Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:04

General

  • Target

    1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe

  • Size

    521KB

  • MD5

    ceb1d935e42bbd004be81b3396244e85

  • SHA1

    d66f256e4fed29300a4a6888c709b00509bda36e

  • SHA256

    1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a

  • SHA512

    f0af8f40b8aec44e311476f665301bb15b0c97af1838186e06caa16f780edaff6d6e9d17e6372a2029cec9b5bfa2ec0ed4ce4632a3c4d367855af3416f31b185

  • SSDEEP

    6144:Kcy+bnr+vp0yN90QEMYQxHVXy/WfxTUMLKKA/Oq3m4XbfQ61P3Yy+NMTfil61P/q:sMr7y902RFfxRKrdtr4cobyul69Is2/

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe
    "C:\Users\Admin\AppData\Local\Temp\1ac53221da1e1974630f40f4fc243742ab79401acad41f584f7b1c2e7e6b9c7a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwe4303.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwe4303.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3704
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr107717.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr107717.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku582551.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku582551.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwe4303.exe

    Filesize

    379KB

    MD5

    9207d6829521453221db52965898ac07

    SHA1

    222b007622d7b3fd99080ff73f64a2252290d49b

    SHA256

    06a8f253f83a4416021efd1ff49ee547748986ed991b4374425778d58aca1552

    SHA512

    104e39f3ff5fcaadd482452d92f99ca3a111b474ab7021aef74f6338e94802d5d80ce0f77de89f37a62be41993481ef99b48070371fec4665c5f68bcc8e28ac1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr107717.exe

    Filesize

    11KB

    MD5

    ff689586f8862f087928224a664e9930

    SHA1

    87e75195a1d83a7d9831e2e42ed77ffc741bf520

    SHA256

    2da2171c81243a36f21404765886b78710c1cd0274b9a4e70ea627e471fafd58

    SHA512

    03f3197642e87fd05dbab699ebaab2bcf9922b5446c2fcea0d8c834233f5ed371b21b7fa6eef9e7579849f591c968edfc67a94a63cff39a806a32d301af86b6b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku582551.exe

    Filesize

    294KB

    MD5

    3bf4ecec45421c39998d2de7a9408677

    SHA1

    f1d702b4df099f565de9e6bddd67f8dd36c601b4

    SHA256

    e6b56ab2d31cc296d87eca646ca8197442e99d16ff86512c6f7269d6c58d8a1d

    SHA512

    bf2733500d6753fffcad6fb47a6f3db27b9741deccecc2dc412b5d222be56fd5659764605378cd17d9ae0bb62e9075a489d33847e570965c1238e93027bc78e6

  • memory/2504-14-0x00007FFCC6E63000-0x00007FFCC6E65000-memory.dmp

    Filesize

    8KB

  • memory/2504-15-0x0000000000090000-0x000000000009A000-memory.dmp

    Filesize

    40KB

  • memory/2504-16-0x00007FFCC6E63000-0x00007FFCC6E65000-memory.dmp

    Filesize

    8KB

  • memory/4176-84-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-72-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-24-0x0000000004AA0000-0x0000000004AE4000-memory.dmp

    Filesize

    272KB

  • memory/4176-34-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-39-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-36-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-32-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-30-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-76-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-62-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-52-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-28-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-26-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-25-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-89-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-86-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-22-0x0000000002500000-0x0000000002546000-memory.dmp

    Filesize

    280KB

  • memory/4176-82-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-80-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-78-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-74-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-23-0x0000000004B60000-0x0000000005104000-memory.dmp

    Filesize

    5.6MB

  • memory/4176-70-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-68-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-66-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-64-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-60-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-58-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-56-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-54-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-50-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-48-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-46-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-44-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-42-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-40-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

    Filesize

    252KB

  • memory/4176-931-0x0000000005110000-0x0000000005728000-memory.dmp

    Filesize

    6.1MB

  • memory/4176-932-0x0000000005790000-0x000000000589A000-memory.dmp

    Filesize

    1.0MB

  • memory/4176-933-0x00000000058D0000-0x00000000058E2000-memory.dmp

    Filesize

    72KB

  • memory/4176-934-0x00000000058F0000-0x000000000592C000-memory.dmp

    Filesize

    240KB

  • memory/4176-935-0x0000000005A40000-0x0000000005A8C000-memory.dmp

    Filesize

    304KB