Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:29

General

  • Target

    da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe

  • Size

    673KB

  • MD5

    c97ce15e9e6f3f119f0303bfcec9cbcf

  • SHA1

    d6eec48a2755d4201d529e22c282161a93bfa7bd

  • SHA256

    da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15

  • SHA512

    3fada44c908e5bdf5f0e5f9b113e7c76213a55870422fae4bb3aaac2a0c3fc229b62b6f8518ef4c520fc9665a9b7dd5679169a78cc2669e4bb86c8757ebb667f

  • SSDEEP

    12288:iMrMy90ic5xKyTUZhiPqVlRPruMFpDMuFR40Dc4R7uWp3SWIm26+qf:ayZbmYuMFpDvc4BuSIm26+S

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe
    "C:\Users\Admin\AppData\Local\Temp\da82cb326dcab4f2d9c76a6ed7256737f07522b35cfed6378a47f4b49d049f15.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un860737.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un860737.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3744
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3039.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3039.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3244
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 1084
          4⤵
          • Program crash
          PID:1784
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3035.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3035.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2664
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3244 -ip 3244
    1⤵
      PID:4752

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un860737.exe

      Filesize

      531KB

      MD5

      c232832bd3a8640499653b2b689723c8

      SHA1

      0171603a1cca562094647bfc62b7b077d223704d

      SHA256

      b2e1345982ba45fc0efe77bfe99b82b03cb4b3cf35ce7c3d9e3f1b95a31d5540

      SHA512

      0cf65f4c837b41323d1785eb606f1e80d78cf7c43d2c9a5b4ecb37361cfc77d1bdeadafe874b6e15cea40b5103a719f3e99754a9a9a68e9f3b28b08c503216a9

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3039.exe

      Filesize

      260KB

      MD5

      4ba208653a620138e853a75d30d8b5b6

      SHA1

      90bf9102493f7e3cf0aa03f08d23ab206d113f5c

      SHA256

      c1ada67016abbe91565564c08dd6abfadf973f54fe3a7c55776d7ba9b474b8bb

      SHA512

      f0c145f9dd16195af0c7093e28b7c8b723ef14214427b19e684949368ce5ae63e0bb930ba7adb976fc8d20e423e8b5b4d92a691b61c09da2797f4a88b82c86d3

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3035.exe

      Filesize

      319KB

      MD5

      9fc6d691ba4e2c88a679b644c40d16a1

      SHA1

      6cc205f74dfdee76b100d9d448f6a8689b32ab68

      SHA256

      cbfe961446dbd3791d98e000ac75d2e90c1ba356c1e23099d096dbaf63da286a

      SHA512

      21a52bebcae59e53fa063e1bbe3daade06a29ab1976d0d675f494705d55d9dba3018a3bbe1bfd06c75036df2a4853041223b10334729afdf3ec7e65cf1d22b5e

    • memory/2664-72-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-76-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-970-0x0000000005780000-0x000000000588A000-memory.dmp

      Filesize

      1.0MB

    • memory/2664-969-0x0000000005100000-0x0000000005718000-memory.dmp

      Filesize

      6.1MB

    • memory/2664-63-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-64-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-66-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-68-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-88-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-70-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-972-0x00000000058E0000-0x000000000591C000-memory.dmp

      Filesize

      240KB

    • memory/2664-973-0x0000000005A30000-0x0000000005A7C000-memory.dmp

      Filesize

      304KB

    • memory/2664-74-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-971-0x00000000058C0000-0x00000000058D2000-memory.dmp

      Filesize

      72KB

    • memory/2664-83-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-84-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-86-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-90-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-92-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-94-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-96-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-78-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-80-0x0000000004AC0000-0x0000000004AFF000-memory.dmp

      Filesize

      252KB

    • memory/2664-62-0x0000000004AC0000-0x0000000004B04000-memory.dmp

      Filesize

      272KB

    • memory/2664-61-0x00000000023F0000-0x0000000002436000-memory.dmp

      Filesize

      280KB

    • memory/3244-43-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/3244-55-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/3244-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/3244-51-0x00000000007B0000-0x00000000007DD000-memory.dmp

      Filesize

      180KB

    • memory/3244-50-0x0000000000800000-0x0000000000900000-memory.dmp

      Filesize

      1024KB

    • memory/3244-29-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-22-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-23-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-25-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-31-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-33-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-35-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-37-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-39-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-41-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-45-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-47-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-49-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-27-0x0000000004B80000-0x0000000004B92000-memory.dmp

      Filesize

      72KB

    • memory/3244-21-0x0000000004B80000-0x0000000004B98000-memory.dmp

      Filesize

      96KB

    • memory/3244-20-0x0000000004BE0000-0x0000000005184000-memory.dmp

      Filesize

      5.6MB

    • memory/3244-19-0x00000000022A0000-0x00000000022BA000-memory.dmp

      Filesize

      104KB

    • memory/3244-18-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/3244-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/3244-16-0x00000000007B0000-0x00000000007DD000-memory.dmp

      Filesize

      180KB

    • memory/3244-15-0x0000000000800000-0x0000000000900000-memory.dmp

      Filesize

      1024KB