Analysis

  • max time kernel
    135s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:28

General

  • Target

    161d8cd3f6f30ed7eeb5db8ca2b4d3d5b0e19f721175e3dbf5c04ee1155626f8.exe

  • Size

    1.2MB

  • MD5

    65f47713a73156d69e3a5f3c6fdeab55

  • SHA1

    ddddadb3ac1b1d49d9bd42ef3bc782536d5acd81

  • SHA256

    161d8cd3f6f30ed7eeb5db8ca2b4d3d5b0e19f721175e3dbf5c04ee1155626f8

  • SHA512

    aa36ee2f52f8e17e938b9db662b05eb155f4ad405c30eedb9e1f83c87c9540ce8db06bdca08071628bb48fb23ce493df8c133d26819a0f58f5e94df80a040caa

  • SSDEEP

    24576:XybGVqieoRM9QatlZEefRs+8Ssc3z2Sl33eP50CnKR1oa:ibGkieoOdjXf+PZc3z2y3jV

Malware Config

Extracted

Family

redline

Botnet

masta

C2

185.161.248.75:4132

Attributes
  • auth_value

    57f23b6b74d0f680c5a0c8ac9f52bd75

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\161d8cd3f6f30ed7eeb5db8ca2b4d3d5b0e19f721175e3dbf5c04ee1155626f8.exe
    "C:\Users\Admin\AppData\Local\Temp\161d8cd3f6f30ed7eeb5db8ca2b4d3d5b0e19f721175e3dbf5c04ee1155626f8.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5040
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7991367.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7991367.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4206827.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4206827.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1662229.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1662229.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2908
          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1662229.exe
            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1662229.exe
            5⤵
            • Executes dropped EXE
            PID:2920
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 152
              6⤵
              • Program crash
              PID:736
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0915936.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0915936.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3940
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2920 -ip 2920
    1⤵
      PID:4888

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7991367.exe

      Filesize

      866KB

      MD5

      f4762881f078d5c21f0f9715c4843746

      SHA1

      6e6f570940a1051e65138805f6e99c6191c3b1a9

      SHA256

      6db1b49f8a24fac10b674b3396ddb9f594c034327b05b22de45376f61f353831

      SHA512

      f058f2824f68c976bfceb65f8cde4907ffe2538543f0d397c790c2385db953ffc340c18aee75a0a4303efea02640fbd92afccd32eee056d339e4d2984c152053

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4206827.exe

      Filesize

      423KB

      MD5

      7639aac5971bc790c80abfd97048c430

      SHA1

      5a3d2e5360dd206654766cb1bca4888772e32ee1

      SHA256

      4f053785a6af154ac47a3b49c80d3adb15b96ca6c5f0e04e9bdf7a642b49da40

      SHA512

      f672e6a8032e29272cc1d23a0cb3ee202699d2cbfa492a6f6ee805b9ad8a8752bef3a6ed42193f585d659e03f3bf4886bab1e0859ae48f93e9ffc2668439fd8e

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1662229.exe

      Filesize

      770KB

      MD5

      7cf887377189a181b6d6cba0f2483d5e

      SHA1

      1028d3df2daddfa7646319af46435c5d7d1827c6

      SHA256

      4f20b2784fabd837b853300bd10cc7df627406c3ee1dc03c56136312b9b38444

      SHA512

      5890088a05f8d06e3b367f6ab586c527bfd6d04a7078b5b90067af8664e94893f45add4578e4ac12f19550aae6772d87671ad92d60f2c12dd062988db2d40c7a

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b0915936.exe

      Filesize

      145KB

      MD5

      2b078bffa8ba7486b5de4371d05e1f59

      SHA1

      cd2535d751fcd9fd8ce32a341cbe6087ff5e4006

      SHA256

      a53973d809deaf13c4140223db81f6b49aa11e0c5430b838c4116cdf86c83a3c

      SHA512

      f0ffbf1ebc2536ed282f850b02b03c7e5d03781de416e4917fd13a195de5b490c775d4c697e2219191a30f2be93713976e450148a222db7ec2409289b9751b05

    • memory/2908-21-0x00000000009E0000-0x0000000000AA6000-memory.dmp

      Filesize

      792KB

    • memory/2920-22-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/3940-28-0x0000000000AB0000-0x0000000000ADA000-memory.dmp

      Filesize

      168KB

    • memory/3940-29-0x00000000058C0000-0x0000000005ED8000-memory.dmp

      Filesize

      6.1MB

    • memory/3940-30-0x0000000005440000-0x000000000554A000-memory.dmp

      Filesize

      1.0MB

    • memory/3940-31-0x0000000005370000-0x0000000005382000-memory.dmp

      Filesize

      72KB

    • memory/3940-32-0x00000000053D0000-0x000000000540C000-memory.dmp

      Filesize

      240KB

    • memory/3940-33-0x0000000005550000-0x000000000559C000-memory.dmp

      Filesize

      304KB