Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:39

General

  • Target

    20a054954b7377d9e5aa7fb07810fdaa3411ecbf9cd55a109a3f39e3b83c2028.exe

  • Size

    657KB

  • MD5

    a866b0a478ac3b9db989ee5a6efe64cd

  • SHA1

    f4a0372bde3a44877ae7f2bd8fa48e0a7e7fcc7f

  • SHA256

    20a054954b7377d9e5aa7fb07810fdaa3411ecbf9cd55a109a3f39e3b83c2028

  • SHA512

    0df2e7638de50976f61a2a2b26db8e59d7481aae4ba89e2b93d120e460c30b202a939660097abb4eba0ed2b55e0c252962fb0677290a456d4462805c411daa2d

  • SSDEEP

    12288:UMrxy901w7hx3DUzCRNonSl7ew5+EMZxpelJaPk8:FyuUlw0eo+EMzpNB

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20a054954b7377d9e5aa7fb07810fdaa3411ecbf9cd55a109a3f39e3b83c2028.exe
    "C:\Users\Admin\AppData\Local\Temp\20a054954b7377d9e5aa7fb07810fdaa3411ecbf9cd55a109a3f39e3b83c2028.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un336197.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un336197.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0056.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0056.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3740
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1080
          4⤵
          • Program crash
          PID:1280
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1012.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1012.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2896
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3740 -ip 3740
    1⤵
      PID:4836

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un336197.exe

            Filesize

            516KB

            MD5

            5aa5186a9a84fd59c72aa9ef4fcb5b50

            SHA1

            024460137d321822fe4adef251828b61f60f0e6c

            SHA256

            52d0b9c1167efad4283c5a9e47f17466b95c225ccb563672893c70661f9a5728

            SHA512

            dbf8db5d73b719a6efc2593cd017b6b24349a66b7f7f86588d3793fd251495c0af3c8975b97095c7b223ba25cd2a09257a6fdc87d3f16269a980298532af37f6

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0056.exe

            Filesize

            295KB

            MD5

            364988cc8cdecba06453bf038ce2771f

            SHA1

            a9c63a8954c4013d82eb3341ca51320f265792ad

            SHA256

            a20ede3ba76f08ed4ba1cb26aeb6b2e9c287521c9615b320062a70d20abbace8

            SHA512

            f8c11b48ae9734a19e9fcf34dcfbe509e43991df7966e1517f475034582dcc3f8f35fcc05eeadbbf999e5dc4c5a5e678c1a1e219c811d6d76cf5d4fe5da04ff7

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1012.exe

            Filesize

            354KB

            MD5

            2ef53d7cd476c1f62371e0472efd499a

            SHA1

            70c0f2a04a61becacda3398137017476946f3ace

            SHA256

            385344ba7ee9f9c82cccac5351b2ecf9ffcb170b449f2941064e8ff4d3340ebd

            SHA512

            7f7c3749edc0aaaadf726f5e3bfced67e0292ec468cd453b2f08567ec0a018cd5378c7a7ee4cd48e2f2b75107cd1fb27d282d8b60f5b70f202b9dbf0589ba89b

          • memory/2896-72-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-76-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-968-0x0000000007E70000-0x0000000007F7A000-memory.dmp

            Filesize

            1.0MB

          • memory/2896-967-0x0000000007810000-0x0000000007E28000-memory.dmp

            Filesize

            6.1MB

          • memory/2896-61-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-62-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-64-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-66-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-68-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-70-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-970-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

            Filesize

            240KB

          • memory/2896-59-0x0000000004BA0000-0x0000000004BE6000-memory.dmp

            Filesize

            280KB

          • memory/2896-74-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-969-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

            Filesize

            72KB

          • memory/2896-78-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-80-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-82-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-84-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-86-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-88-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-90-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-92-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-94-0x00000000077D0000-0x000000000780F000-memory.dmp

            Filesize

            252KB

          • memory/2896-60-0x00000000077D0000-0x0000000007814000-memory.dmp

            Filesize

            272KB

          • memory/2896-971-0x0000000008110000-0x000000000815C000-memory.dmp

            Filesize

            304KB

          • memory/3740-38-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-53-0x0000000000400000-0x0000000002B78000-memory.dmp

            Filesize

            39.5MB

          • memory/3740-54-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3740-51-0x0000000000400000-0x0000000002B78000-memory.dmp

            Filesize

            39.5MB

          • memory/3740-50-0x0000000002E00000-0x0000000002E2D000-memory.dmp

            Filesize

            180KB

          • memory/3740-49-0x0000000002E30000-0x0000000002F30000-memory.dmp

            Filesize

            1024KB

          • memory/3740-21-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-48-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-22-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-24-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-26-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-28-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-33-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-34-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-36-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-40-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-42-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-45-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-46-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-31-0x0000000004C70000-0x0000000004C82000-memory.dmp

            Filesize

            72KB

          • memory/3740-20-0x0000000004C70000-0x0000000004C88000-memory.dmp

            Filesize

            96KB

          • memory/3740-19-0x0000000007180000-0x0000000007724000-memory.dmp

            Filesize

            5.6MB

          • memory/3740-18-0x0000000004920000-0x000000000493A000-memory.dmp

            Filesize

            104KB

          • memory/3740-17-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3740-16-0x0000000002E00000-0x0000000002E2D000-memory.dmp

            Filesize

            180KB

          • memory/3740-15-0x0000000002E30000-0x0000000002F30000-memory.dmp

            Filesize

            1024KB