Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 05:59

General

  • Target

    121d164d7aeecb6f7dbf0006002af62a267ab4f54899c31a5e6bd73448764a3e.exe

  • Size

    706KB

  • MD5

    0fb13d2adba06b51c087021d586524d9

  • SHA1

    dc1025757ac7640a1182c90557653a27b6a6f84e

  • SHA256

    121d164d7aeecb6f7dbf0006002af62a267ab4f54899c31a5e6bd73448764a3e

  • SHA512

    ba33fece6cbf343fb1b11468204817e9944e23bce1219c11ae53f8f329f9ef0b3b7c9a97e5aa9b19c06f3453ae881c31e5f603cc8772eb466179d65e90cecde9

  • SSDEEP

    12288:NMr9y90h9GO0JyHn3L8bHbRc2YZ60qrlob5JhzfijU65gh1WJ:0y6GO0JUnba7RbYZmWlz6jU7hi

Malware Config

Extracted

Family

redline

Botnet

ronam

C2

193.233.20.17:4139

Attributes
  • auth_value

    125421d19d14dd7fd211bc7f6d4aea6c

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\121d164d7aeecb6f7dbf0006002af62a267ab4f54899c31a5e6bd73448764a3e.exe
    "C:\Users\Admin\AppData\Local\Temp\121d164d7aeecb6f7dbf0006002af62a267ab4f54899c31a5e6bd73448764a3e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vzq4698.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vzq4698.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vZj0330.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vZj0330.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\reX5425.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\reX5425.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1616
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sAE00Rg.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sAE00Rg.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4752

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vzq4698.exe

          Filesize

          561KB

          MD5

          b700cdcba0fa23af6db8163b649f4d26

          SHA1

          eb0718c994dcc79b428f47f624b18be7bcde6224

          SHA256

          7401531cb129d91126013dd7045550a4fe45f59035a87e14ee00693a755e89c3

          SHA512

          7f2e055e999aa5b6236e5cd5878ae145b282461b99d5f320fa44b76eddafc57f9b0c10afd2e6a08fd880cde7253537993541ab3d8d876b4a3fd9092ff2b49e97

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vZj0330.exe

          Filesize

          416KB

          MD5

          d9b1e0559fd2f57f5fd2894ce410433c

          SHA1

          bfcd134c06956f48eb2e76df6adbf3caff36d8cb

          SHA256

          3d27a428fda8a4b183b2a20ff5c9c0c0bae2d0e56dfbdc25750187b98a22c9b6

          SHA512

          8dfe1ae1e995e4bc5174293646d84be6d6823c1b63731390b5399d7e4fa1d99fe45e788a8545c504ac20fc5ec41dc01fb98ffd7bca14d5852ebc3cec96b80f0e

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\reX5425.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sAE00Rg.exe

          Filesize

          349KB

          MD5

          a473a8c3825423654f8417c15f488d5e

          SHA1

          c52a5c44b43b056ef31b387b23172cbde9e28c58

          SHA256

          27549af362babf563a986eab80ec37dd52685ed559c915026fd07a58f3b069ff

          SHA512

          8797ac3424380a9e6b457a6c2640494ba2680f587127ca0ce48f4f61302505de95a979e3f1ebdc0e6ec23add81ceea84cbfc0c993ff75f12208fda10c1b7098b

        • memory/1616-21-0x00007FFF6FB13000-0x00007FFF6FB15000-memory.dmp

          Filesize

          8KB

        • memory/1616-22-0x0000000000FD0000-0x0000000000FDA000-memory.dmp

          Filesize

          40KB

        • memory/4752-78-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-68-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-30-0x0000000004C00000-0x0000000004C44000-memory.dmp

          Filesize

          272KB

        • memory/4752-80-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-64-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-52-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-48-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-32-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-31-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-94-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-92-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-90-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-88-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-86-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-84-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-82-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-28-0x0000000004B80000-0x0000000004BC6000-memory.dmp

          Filesize

          280KB

        • memory/4752-76-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-74-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-72-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-70-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-29-0x0000000004CE0000-0x0000000005284000-memory.dmp

          Filesize

          5.6MB

        • memory/4752-66-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-62-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-60-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-58-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-56-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-54-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-50-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-46-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-44-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-42-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-40-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-39-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-36-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-34-0x0000000004C00000-0x0000000004C3E000-memory.dmp

          Filesize

          248KB

        • memory/4752-937-0x0000000005290000-0x00000000058A8000-memory.dmp

          Filesize

          6.1MB

        • memory/4752-938-0x00000000058B0000-0x00000000059BA000-memory.dmp

          Filesize

          1.0MB

        • memory/4752-939-0x00000000059F0000-0x0000000005A02000-memory.dmp

          Filesize

          72KB

        • memory/4752-940-0x0000000005A10000-0x0000000005A4C000-memory.dmp

          Filesize

          240KB

        • memory/4752-941-0x0000000005B60000-0x0000000005BAC000-memory.dmp

          Filesize

          304KB