Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 05:55

General

  • Target

    7ed6524816f7c38bc68db11b0ddcd5c354a03406d967173e719883259ef0c6bc.exe

  • Size

    561KB

  • MD5

    d572a4539bc6382a4f8f95482bfca0d7

  • SHA1

    06b98efe3e5bf7dc2bcc5796ce31dbacfcfd719a

  • SHA256

    7ed6524816f7c38bc68db11b0ddcd5c354a03406d967173e719883259ef0c6bc

  • SHA512

    21e907aaf780c83a4d625d9e34b16e9de8af17e4665d05c7b7bf1fc6340aeb729d2642976c50cfc3d233a27476e48347b9ded42e7e8ea7609633c8674ecf9f66

  • SSDEEP

    12288:ZMrEy90q/JvfbkRd1RiFOFUVGKT/m6Zp9qjezKwOV:Byb/pbgd1RiFOFUY6ZreV

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes
  • auth_value

    cddc991efd6918ad5321d80dac884b40

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ed6524816f7c38bc68db11b0ddcd5c354a03406d967173e719883259ef0c6bc.exe
    "C:\Users\Admin\AppData\Local\Temp\7ed6524816f7c38bc68db11b0ddcd5c354a03406d967173e719883259ef0c6bc.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:364
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhsB0866mN.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhsB0866mN.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf35sb92vK35.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf35sb92vK35.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4672
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf51FM39qy35.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf51FM39qy35.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2628

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhsB0866mN.exe

          Filesize

          416KB

          MD5

          b59f0f81d8eca52f9b6698f365ac36a3

          SHA1

          52688521ddd88dfb1be1f19531a20bbdd8597c40

          SHA256

          10da39b0030c69ea212acaecadecb17d4c4cb9b0a1099017030dd097471e3f7a

          SHA512

          8ae504e4967f94f5185fe506fff7494be7c3fcf6ce353250577539fd102efe46a33aecbfdc5636e53bac19aa6c6f8935b612e8ef5836096b1f011686e1a0a3e4

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf35sb92vK35.exe

          Filesize

          11KB

          MD5

          b939b180e30acc3c5ce9c9b80d91b657

          SHA1

          efc4ad36ae1cd28ad0c7031dbed94bffd06101af

          SHA256

          1c49fd426f0f50d4d12f47a1c59f3896de38716b8292744d8968f7f5ce27ae8a

          SHA512

          fc9fb455807a77e2161300954a9b24d927cf6abeabadbd5403a28a1b8b89cce5a639e54b23ef52b14cfe648ee21b5fd0ffc4b70ec236cf78ef315dad4b8b41b2

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf51FM39qy35.exe

          Filesize

          416KB

          MD5

          9ce8c74a533c9909e622ad2c5700ca63

          SHA1

          bcce3e38eaf3c3b741bad36507671231d94ef844

          SHA256

          a41658d0c260a9fa32e4797a385856dcbcd11ec5afd2135cee0f69ee6a52576d

          SHA512

          98491caf62c0bfd90a89e3172801096e12328a4ac379f99a6895db5d85eb70468ccede97678b46eceabdc419d1114f3da59b9e72d68847be2384c58169cb0e73

        • memory/2628-84-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-75-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-21-0x0000000004CF0000-0x0000000004D36000-memory.dmp

          Filesize

          280KB

        • memory/2628-22-0x0000000007390000-0x0000000007934000-memory.dmp

          Filesize

          5.6MB

        • memory/2628-23-0x00000000072F0000-0x0000000007334000-memory.dmp

          Filesize

          272KB

        • memory/2628-37-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-39-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-35-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-33-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-31-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-30-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-81-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-69-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-53-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-27-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-25-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-24-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-77-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-85-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-934-0x00000000082A0000-0x00000000082EC000-memory.dmp

          Filesize

          304KB

        • memory/2628-933-0x0000000008150000-0x000000000818C000-memory.dmp

          Filesize

          240KB

        • memory/2628-79-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-87-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-73-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-71-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-67-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-65-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-63-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-61-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-59-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-57-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-55-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-51-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-49-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-47-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-45-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-43-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-41-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/2628-930-0x0000000007950000-0x0000000007F68000-memory.dmp

          Filesize

          6.1MB

        • memory/2628-931-0x0000000007FF0000-0x00000000080FA000-memory.dmp

          Filesize

          1.0MB

        • memory/2628-932-0x0000000008130000-0x0000000008142000-memory.dmp

          Filesize

          72KB

        • memory/4672-14-0x00007FFED03C3000-0x00007FFED03C5000-memory.dmp

          Filesize

          8KB

        • memory/4672-15-0x0000000000130000-0x000000000013A000-memory.dmp

          Filesize

          40KB