Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:34

General

  • Target

    0ad3fec3c07ad88a58d8a186cc5277a274f103cd0cf26589b6bac201ed4f22e5.exe

  • Size

    491KB

  • MD5

    d26298260a1d1d2a3ba85a19517f09b2

  • SHA1

    30370bcd42231a8d9044891787133220c22a344b

  • SHA256

    0ad3fec3c07ad88a58d8a186cc5277a274f103cd0cf26589b6bac201ed4f22e5

  • SHA512

    f7ff68d68d1dad4067b9276908b2662c8a05e39004a497b445b782614da3b5176e8cec2c6569d4d4561a03a8df88bafd494668c1c4180f9bbb765360c47c79a4

  • SSDEEP

    12288:OMrQy90w6xlf9u0baO8SJzHvJJnSQ8G4ALL2xCf3GWFM:ayA6OHzHvJJSQ8LALL2xCf3GWFM

Malware Config

Extracted

Family

redline

Botnet

lade

C2

217.196.96.101:4132

Attributes
  • auth_value

    6e597bb53b7858f1eaca3f569cb16e1e

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ad3fec3c07ad88a58d8a186cc5277a274f103cd0cf26589b6bac201ed4f22e5.exe
    "C:\Users\Admin\AppData\Local\Temp\0ad3fec3c07ad88a58d8a186cc5277a274f103cd0cf26589b6bac201ed4f22e5.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6627754.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6627754.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o4123143.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o4123143.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3764
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7453851.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7453851.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4024
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:2352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6627754.exe

    Filesize

    309KB

    MD5

    1803887bcb905d7a232c206c4ac8e284

    SHA1

    cc5bb7fcb40f7cb8a245ca76c1bfb84818384f5a

    SHA256

    2bf68ba0f34e88e0348e41cd0febed19c8489bebb407b330e291122b513c1652

    SHA512

    5693eef12c06859725eee5cc07954b4f86eb636b77a985b35c9f5b7df9f373ee2a10ab086d9ce480b624cda9df33d14146afbd686210e550704c7115ac89fac7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o4123143.exe

    Filesize

    177KB

    MD5

    65af9e3a9d6ec053d41490c47930eb99

    SHA1

    90d59fe616fcbc4b080bed5587b678749be6dbfd

    SHA256

    4b605ae208dd73d85bf500fb4c34185cb7bfb789cb5f13854419738c109ee0cc

    SHA512

    c196ce3031a24ff9f68def79d1777429555622f3a1fcb39ff123211ee737dc7a168cff70722f70c33852ceffece4815a9455f8ed17a15eb1aa7b4cb1fd9d3839

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7453851.exe

    Filesize

    168KB

    MD5

    c452f4dbc1c995e853dc192b0c47be84

    SHA1

    24f4819dd9788e90fdef601107bb308189cca6da

    SHA256

    96e97dbdf6d2d4af4f3c1e225f6d76b4ede42c3257a3ec5c1353d298aafeb6ba

    SHA512

    697ac505b896b140563b1ac4125797a652fcdd5ec99ea7fe4158d6efb339631e38a1988cc5f554289fc5ef56a7198ea8b10ab14aead8b40a7d6babf2a00c77d6

  • memory/3764-34-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-50-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/3764-17-0x0000000004AC0000-0x0000000005064000-memory.dmp

    Filesize

    5.6MB

  • memory/3764-18-0x0000000004980000-0x0000000004998000-memory.dmp

    Filesize

    96KB

  • memory/3764-19-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/3764-20-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/3764-28-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-46-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-44-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-42-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-40-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-38-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-36-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-15-0x00000000023D0000-0x00000000023EA000-memory.dmp

    Filesize

    104KB

  • memory/3764-32-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-30-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-48-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-26-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-24-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-22-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-21-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3764-49-0x00000000741EE000-0x00000000741EF000-memory.dmp

    Filesize

    4KB

  • memory/3764-16-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/3764-52-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/3764-14-0x00000000741EE000-0x00000000741EF000-memory.dmp

    Filesize

    4KB

  • memory/4024-56-0x0000000000030000-0x000000000005E000-memory.dmp

    Filesize

    184KB

  • memory/4024-57-0x0000000004810000-0x0000000004816000-memory.dmp

    Filesize

    24KB

  • memory/4024-58-0x000000000A460000-0x000000000AA78000-memory.dmp

    Filesize

    6.1MB

  • memory/4024-59-0x0000000009FE0000-0x000000000A0EA000-memory.dmp

    Filesize

    1.0MB

  • memory/4024-60-0x0000000009F10000-0x0000000009F22000-memory.dmp

    Filesize

    72KB

  • memory/4024-61-0x0000000009F70000-0x0000000009FAC000-memory.dmp

    Filesize

    240KB

  • memory/4024-62-0x00000000022D0000-0x000000000231C000-memory.dmp

    Filesize

    304KB