Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:35

General

  • Target

    3b9b6be08022faa402737b82cc3aee06b8adda6c54d9884fb841fc4408fde07e.exe

  • Size

    560KB

  • MD5

    41f7e6200b6fa0809125ab71a3a5f6b6

  • SHA1

    e6f25f817d299d829008a35c43a98d17ab428e05

  • SHA256

    3b9b6be08022faa402737b82cc3aee06b8adda6c54d9884fb841fc4408fde07e

  • SHA512

    0180ceb5cad4020253c3a6df44788953cb8e154e645df31a083b246d1199bdb78048e907dea3d965fee473732877d8759358b76c53cc8936af9f74f04b3c11b1

  • SSDEEP

    12288:EMrwy90g8Vj8uxsP2Q05gvZ220GS2h3vZ4GoPGdV7:MyL8VjWZOgR22rf3hv5/7

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b9b6be08022faa402737b82cc3aee06b8adda6c54d9884fb841fc4408fde07e.exe
    "C:\Users\Admin\AppData\Local\Temp\3b9b6be08022faa402737b82cc3aee06b8adda6c54d9884fb841fc4408fde07e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipG3882.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipG3882.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr397995.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr397995.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1416
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku181363.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku181363.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipG3882.exe

    Filesize

    406KB

    MD5

    453caf4621b7526ca21145b49d2182ba

    SHA1

    c3635af0cba2e6116e3929d5f7709256ee48c83c

    SHA256

    6e901c14b05d47af830581d7cd25acb6f700fe4acd93c4308b6c827423153608

    SHA512

    299fa64b1aa8a66a53f58eb47df810d5bf3eaf24401ab409a16504042a506334bafe996668d0398de95dd83e820242f0aa07a489b7cdb5cb8684f513aaa3a0f2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr397995.exe

    Filesize

    11KB

    MD5

    b78b5dc0c84dc01601e6c148f8630fbd

    SHA1

    a60b5a7c82be01561245f1c7d4f3fb5db3b0d0df

    SHA256

    ae8d23ea29924ba92b9bff0a42c084d7a9099b3a3a7323f0452f88faa210ef7b

    SHA512

    7d3189336a486852068fb968ede4c90e0dd6006f341c28ea1a26b5f299d354d0dd1612ff5d88340f802da613188186b14da0a0b0ba76cfc40645ca201d56e12f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku181363.exe

    Filesize

    372KB

    MD5

    fbe17bf3c93046aa153d79a8b2da1ff9

    SHA1

    8d46ee807f4e5e2e8e8e49704af4f09be8ef2ea3

    SHA256

    bdfd37922ec2f475fd64694052767b7e81c5994570e967f0a3536936849de712

    SHA512

    de1f1cf28f4b5bd9765d02b9981425401563a5480843b8204b12cfbd37fd3773d5d613d179ed3331e3a970813d1d49614ee24c1d215acea129af813b574530e9

  • memory/1416-14-0x00007FFBA03A3000-0x00007FFBA03A5000-memory.dmp

    Filesize

    8KB

  • memory/1416-15-0x00000000002E0000-0x00000000002EA000-memory.dmp

    Filesize

    40KB

  • memory/1416-16-0x00007FFBA03A3000-0x00007FFBA03A5000-memory.dmp

    Filesize

    8KB

  • memory/2668-72-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-60-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-24-0x0000000004E20000-0x0000000004E64000-memory.dmp

    Filesize

    272KB

  • memory/2668-32-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-30-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-28-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-26-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-25-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-46-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-88-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-86-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-85-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-82-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-81-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-78-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-74-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-22-0x00000000027E0000-0x0000000002826000-memory.dmp

    Filesize

    280KB

  • memory/2668-70-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-66-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-64-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-62-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-23-0x0000000004F60000-0x0000000005504000-memory.dmp

    Filesize

    5.6MB

  • memory/2668-58-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-56-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-54-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-52-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-50-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-44-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-42-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-40-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-38-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-36-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-34-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-76-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-68-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-48-0x0000000004E20000-0x0000000004E5F000-memory.dmp

    Filesize

    252KB

  • memory/2668-931-0x0000000005510000-0x0000000005B28000-memory.dmp

    Filesize

    6.1MB

  • memory/2668-932-0x0000000005B30000-0x0000000005C3A000-memory.dmp

    Filesize

    1.0MB

  • memory/2668-933-0x0000000005C40000-0x0000000005C52000-memory.dmp

    Filesize

    72KB

  • memory/2668-934-0x0000000005C60000-0x0000000005C9C000-memory.dmp

    Filesize

    240KB

  • memory/2668-935-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

    Filesize

    304KB