Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:48

General

  • Target

    d3b7e789dd40ff8457574e68d188bf3e90606057ed8992dbf739da795fb6cd57N.exe

  • Size

    530KB

  • MD5

    cf8c96513753595e188e0aed4953c610

  • SHA1

    7380e7c18a509a9ae513b4fc06dfc627928c7f93

  • SHA256

    d3b7e789dd40ff8457574e68d188bf3e90606057ed8992dbf739da795fb6cd57

  • SHA512

    200fcfb234ebe56d769d83f7ea4a4c3bbad1825b51db0c5de031ca1d3bdf3f1334d7f34c2d693f5437921728705066c29f61b137d0d813f0823f729e216d1d1b

  • SSDEEP

    12288:9Mrwy908V7fu1nT3p2xY1Svjf7rSv2XF5yz:xyhc24kXDXF5yz

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3b7e789dd40ff8457574e68d188bf3e90606057ed8992dbf739da795fb6cd57N.exe
    "C:\Users\Admin\AppData\Local\Temp\d3b7e789dd40ff8457574e68d188bf3e90606057ed8992dbf739da795fb6cd57N.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr441762.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr441762.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:320
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku760359.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku760359.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Windows\Temp\1.exe
        "C:\Windows\Temp\1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 992
        3⤵
        • Program crash
        PID:2204
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4424 -ip 4424
    1⤵
      PID:4372

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr441762.exe

            Filesize

            12KB

            MD5

            ad75ca6ec8b6a9087ed85a88c0e04fea

            SHA1

            8e2a78c537bf1d8fd0d487837bd0baf9bbefe1d8

            SHA256

            5b101583de60ad2876b768b8254ee40a792b649487fba6fcc2f3bbeb96d520eb

            SHA512

            53b984c7605f4baf323849a50b7c7fe312161eb88eb10f0bb92a3e817b839c03bbb32e723daa8cfefdb6ff94ce9753b79eff67aeb77cc325a6cbb86204908823

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku760359.exe

            Filesize

            495KB

            MD5

            750207b822afb581b0c1adef5099cfd2

            SHA1

            9358add7abfd23d55e93f655a050a0c360177498

            SHA256

            2474bcd1774f17cc4f918cd7753da851f4cd17b9ad77a17e8dcdcf64b8663151

            SHA512

            5308a583b698974cd109d21e315f30030dd636a3f4b9bf982e2a9364c8f5fbd701723d3930e6bbec52356c7829543c201092bc6e56c80dec6610d8eaa65e79f0

          • C:\Windows\Temp\1.exe

            Filesize

            168KB

            MD5

            1073b2e7f778788852d3f7bb79929882

            SHA1

            7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

            SHA256

            c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

            SHA512

            90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

          • memory/320-7-0x00007FFF3D173000-0x00007FFF3D175000-memory.dmp

            Filesize

            8KB

          • memory/320-8-0x0000000000500000-0x000000000050A000-memory.dmp

            Filesize

            40KB

          • memory/320-9-0x00007FFF3D173000-0x00007FFF3D175000-memory.dmp

            Filesize

            8KB

          • memory/3012-2114-0x0000000000390000-0x00000000003C0000-memory.dmp

            Filesize

            192KB

          • memory/3012-2115-0x0000000000BC0000-0x0000000000BC6000-memory.dmp

            Filesize

            24KB

          • memory/3012-2116-0x0000000005350000-0x0000000005968000-memory.dmp

            Filesize

            6.1MB

          • memory/3012-2120-0x0000000004DD0000-0x0000000004E1C000-memory.dmp

            Filesize

            304KB

          • memory/3012-2119-0x0000000004D90000-0x0000000004DCC000-memory.dmp

            Filesize

            240KB

          • memory/3012-2118-0x0000000004D30000-0x0000000004D42000-memory.dmp

            Filesize

            72KB

          • memory/3012-2117-0x0000000004E40000-0x0000000004F4A000-memory.dmp

            Filesize

            1.0MB

          • memory/4424-62-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-44-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-34-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-84-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-82-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-78-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-76-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-74-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-72-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-70-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-68-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-66-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-64-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-19-0x0000000004FF0000-0x0000000005594000-memory.dmp

            Filesize

            5.6MB

          • memory/4424-60-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-58-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-56-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-54-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-50-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-48-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-46-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-20-0x00000000055A0000-0x0000000005606000-memory.dmp

            Filesize

            408KB

          • memory/4424-42-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-40-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-38-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-36-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-32-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-30-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-28-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-80-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-26-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-24-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-18-0x0000000004F80000-0x0000000004FE6000-memory.dmp

            Filesize

            408KB

          • memory/4424-17-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB

          • memory/4424-16-0x00000000023F0000-0x000000000244B000-memory.dmp

            Filesize

            364KB

          • memory/4424-15-0x0000000000920000-0x0000000000A20000-memory.dmp

            Filesize

            1024KB

          • memory/4424-52-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-22-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-21-0x00000000055A0000-0x00000000055FF000-memory.dmp

            Filesize

            380KB

          • memory/4424-2101-0x0000000005770000-0x00000000057A2000-memory.dmp

            Filesize

            200KB

          • memory/4424-2122-0x00000000023F0000-0x000000000244B000-memory.dmp

            Filesize

            364KB

          • memory/4424-2123-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB