Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 05:56

General

  • Target

    4c7b5413a29a64ac83ba954eb34c525291b03a6c4f9439971d86682b40abd8bb.exe

  • Size

    660KB

  • MD5

    1d3010b2ead0c5d3b760bfeacd92f78a

  • SHA1

    d8803b06ce5ed58b48f1e1cf1738f6f4d8005578

  • SHA256

    4c7b5413a29a64ac83ba954eb34c525291b03a6c4f9439971d86682b40abd8bb

  • SHA512

    d73e6066ee242221b75f5b82d4400964c48287a5495d91a7d13f2e205d130a8ff6f86c7fb26542344250b72748723d5d76d1c538cd494b360a59243f5630a826

  • SSDEEP

    12288:UMrTy90Ex9QDC1mgLrixy+cWQG6LfvG2v5R8uP0MsxrLi5iUaWP5G5OjK:fyJ0YmgSERfbLXG2v5/PZsx65iU5wMe

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c7b5413a29a64ac83ba954eb34c525291b03a6c4f9439971d86682b40abd8bb.exe
    "C:\Users\Admin\AppData\Local\Temp\4c7b5413a29a64ac83ba954eb34c525291b03a6c4f9439971d86682b40abd8bb.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444467.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444467.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0337.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0337.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2712
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 1088
          4⤵
          • Program crash
          PID:2016
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2786.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2786.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4336
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2712 -ip 2712
    1⤵
      PID:3260

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un444467.exe

            Filesize

            518KB

            MD5

            a9dccb806d82a1fbe7f3e147e21d15dc

            SHA1

            16272c6a436f39afc95a39146337ee33c27a354f

            SHA256

            1c42d8e4270428bff400254906bc44cb2b8bfd1086a017ecac1d0fd7a3b420ee

            SHA512

            c6aab3eafd82fce8e58ae76de236f5af5979b2a89e89222a3e77b8c803efa60b356298abfdc13b4574a012fbc756c3bc1dbfdfcec04e033e093d748bedf68f58

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0337.exe

            Filesize

            236KB

            MD5

            d6dd8adaf533d598654687c1de1cc7a8

            SHA1

            27b2f9b9eada468e68224ce5504745d60646754c

            SHA256

            695f504e2599a621205542fa25fec0f689f4333ca60c71b900e1e2982c111292

            SHA512

            4745f52a8f8f4271d216d8baed230ca365d882c5e5a6f361681e20b3a2a901e68eb4bec45c7b0cdc453b3897ab9e452f95a1c9ed3280ebc64ece752e236d40c8

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2786.exe

            Filesize

            295KB

            MD5

            b7e95934023f18e2d9e2e7c6ab993f3e

            SHA1

            dc0de043bf35d877b1f66990c5f185ee10ab36f4

            SHA256

            8607fdab86d8dc48e11cc9eb9440fca0b7053d008a1a9ab3acd547ee8b593d85

            SHA512

            4e435cd693c2499753f71b3403a0ef3043ac55b3dc59485c7c69bc840efbfde69343778440b36cd2da6b5a8b3e853035a8910bed8fb34a513500299df22bb5a2

          • memory/2712-15-0x0000000000670000-0x0000000000770000-memory.dmp

            Filesize

            1024KB

          • memory/2712-17-0x0000000000400000-0x00000000004AA000-memory.dmp

            Filesize

            680KB

          • memory/2712-16-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2712-18-0x0000000000400000-0x00000000004AA000-memory.dmp

            Filesize

            680KB

          • memory/2712-19-0x0000000002310000-0x000000000232A000-memory.dmp

            Filesize

            104KB

          • memory/2712-20-0x0000000004B20000-0x00000000050C4000-memory.dmp

            Filesize

            5.6MB

          • memory/2712-21-0x0000000004A40000-0x0000000004A58000-memory.dmp

            Filesize

            96KB

          • memory/2712-27-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-49-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-47-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-45-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-43-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-41-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-39-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-37-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-35-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-33-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-31-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-30-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-25-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-23-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-22-0x0000000004A40000-0x0000000004A52000-memory.dmp

            Filesize

            72KB

          • memory/2712-50-0x0000000000670000-0x0000000000770000-memory.dmp

            Filesize

            1024KB

          • memory/2712-51-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2712-54-0x0000000000400000-0x00000000004AA000-memory.dmp

            Filesize

            680KB

          • memory/2712-55-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/4336-60-0x0000000002610000-0x0000000002656000-memory.dmp

            Filesize

            280KB

          • memory/4336-61-0x0000000004B10000-0x0000000004B54000-memory.dmp

            Filesize

            272KB

          • memory/4336-69-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-77-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-95-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-93-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-91-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-89-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-87-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-83-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-81-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-79-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-75-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-73-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-71-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-67-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-85-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-65-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-63-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-62-0x0000000004B10000-0x0000000004B4F000-memory.dmp

            Filesize

            252KB

          • memory/4336-968-0x0000000005280000-0x0000000005898000-memory.dmp

            Filesize

            6.1MB

          • memory/4336-969-0x00000000058E0000-0x00000000059EA000-memory.dmp

            Filesize

            1.0MB

          • memory/4336-970-0x0000000005A10000-0x0000000005A22000-memory.dmp

            Filesize

            72KB

          • memory/4336-971-0x0000000005A30000-0x0000000005A6C000-memory.dmp

            Filesize

            240KB

          • memory/4336-972-0x0000000005B80000-0x0000000005BCC000-memory.dmp

            Filesize

            304KB