Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:42

General

  • Target

    513f3717e6e284445e084e3f9aff6db2d4ed528d759fd4880ddb486492b3ca20N.exe

  • Size

    545KB

  • MD5

    421056d62466850911f8c474dbe057b0

  • SHA1

    272abfcbaf0378a53b28c23abce6c7bc2d2ef1dc

  • SHA256

    513f3717e6e284445e084e3f9aff6db2d4ed528d759fd4880ddb486492b3ca20

  • SHA512

    4c875cc786f03942a4ebba730f4944bb51e9f0592a4b20526f6e7af888f325ed4f7152f6d3ade31e68daff1df76fa526f7e3d379565310e1284ac1d12c3a4e09

  • SSDEEP

    12288:tMrCy900/xEeQD0GVR8A613R618MXAhXPWTBZ3E0KGokHRhia:7yra3RNs3R618BWTn3WnO39

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\513f3717e6e284445e084e3f9aff6db2d4ed528d759fd4880ddb486492b3ca20N.exe
    "C:\Users\Admin\AppData\Local\Temp\513f3717e6e284445e084e3f9aff6db2d4ed528d759fd4880ddb486492b3ca20N.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:372
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro1252.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro1252.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1080
        3⤵
        • Program crash
        PID:3572
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu5325.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu5325.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1704
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3688 -ip 3688
    1⤵
      PID:4380

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro1252.exe

            Filesize

            325KB

            MD5

            ff0edc4702cb51296c296d3ef42a0a98

            SHA1

            089879baa7e7ab088e947577b93d33b2a8cd081e

            SHA256

            80267184b938dc94b523cd03882d92fd4baefa1d7316d6c1f79a37ae5f3b406d

            SHA512

            f6cd9e5655f0e6f5ef7dad29eba8be363a70a3406e53ee131034d71809ebc608aa4393ada46530452f282d089ebf763c50d7695a37b163ee8a8265c1d2662c27

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu5325.exe

            Filesize

            383KB

            MD5

            15726314831b6ac4f05f706261db0348

            SHA1

            0f815de28c685776b0122f760daf3b2015163702

            SHA256

            21aa199e0df3e907537e1932037396711502e0f97fd26f9051229a95daccee8b

            SHA512

            5f4309de96860249d1dccb18a914c73047034e04db5b2a6d5bdc4882826e0b189ad6325c9cae91892f89dbd0d14207ef5e8c568b61045f807424f8aa04a15849

          • memory/1704-72-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-68-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-964-0x0000000007E60000-0x0000000007F6A000-memory.dmp

            Filesize

            1.0MB

          • memory/1704-963-0x0000000007810000-0x0000000007E28000-memory.dmp

            Filesize

            6.1MB

          • memory/1704-58-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-60-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-62-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-64-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-66-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-70-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-966-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

            Filesize

            240KB

          • memory/1704-967-0x0000000008110000-0x000000000815C000-memory.dmp

            Filesize

            304KB

          • memory/1704-965-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

            Filesize

            72KB

          • memory/1704-78-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-74-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-80-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-82-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-84-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-86-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-88-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-90-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-76-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-57-0x00000000071C0000-0x00000000071FF000-memory.dmp

            Filesize

            252KB

          • memory/1704-56-0x00000000071C0000-0x0000000007204000-memory.dmp

            Filesize

            272KB

          • memory/1704-55-0x00000000049A0000-0x00000000049E6000-memory.dmp

            Filesize

            280KB

          • memory/3688-32-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-50-0x0000000000400000-0x0000000002B7E000-memory.dmp

            Filesize

            39.5MB

          • memory/3688-49-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3688-46-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3688-44-0x0000000002B80000-0x0000000002BAD000-memory.dmp

            Filesize

            180KB

          • memory/3688-43-0x0000000002BF0000-0x0000000002CF0000-memory.dmp

            Filesize

            1024KB

          • memory/3688-15-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-16-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-18-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-20-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-22-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-24-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-26-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-28-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-30-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-34-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-36-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-38-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-40-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-42-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/3688-14-0x0000000000400000-0x0000000002B7E000-memory.dmp

            Filesize

            39.5MB

          • memory/3688-13-0x0000000004B80000-0x0000000004B98000-memory.dmp

            Filesize

            96KB

          • memory/3688-12-0x0000000007240000-0x00000000077E4000-memory.dmp

            Filesize

            5.6MB

          • memory/3688-11-0x00000000047B0000-0x00000000047CA000-memory.dmp

            Filesize

            104KB

          • memory/3688-10-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3688-9-0x0000000002B80000-0x0000000002BAD000-memory.dmp

            Filesize

            180KB

          • memory/3688-8-0x0000000002BF0000-0x0000000002CF0000-memory.dmp

            Filesize

            1024KB