Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:42

General

  • Target

    bc3737f0a31054c55cf897cf6f283ab636e12575ba809801a5b152b3134b5a38.exe

  • Size

    480KB

  • MD5

    94459edd58c89c4f25b238e2a83778be

  • SHA1

    e9588c9ac7d05a6f2f52cf54b46ae54a15efade9

  • SHA256

    bc3737f0a31054c55cf897cf6f283ab636e12575ba809801a5b152b3134b5a38

  • SHA512

    c0f8b0d6df532a9ab74db9cdf6b11d7e72712d7a92df2235aa9d625ecb1dac5cb593913f4d5e3d51da08e699ef017fc6f34f448d8738597878a6a3206f5cee54

  • SSDEEP

    6144:Koy+bnr+Np0yN90QEty6zXzyvQP9synWeIGsfhSmkRSY0f/Zro96sLcht8pMUOs5:QMr1y90bRbzyDeIGsw3RZSFg5wwBX5

Malware Config

Extracted

Family

redline

Botnet

mofun

C2

217.196.96.101:4132

Attributes
  • auth_value

    da5d4987d25c2de43d34fcc99b29fff3

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc3737f0a31054c55cf897cf6f283ab636e12575ba809801a5b152b3134b5a38.exe
    "C:\Users\Admin\AppData\Local\Temp\bc3737f0a31054c55cf897cf6f283ab636e12575ba809801a5b152b3134b5a38.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3346885.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3346885.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7905071.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7905071.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2560
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2544887.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2544887.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:540

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3346885.exe

          Filesize

          309KB

          MD5

          a30c313cd63f87ec50ffa07062d3a543

          SHA1

          c97f07c4b652ff85c439c9740703e8f6d576914f

          SHA256

          32dd7e6a4aa2d3212925ba23eb5ef1dcf7222eb0887a9c1e6ce5fb27ccf49a85

          SHA512

          225584b986a9845a20527082742025101679a7ae008685129682501edaf10eb2711d18e4fcbf6dc925c9798e1187fb24f14c97f45e1faf2754cf2d05fd5de414

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7905071.exe

          Filesize

          180KB

          MD5

          50e673484775811c017b61dfc6510141

          SHA1

          738c1194694c4a6cb164f7e249251077ffe5e60a

          SHA256

          561628502982615ee83eab36742ddaedf09759ba9fb8e4154f7778addab49ff7

          SHA512

          90f7498ca6ba0d68bcbedfd55b785e04ed50a8ce0caebf46cbcb2ed298e7c46816c887466f0be2b635735963755007ecf1d8bfae018c60573e5b526408c51bf3

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2544887.exe

          Filesize

          168KB

          MD5

          c2852f2047dd40da18bd5c06b4448841

          SHA1

          20eaf9df2f87caaa572b8821132be75cc88b35dd

          SHA256

          d6fc9ab80a0578301c061b4ba8e88669f837666962f97437e10a798f58997fe6

          SHA512

          dee98ffc160213494c249b4e554e6f28e6ee0d4d3e093ebdc28554250d761bd538761949ccd7d9c4bea587f81465c7263a7357875a2c003412551db8d70ce8cb

        • memory/540-62-0x0000000004F90000-0x0000000004FDC000-memory.dmp

          Filesize

          304KB

        • memory/540-61-0x000000000AAD0000-0x000000000AB0C000-memory.dmp

          Filesize

          240KB

        • memory/540-60-0x000000000AA70000-0x000000000AA82000-memory.dmp

          Filesize

          72KB

        • memory/540-59-0x000000000AB40000-0x000000000AC4A000-memory.dmp

          Filesize

          1.0MB

        • memory/540-58-0x000000000B000000-0x000000000B618000-memory.dmp

          Filesize

          6.1MB

        • memory/540-57-0x00000000055F0000-0x00000000055F6000-memory.dmp

          Filesize

          24KB

        • memory/540-56-0x0000000000CD0000-0x0000000000D00000-memory.dmp

          Filesize

          192KB

        • memory/2560-34-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-21-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-42-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-40-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-38-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-36-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-46-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-32-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-30-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-28-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-26-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-24-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-22-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-44-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-49-0x000000007469E000-0x000000007469F000-memory.dmp

          Filesize

          4KB

        • memory/2560-50-0x0000000074690000-0x0000000074E40000-memory.dmp

          Filesize

          7.7MB

        • memory/2560-52-0x0000000074690000-0x0000000074E40000-memory.dmp

          Filesize

          7.7MB

        • memory/2560-48-0x00000000049A0000-0x00000000049B2000-memory.dmp

          Filesize

          72KB

        • memory/2560-20-0x0000000074690000-0x0000000074E40000-memory.dmp

          Filesize

          7.7MB

        • memory/2560-19-0x0000000074690000-0x0000000074E40000-memory.dmp

          Filesize

          7.7MB

        • memory/2560-18-0x00000000049A0000-0x00000000049B8000-memory.dmp

          Filesize

          96KB

        • memory/2560-17-0x0000000004B30000-0x00000000050D4000-memory.dmp

          Filesize

          5.6MB

        • memory/2560-16-0x0000000074690000-0x0000000074E40000-memory.dmp

          Filesize

          7.7MB

        • memory/2560-15-0x0000000002110000-0x000000000212A000-memory.dmp

          Filesize

          104KB

        • memory/2560-14-0x000000007469E000-0x000000007469F000-memory.dmp

          Filesize

          4KB