Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:36

General

  • Target

    66a8f069d915989d1a6d9c34ac617e97928567dee2f52d2725d9d4d3c385a1ce.exe

  • Size

    556KB

  • MD5

    beefd852bd36260e61d7666a54e62fbd

  • SHA1

    8b91d3f5027c6d09903d2885c52b63c5c4bfdeb4

  • SHA256

    66a8f069d915989d1a6d9c34ac617e97928567dee2f52d2725d9d4d3c385a1ce

  • SHA512

    6fc0dfa11bc504d98505f793006f2d2e137b03324988d6757ce79f197671c06fe348e71b0a582d85cdd98c3c79770d94f30674e43051186c2cb533af65498ca5

  • SSDEEP

    12288:0Mrgy90PySK4ei1dwaCVAzFTibf2rSGlG2dUsINkQ:syeei1aai8Ti7dGlGiUsINd

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes
  • auth_value

    cddc991efd6918ad5321d80dac884b40

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66a8f069d915989d1a6d9c34ac617e97928567dee2f52d2725d9d4d3c385a1ce.exe
    "C:\Users\Admin\AppData\Local\Temp\66a8f069d915989d1a6d9c34ac617e97928567dee2f52d2725d9d4d3c385a1ce.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhxR2885tf.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhxR2885tf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3308
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf82Dn34Ui28.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf82Dn34Ui28.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4212
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf73yu14Hs68.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf73yu14Hs68.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhxR2885tf.exe

    Filesize

    412KB

    MD5

    57e03981222c9768f83c577d04fda2f4

    SHA1

    5b5d48ffc94d1ad9adf2a58dee1d973df86aee08

    SHA256

    8e793a1eba35e111a02fd5786faee133a26217540010efebbba52eea9eed1879

    SHA512

    7857feb6b030488bd6a58c5e34e1cfc7d405f82665eb09652fbe14f2285a4823b24bcfe59a58c0c578c1f567257cc90c53f0f2ada271559541a0856d10d307d2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf82Dn34Ui28.exe

    Filesize

    11KB

    MD5

    04e0291e7375ab4d75e1f27ebb29c325

    SHA1

    d9a645fb94b5a43a835ddd88b3f741a311e383f8

    SHA256

    b6df3fd706c1066082087ca0c9fb699f83042b1714a31d1e4121e3768ed6d6ab

    SHA512

    f3a3c67b529a4b1ffb7191ff6012b6b67181463a8317610f2c32fa4fd176c2d52111e04acf93986896b4ef440085385b14b023a1f442b04f16d3e3fdfc25503e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf73yu14Hs68.exe

    Filesize

    409KB

    MD5

    d918db9077504212d04e97bc5857b710

    SHA1

    cbac3bfca65f8dfe4efd408bcf480f3d603f1d06

    SHA256

    ab46765a44c015f420a104a2ffee2d036dc0cb4ce25e72be2540eed2cd521bb3

    SHA512

    f00800d9c2616090029632b5fea54abacc92e9c323feda1ea3c50a2ffdacd0f047d4da66b185b75d4570bee869c9684a3746b1daf58cc66278cbb09a0946f187

  • memory/4212-14-0x00007FFB677E3000-0x00007FFB677E5000-memory.dmp

    Filesize

    8KB

  • memory/4212-15-0x00000000006B0000-0x00000000006BA000-memory.dmp

    Filesize

    40KB

  • memory/4212-16-0x00007FFB677E3000-0x00007FFB677E5000-memory.dmp

    Filesize

    8KB

  • memory/4268-64-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-52-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-24-0x00000000078B0000-0x00000000078F4000-memory.dmp

    Filesize

    272KB

  • memory/4268-38-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-50-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-88-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-86-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-84-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-80-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-78-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-76-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-74-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-72-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-70-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-68-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-66-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-22-0x0000000007280000-0x00000000072C6000-memory.dmp

    Filesize

    280KB

  • memory/4268-62-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-58-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-56-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-54-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-23-0x00000000072C0000-0x0000000007864000-memory.dmp

    Filesize

    5.6MB

  • memory/4268-48-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-46-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-44-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-42-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-40-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-34-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-32-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-30-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-82-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-60-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-36-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-28-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-26-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-25-0x00000000078B0000-0x00000000078EE000-memory.dmp

    Filesize

    248KB

  • memory/4268-931-0x0000000007950000-0x0000000007F68000-memory.dmp

    Filesize

    6.1MB

  • memory/4268-932-0x0000000007FF0000-0x00000000080FA000-memory.dmp

    Filesize

    1.0MB

  • memory/4268-933-0x0000000008130000-0x0000000008142000-memory.dmp

    Filesize

    72KB

  • memory/4268-934-0x0000000008150000-0x000000000818C000-memory.dmp

    Filesize

    240KB

  • memory/4268-935-0x00000000082A0000-0x00000000082EC000-memory.dmp

    Filesize

    304KB