Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:25

General

  • Target

    c6233181b20fcf23057144de45231deb58c24bcb503fda3b8d8e34d4a50ff314.exe

  • Size

    1.1MB

  • MD5

    9b586dd3bef41e4ad44a148bcb56ea5d

  • SHA1

    e9dd586bcc563b6a7596656b7370e746aa9c901f

  • SHA256

    c6233181b20fcf23057144de45231deb58c24bcb503fda3b8d8e34d4a50ff314

  • SHA512

    de4e06242d12d095e1012d1467d5ed28d936409688c5068bc19f4c8a6c4fe721bbffcb81884b668ea37bc339acf3d0a78c4e1c46ac622819802a75f2885e9ea6

  • SSDEEP

    24576:7ymjVbt65DdJYjXD9SKQhjjzU6tC2gCtX5QKsC+nfB4o:umjP4bQXD9ohj3U6zQKf+Z

Malware Config

Extracted

Family

redline

Botnet

rouch

C2

193.56.146.11:4162

Attributes
  • auth_value

    1b1735bcfc122c708eae27ca352568de

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6233181b20fcf23057144de45231deb58c24bcb503fda3b8d8e34d4a50ff314.exe
    "C:\Users\Admin\AppData\Local\Temp\c6233181b20fcf23057144de45231deb58c24bcb503fda3b8d8e34d4a50ff314.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pljw31LG71.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pljw31LG71.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plxd97bI62.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plxd97bI62.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4444
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plBd81sr51.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plBd81sr51.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:640
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plcI56xG63.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plcI56xG63.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3052
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buVf39Df34.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buVf39Df34.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1148
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caGS19pj86.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caGS19pj86.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pljw31LG71.exe

    Filesize

    1022KB

    MD5

    e171d9b0426d2e7ae0b8a009af0d5b3b

    SHA1

    c210ba65a018b49d445b94d5387cad33c980314a

    SHA256

    88937f0d4f1c18d0ab41039e560e594cf9845a1d806a60bdec9856c3a5af1185

    SHA512

    2c7aaf58f16b804585e61caa3da2e4013ab27759c9ee6a46f9cb8f0fce7d13458668d71bc2834b9189e2b906018dc9df2943776c91aaa4c078f6caaaab400ffe

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plxd97bI62.exe

    Filesize

    919KB

    MD5

    095ea059e0107fccf798d8b232c0a478

    SHA1

    2634296747b15d9984a15ded6a3e0d696c3387b1

    SHA256

    e7b0a04e7d99d719cffc1ae61278222e03830e56564bc0e405db2f8327a245ae

    SHA512

    ee162b0a7a71b42e240ea935d89d6aeb500f0abd812ab196ad2980315a159a7bf7c3894f2ab94261987fc36f158cfdf68da2c13aeabacfe40ef764029645ff75

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plBd81sr51.exe

    Filesize

    692KB

    MD5

    b488f9aa186d5ebcb4300ed26036e249

    SHA1

    eb92e8fee9a59df1bfa438dc428834fa6925f53b

    SHA256

    3be5bb8b8ffe6d99ad05a23e0f97d8c3961b3898fa1e563b014679ea31592862

    SHA512

    1cc987e5a67773c718f23654716f54e34353a2ecb68c4cf2721a160b461b156a3401ab00ea02f704297362e0ed1ad113e73a046ac209ec8152d5f97d9e3708f4

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plcI56xG63.exe

    Filesize

    404KB

    MD5

    636111ffc679028ef4b395b5c0fb5e11

    SHA1

    b7af1be3ad476d6a551e997ea58d0eb40ba4e93c

    SHA256

    15c569d673c0d15d2df894a25ea3f1dde3679418756a3b3f9071efb60e6a6bb5

    SHA512

    3db813fdb1b462192ab0f387c3e5f087e499b4f8f006109ff0099bcc5ef4d6cb7f2859aef4f7de74fab244f04bd114ec77bc3a9665f448bc91dda8578eaa4c50

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buVf39Df34.exe

    Filesize

    12KB

    MD5

    c3b47a80a28cc450754a883d9fdaf65b

    SHA1

    870df201d57239320785b315f654efab12dc6a6a

    SHA256

    901855ba1e6be580ef17e205d406292ad7e2292513234a7e1754b26e815e5e01

    SHA512

    8659d725eaf314c62451bbd6ad1a549190f8000a05c56c2e87002861bc1855839c5206f3befdee36989f8d62b1f27d7b2f86c4110c6a2ac265bfde9dfe35da15

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caGS19pj86.exe

    Filesize

    381KB

    MD5

    57b4e73c1d36751cb60a4d2e68594087

    SHA1

    0e371eaad20ebbb81735876f0f1703adee193117

    SHA256

    39f6bf6cf9f7bfba26380635a4b052c5de0e1688c92bacc10411dad74886dd25

    SHA512

    e5e81ce16ccd679b95cde5e1db79b62fe878d8c5e27d217bf0605433f47626261756b6b7da870333233023b1e8ea30af07af395b9078a7dd1c72834c254e279c

  • memory/1148-35-0x00000000000E0000-0x00000000000EA000-memory.dmp

    Filesize

    40KB

  • memory/2004-77-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-69-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-43-0x0000000007780000-0x00000000077C4000-memory.dmp

    Filesize

    272KB

  • memory/2004-51-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-65-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-107-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-103-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-101-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-99-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-97-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-93-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-91-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-89-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-87-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-85-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-81-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-79-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-41-0x0000000004C20000-0x0000000004C66000-memory.dmp

    Filesize

    280KB

  • memory/2004-75-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-73-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-71-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-42-0x0000000007190000-0x0000000007734000-memory.dmp

    Filesize

    5.6MB

  • memory/2004-67-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-63-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-61-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-59-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-57-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-55-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-53-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-49-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-106-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-95-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-83-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-47-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-45-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-44-0x0000000007780000-0x00000000077BE000-memory.dmp

    Filesize

    248KB

  • memory/2004-950-0x0000000007800000-0x0000000007E18000-memory.dmp

    Filesize

    6.1MB

  • memory/2004-951-0x0000000007EA0000-0x0000000007FAA000-memory.dmp

    Filesize

    1.0MB

  • memory/2004-952-0x0000000007FE0000-0x0000000007FF2000-memory.dmp

    Filesize

    72KB

  • memory/2004-953-0x0000000008000000-0x000000000803C000-memory.dmp

    Filesize

    240KB

  • memory/2004-954-0x0000000008150000-0x000000000819C000-memory.dmp

    Filesize

    304KB