Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:47

General

  • Target

    0ac0d148918b3cd9f2d43c3c9d78b980c81dd23b73906cb5ea78a75ffbb19700.exe

  • Size

    1.5MB

  • MD5

    00ebe38ee1733d76518f76305c6543ab

  • SHA1

    f54a19ea108809118e5cb73f7d30723388e8dd86

  • SHA256

    0ac0d148918b3cd9f2d43c3c9d78b980c81dd23b73906cb5ea78a75ffbb19700

  • SHA512

    0c026e5b928f4ac8a527f1eba2241eb239cd3b3cfc9f2b0125b32ef1ec83c2b34f0dd5c3d7193e83fe782c338036cf34a5e4e8d1d40accffdd51c9d7cc306e49

  • SSDEEP

    24576:2ysTDq+3UjlsfjPKVoY6DpZp01YAX0adOiiu0s5Zf+xNEMXrAZ66:FoDq+3nf26YIZp06AXIiysaLEOZ

Malware Config

Extracted

Family

redline

Botnet

max

C2

185.161.248.73:4164

Attributes
  • auth_value

    efb1499709a5d08ed1ddf71cff71211f

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ac0d148918b3cd9f2d43c3c9d78b980c81dd23b73906cb5ea78a75ffbb19700.exe
    "C:\Users\Admin\AppData\Local\Temp\0ac0d148918b3cd9f2d43c3c9d78b980c81dd23b73906cb5ea78a75ffbb19700.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i07930430.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i07930430.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4480
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i41481659.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i41481659.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i58734986.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i58734986.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4736
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i09453305.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i09453305.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1156
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a98532674.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a98532674.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4196
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b04622328.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b04622328.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4944

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i07930430.exe

          Filesize

          1.2MB

          MD5

          7db1ac7c2f9d84fe7b11df33d9b65259

          SHA1

          ff41dfc211fbf4239dda95c705e6d479006cb402

          SHA256

          a81fdc3be528b464d464b74542d690ecd502ac503788c495c1c60f5526a192cd

          SHA512

          6b348156e4965a082e812ea952f5d68ddb1afb7be14c6b33facf580ece1a73a352a20a5f58f13456b748edee6a9c73ebb130ac9f704cf99374e2a72c00d2bd59

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i41481659.exe

          Filesize

          1.1MB

          MD5

          b425b4a9f016d95cddc22b8e6543deb6

          SHA1

          a0b49db5b5e17a8add44d3b3eeb3fdab03659858

          SHA256

          6ffb2299ae539c576f6ba0cdbad6062151aa0745c720f3ff39ab123cf802c313

          SHA512

          302d06fab11fb6ad2a5ca233c782b3cffeba3c5ace9ceef68cb0d081ada79113ca88a21cdf1e4230c23164cbf67d88da2f40b2e5662e62d1ae31722ab8b88b21

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i58734986.exe

          Filesize

          590KB

          MD5

          fa5c4cc610eb9b882dd49d57c91e856f

          SHA1

          169442ac3feb1988ff88b9e5dfbbb1ff634f6ad3

          SHA256

          dfab72691cbfd39913f7694be89071b3dc98c1873b95855b42c1f1191fca1ccb

          SHA512

          4d84ad07e051c84305194f086c9358f21b1615f78cd5c6a64d4e3cb69cf7f27336d6cea7027eaad2ad96e9b96f78378a9038df62053099dfa6b97608c4a75513

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i09453305.exe

          Filesize

          310KB

          MD5

          cdfb76668c1a0de0e545275331661b73

          SHA1

          7b96af1982fd27323468a5f74345c2de046a734a

          SHA256

          0dea7ae46714df770e3674c6ae78f5f93abe886b0b45f0df02cfd694e356a415

          SHA512

          bb5cdeff4fe687f746b63203b0e15ed6ce97dc6c8731640458d4872dbd9271573c9f21de46511dd019b75373546acd989ab76c34d4fd2ba4d5059138097e01f6

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a98532674.exe

          Filesize

          177KB

          MD5

          0e70e336b50840a9ddc7817fc0caf63b

          SHA1

          1666ebb4448cecb7a21f32b340441878f1fb720e

          SHA256

          0b96476ad431e92c5e7121f2d6cfae50d05f5eef14ba878f0d9550567e15ad70

          SHA512

          0c7b5b78575005bf600f069eca4e570f8b2b00f24b8594ea1032c1c77b7a8c03c11acc5dbcd8d2fc39775db020363696de8033a9fccf020a9ac8d7f36dad376e

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b04622328.exe

          Filesize

          168KB

          MD5

          fb50afd3a9e83d1ce7932914cf8e3534

          SHA1

          fd996173a34c311485b4a9671d6fde3392ae2843

          SHA256

          498842af0fbff25318307ae68f5e0afbd2dc067e37d871b8dd5834592a36c720

          SHA512

          f0efa77feb8bb33c556b61d20e3598ed1271366b587ff449de3455a544b9bd2673548a4ccc5e87164a7c47001b7ecd2ae353ec507ef10794fdb2bee26513f6ab

        • memory/4196-47-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-53-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-63-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-61-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-59-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-57-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-55-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-65-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-36-0x0000000004AD0000-0x0000000005074000-memory.dmp

          Filesize

          5.6MB

        • memory/4196-45-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-43-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-41-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-39-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-37-0x0000000005080000-0x0000000005098000-memory.dmp

          Filesize

          96KB

        • memory/4196-51-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-49-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-38-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/4196-35-0x00000000049F0000-0x0000000004A0A000-memory.dmp

          Filesize

          104KB

        • memory/4944-70-0x00000000008C0000-0x00000000008F0000-memory.dmp

          Filesize

          192KB

        • memory/4944-71-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

          Filesize

          24KB

        • memory/4944-72-0x000000000AD50000-0x000000000B368000-memory.dmp

          Filesize

          6.1MB

        • memory/4944-73-0x000000000A870000-0x000000000A97A000-memory.dmp

          Filesize

          1.0MB

        • memory/4944-74-0x000000000A7A0000-0x000000000A7B2000-memory.dmp

          Filesize

          72KB

        • memory/4944-75-0x000000000A800000-0x000000000A83C000-memory.dmp

          Filesize

          240KB

        • memory/4944-76-0x0000000004C30000-0x0000000004C7C000-memory.dmp

          Filesize

          304KB