0x00000000053E4000-memory.dmp

        Filesize

        5.6MB

      • memory/752-16-0x0000000002340000-0x000000000236D000-memory.dmp

        Filesize

        180KB

      • memory/752-27-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-47-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-45-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-43-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-41-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-49-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-39-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-37-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-35-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-33-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-31-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-29-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-21-0x0000000002710000-0x0000000002728000-memory.dmp

        Filesize

        96KB

      • memory/752-23-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-22-0x0000000002710000-0x0000000002722000-memory.dmp

        Filesize

        72KB

      • memory/752-50-0x00000000009A0000-0x0000000000AA0000-memory.dmp

        Filesize

        1024KB

      • memory/752-51-0x0000000002340000-0x000000000236D000-memory.dmp

        Filesize

        180KB

      • memory/752-52-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/752-15-0x00000000009A0000-0x0000000000AA0000-memory.dmp

        Filesize

        1024KB

      • memory/752-55-0x0000000000400000-0x0000000000802000-memory.dmp

        Filesize

        4.0MB

      • memory/1288-2168-0x0000000005140000-0x0000000005146000-memory.dmp

        Filesize

        24KB

      • memory/1288-2167-0x0000000000820000-0x000000000084E000-memory.dmp

        Filesize

        184KB

      • memory/4084-63-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-74-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-70-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-84-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-97-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-94-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-90-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-88-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-86-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-82-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-80-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-62-0x0000000005550000-0x00000000055B6000-memory.dmp

        Filesize

        408KB

      • memory/4084-76-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-78-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-64-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-68-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-66-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-92-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-72-0x0000000005550000-0x00000000055AF000-memory.dmp

        Filesize

        380KB

      • memory/4084-61-0x0000000002A80000-0x0000000002AE6000-memory.dmp

        Filesize

        408KB

      • memory/4084-2143-0x0000000005750000-0x0000000005782000-memory.dmp

        Filesize

        200KB

      • memory/5188-2156-0x0000000000910000-0x0000000000940000-memory.dmp

        Filesize

        192KB

      • memory/5188-2157-0x0000000005030000-0x0000000005036000-memory.dmp

        Filesize

        24KB

      • memory/5188-2158-0x00000000058F0000-0x0000000005F08000-memory.dmp

        Filesize

        6.1MB

      • memory/5188-2159-0x00000000053E0000-0x00000000054EA000-memory.dmp

        Filesize

        1.0MB

      • memory/5188-2160-0x0000000005080000-0x0000000005092000-memory.dmp

        Filesize

        72KB

      • memory/5188-2161-0x0000000005310000-0x000000000534C000-memory.dmp

        Filesize

        240KB

      • memory/5188-2162-0x0000000005350000-0x000000000539C000-memory.dmp

        Filesize

        304KB