Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:04

General

  • Target

    0486b0c530c418f484f5a7348c673bd94a5f1631017096c65fce1cdc28f78d52.exe

  • Size

    659KB

  • MD5

    ccbd9080c4e0d8ffd64a6c12d3faae5d

  • SHA1

    389ba71557a8c11cd7388b13df7317a034fc7cf8

  • SHA256

    0486b0c530c418f484f5a7348c673bd94a5f1631017096c65fce1cdc28f78d52

  • SHA512

    8e9692a7d426200a18c998103d60a53fdf06db57cbdacb934e2f3ac5ec87188957492661d17c73b5e4f98aece55e0d9e1e463f5fe96f9649c451f77573918f26

  • SSDEEP

    12288:4MrGy90NVhOqmH8t4DbUsniWssNsXrAIw/lf0TsMrLiViKaWP0uT:uyKVhCtn/ssN4AIwtfOsM6ViK50a

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0486b0c530c418f484f5a7348c673bd94a5f1631017096c65fce1cdc28f78d52.exe
    "C:\Users\Admin\AppData\Local\Temp\0486b0c530c418f484f5a7348c673bd94a5f1631017096c65fce1cdc28f78d52.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un822150.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un822150.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0003.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0003.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4972
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1080
          4⤵
          • Program crash
          PID:2480
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1336.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1336.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1040
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4972 -ip 4972
    1⤵
      PID:1748

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un822150.exe

      Filesize

      517KB

      MD5

      e8bd68714eefb1ccbd066975db7a552a

      SHA1

      a9916007a6d5dc6cfc5d27480ed584023f81316d

      SHA256

      e8af34428b3eee0b130fa1906e7c2e755e8beb631ddf9b9e1aa75f4f3943cb62

      SHA512

      b14f345cf66cda26ce6e17d7091b79ef4dd65ec2ab8f4d8246d9b5c416e83f2208970121d40f670dcf4c90172953d167ee74fe02a2f7954fe9aaa9bfe2f52eb8

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0003.exe

      Filesize

      236KB

      MD5

      b217bd817cd0a9869f6f2a64bfe882fd

      SHA1

      6a2530c6389e9bfee6c07b29b297504f88f98263

      SHA256

      bf0025b15d20b8314398309d662e43cbd5c12a6682c0292a0f9c8882975a2d19

      SHA512

      e9eebfcdee49c6bb109b035120d381cf65e0a26afdc8d7091096aee2de7278af139905ef0206a584981fe489bda4212c5d97bca67f14c55b01e6b049fe4e61e5

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1336.exe

      Filesize

      295KB

      MD5

      9b10daeb2e92f078cdfa026fce10ddc0

      SHA1

      e64762651476447e4a343f304cd4d4ee00eb1b07

      SHA256

      a1867b641dfce0e3119b9da8f96a88f61782a011e52fc799aee75e9e2d36ac87

      SHA512

      60b022039b314970584fcb425854362aa049b3e2464672212ffc86dd4d6d181c758ae9483a8800657d33066e83fb0f005137a21111ad4311f2f391f2dba24f8f

    • memory/1040-74-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-80-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-970-0x0000000005790000-0x000000000589A000-memory.dmp

      Filesize

      1.0MB

    • memory/1040-969-0x0000000005160000-0x0000000005778000-memory.dmp

      Filesize

      6.1MB

    • memory/1040-63-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-64-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-66-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-84-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-70-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-72-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-972-0x00000000058F0000-0x000000000592C000-memory.dmp

      Filesize

      240KB

    • memory/1040-973-0x0000000005A40000-0x0000000005A8C000-memory.dmp

      Filesize

      304KB

    • memory/1040-78-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-971-0x00000000058D0000-0x00000000058E2000-memory.dmp

      Filesize

      72KB

    • memory/1040-82-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-86-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-88-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-90-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-92-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-94-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-96-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-76-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-68-0x00000000027B0000-0x00000000027EF000-memory.dmp

      Filesize

      252KB

    • memory/1040-62-0x00000000027B0000-0x00000000027F4000-memory.dmp

      Filesize

      272KB

    • memory/1040-61-0x0000000002470000-0x00000000024B6000-memory.dmp

      Filesize

      280KB

    • memory/4972-43-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4972-55-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/4972-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4972-51-0x00000000020F0000-0x000000000211D000-memory.dmp

      Filesize

      180KB

    • memory/4972-50-0x0000000000710000-0x0000000000810000-memory.dmp

      Filesize

      1024KB

    • memory/4972-22-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-23-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-25-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-27-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-29-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-33-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-35-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-37-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-39-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-41-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-45-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-47-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-49-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-31-0x00000000024F0000-0x0000000002502000-memory.dmp

      Filesize

      72KB

    • memory/4972-21-0x00000000024F0000-0x0000000002508000-memory.dmp

      Filesize

      96KB

    • memory/4972-20-0x0000000004CB0000-0x0000000005254000-memory.dmp

      Filesize

      5.6MB

    • memory/4972-19-0x0000000002450000-0x000000000246A000-memory.dmp

      Filesize

      104KB

    • memory/4972-18-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/4972-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4972-16-0x00000000020F0000-0x000000000211D000-memory.dmp

      Filesize

      180KB

    • memory/4972-15-0x0000000000710000-0x0000000000810000-memory.dmp

      Filesize

      1024KB