Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 05:54

General

  • Target

    3b809e2cdc53dd38b6a46e60fc0b7d327e293787bd4bc1724bff96ffcbfad173.exe

  • Size

    693KB

  • MD5

    13e7465ea80d98db3c705f2d1514dc58

  • SHA1

    0cceb60c32215991807f4eb1aab27119743159e7

  • SHA256

    3b809e2cdc53dd38b6a46e60fc0b7d327e293787bd4bc1724bff96ffcbfad173

  • SHA512

    2f89d36e8e5d1af7e0c4097ad57505715c9f5fc219881c438263724713beb1401ce8e8def80f905ec7c71762d317b0cd85f640722ac8c2c83e68074a45e259ec

  • SSDEEP

    12288:kBVTbILUBFnob9ROF52dVW5iXygBfovnzMd6T0BplqHvnLM8d:WRAUBFo7V1XyiovzvIPlSvL5d

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 34 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b809e2cdc53dd38b6a46e60fc0b7d327e293787bd4bc1724bff96ffcbfad173.exe
    "C:\Users\Admin\AppData\Local\Temp\3b809e2cdc53dd38b6a46e60fc0b7d327e293787bd4bc1724bff96ffcbfad173.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziOc8233.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziOc8233.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr053814.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr053814.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2312
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku613286.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku613286.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2128
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:4412

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziOc8233.exe

          Filesize

          406KB

          MD5

          fbb0766c66e33ee3a53e9ed2b827daa0

          SHA1

          8928d09d37a301d996657da261f2697ba3a647fd

          SHA256

          59b04f3e7728eb2f28ea01087a66a2c8ba6edcc36f43c81dbf61da5a5e99c7b1

          SHA512

          d973971cec47db5b79905c93853ed456d6dae1420992a668f74917d0d3eb7f2b7baebbba658b79289457ae1d032424db214a51ef7229ce77c7bdb74f42540494

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr053814.exe

          Filesize

          12KB

          MD5

          6e8f52ddef9bef053648d152ac59f057

          SHA1

          5c54bbcd7e25c9518c0f431357cc79ac64af1de8

          SHA256

          07a913a067031ab6c5b18b73b6026320586bea449bc6f9d183fa72553bb17d49

          SHA512

          7f740f706ebda245c4f3a0224b42f292fd3fb681f6ba4bad9a0b4c9469c4652a11bd1b8bb2f3b7cb5a82ccd06e22bef047fad1041b95538ef58b990fc4a9cd78

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku613286.exe

          Filesize

          379KB

          MD5

          746c4dd70fed84f4a332eb0472cd09b1

          SHA1

          009678bae4c4fe11393e8196f91d98122273e7df

          SHA256

          5f7919f529a13f35bd52dd31bae98948a6e130e29785b3dcc99e238d5bfdfc43

          SHA512

          82b2db294024f50e3394058361fe8582e43927040aa975995a14be143f22bf04ea98c17114c7cbd3d0e8a9fb275eb9e169aa84d74d6656247e77d8f369fe12a0

        • memory/2128-72-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-34-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-943-0x0000000008110000-0x000000000815C000-memory.dmp

          Filesize

          304KB

        • memory/2128-942-0x00000000080C0000-0x00000000080FC000-memory.dmp

          Filesize

          240KB

        • memory/2128-941-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

          Filesize

          72KB

        • memory/2128-940-0x0000000007E70000-0x0000000007F7A000-memory.dmp

          Filesize

          1.0MB

        • memory/2128-939-0x0000000007850000-0x0000000007E68000-memory.dmp

          Filesize

          6.1MB

        • memory/2128-33-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-69-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-30-0x0000000004A80000-0x0000000004AC6000-memory.dmp

          Filesize

          280KB

        • memory/2128-31-0x00000000072A0000-0x0000000007844000-memory.dmp

          Filesize

          5.6MB

        • memory/2128-32-0x0000000007160000-0x00000000071A4000-memory.dmp

          Filesize

          272KB

        • memory/2128-38-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-50-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-94-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-92-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-90-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-88-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-84-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-82-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-80-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-78-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-76-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-36-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-52-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-70-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-66-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-65-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-62-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-60-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-58-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-56-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-54-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-48-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-46-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-44-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-42-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-40-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-86-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2128-74-0x0000000007160000-0x000000000719E000-memory.dmp

          Filesize

          248KB

        • memory/2312-19-0x0000000000390000-0x000000000039A000-memory.dmp

          Filesize

          40KB

        • memory/2312-18-0x00007FFBF6223000-0x00007FFBF6225000-memory.dmp

          Filesize

          8KB

        • memory/2312-24-0x00007FFBF6223000-0x00007FFBF6225000-memory.dmp

          Filesize

          8KB

        • memory/3136-22-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/3136-21-0x0000000002410000-0x000000000249B000-memory.dmp

          Filesize

          556KB

        • memory/3136-20-0x0000000002380000-0x0000000002403000-memory.dmp

          Filesize

          524KB

        • memory/3136-3-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/3136-2-0x0000000002410000-0x000000000249B000-memory.dmp

          Filesize

          556KB

        • memory/3136-1-0x0000000002380000-0x0000000002403000-memory.dmp

          Filesize

          524KB

        • memory/3136-23-0x0000000000400000-0x0000000000770000-memory.dmp

          Filesize

          3.4MB