Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:47

General

  • Target

    20cd183570155f14057bdc2ea18e7198d65c5cb4042dfe55d87b575f2007e015N.exe

  • Size

    1.2MB

  • MD5

    ce48174683e6c20aed39934908d2a3f2

  • SHA1

    129c0265a97dbfe90339fd598af55231849a008f

  • SHA256

    5142102c7da0f3090d6d7a8bc6021dd11d64bcc3040e884514db25148f7f84ec

  • SHA512

    f3e6a9faedd2d6c5b00745e36db753edd74a788170680b6e2f8b02baac44045f25e3d9c4981f417f1d002650c886bdc842c3c9304c4b9e1d66ef17117bf8fdeb

  • SSDEEP

    24576:dyilyisGwlWiclUxeZDw8AWQ0KXsp/DzlI5nI57HCL43hpbexpk7Z7w0RyC2P0:4iljsM7lUxgW2KYlSI5uwhpbexi7ZM0/

Malware Config

Extracted

Family

redline

Botnet

rumfa

C2

193.233.20.24:4123

Attributes
  • auth_value

    749d02a6b4ef1fa2ad908e44ec2296dc

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20cd183570155f14057bdc2ea18e7198d65c5cb4042dfe55d87b575f2007e015N.exe
    "C:\Users\Admin\AppData\Local\Temp\20cd183570155f14057bdc2ea18e7198d65c5cb4042dfe55d87b575f2007e015N.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plJJ83ZE32.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plJJ83ZE32.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plTh81jw72.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plTh81jw72.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plxb02qK13.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plxb02qK13.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1104
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plIE49xu41.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plIE49xu41.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3788
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buQY92uJ96.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buQY92uJ96.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1964
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caSq39ux69.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caSq39ux69.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4952

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plJJ83ZE32.exe

          Filesize

          1.0MB

          MD5

          61d273146b25273285d27eace9334d73

          SHA1

          21b843a4be7c1d2756fd9dc91953e8f773eed558

          SHA256

          45e265dea59758ac99bbd7dda262471b9a7f56e54001c122b5745898676a59cc

          SHA512

          1819f10344500652e907d855d33a0e3786d4575b228942549cd8de44077eb717797f5be8af1f5e87cc482b1b46f8dbd73ba2335ed164839ef0770d3e1b3ac957

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plTh81jw72.exe

          Filesize

          971KB

          MD5

          1c65d7ed5e3586a7ad2e6c30c5fa21f0

          SHA1

          aa1c8921489f0e8370f0b3f836ec2f3f16709439

          SHA256

          a743349cdd77be59d93fb3786fd0a68cdc78ea76710e308a0cce3837257fe93a

          SHA512

          59feb354e939938a703218d4c9ce889623a026e40465f833b77249b61e98921c3b6b694fe9c4c34cdbfdef7b339498e1329979daac27da42f7b88aa3e3d6f232

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plxb02qK13.exe

          Filesize

          690KB

          MD5

          874fa1793604962a2b1b0eba384964d5

          SHA1

          a192bf6d9197513b8889909333a8a2da694979c9

          SHA256

          f4f3bf29a613c80cd947a8643a6d6ab81638ec3eb80a814e01dfe157ef934684

          SHA512

          092541b664d7e058bb44d7dbbe096048227138384033035fc25fa4b0bf26ce462771294aaea4ba04215ae9814814e9bbe33d12aefd58fcd24efcc562c7fc229e

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plIE49xu41.exe

          Filesize

          403KB

          MD5

          f6f68a58df4e09fa82cdf6409b69fd9e

          SHA1

          f47b4a375b7f5a661220732a0347b36cba9ba3ce

          SHA256

          0178b51135f56f331e8f78149858a76d82a0c73137f17c493e9cb617678efd4d

          SHA512

          5741dab820b559e29acbd041960ec13b9fceb9f61316da986f5ee1c46454167e61c2b2a31ce1bc2c624bf5085e69ae3c08396ddbf00dce3b253e78b04e4a7b76

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buQY92uJ96.exe

          Filesize

          15KB

          MD5

          45b8301c4da3ccf9a2ae7f96b7a32d28

          SHA1

          9e83dbd88b40f4285bea300e6b8d91e1acdab294

          SHA256

          7594c5b603b58d2f66fcb876413baca0560bb69be9da50c0eee2ac5faa0b18c0

          SHA512

          bcba9be12cbd211a5a86872e259683614a39f32e1678a843db909f822b06a370145bedb838116a8a604d8c8cb222106026b8f153a75c6fcdd450d6d73c575e8c

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caSq39ux69.exe

          Filesize

          378KB

          MD5

          0699a3dd8a0bfbef309a3c474b22b56d

          SHA1

          8f8218184e8f28b14b8a3d5f828e28b9d8cd40a8

          SHA256

          0fe939fc94b4462887001499c9acd988653938b21d30b6eadfa023629edad178

          SHA512

          6dff28c979b7efeb3b8fccb98102b1adeaa5e31aebf01713c76f8055c7ac520bc8b37857f442e1d0de5d4b77295325b485cf8d53d72fd4d22091211de4ef26cd

        • memory/1964-35-0x0000000000250000-0x000000000025A000-memory.dmp

          Filesize

          40KB

        • memory/4952-81-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-71-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-43-0x0000000007760000-0x00000000077A4000-memory.dmp

          Filesize

          272KB

        • memory/4952-63-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-75-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-107-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-105-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-103-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-102-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-99-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-97-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-95-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-93-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-91-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-89-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-87-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-83-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-41-0x0000000004DC0000-0x0000000004E06000-memory.dmp

          Filesize

          280KB

        • memory/4952-79-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-77-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-73-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-42-0x0000000007170000-0x0000000007714000-memory.dmp

          Filesize

          5.6MB

        • memory/4952-69-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-67-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-65-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-61-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-59-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-58-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-53-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-51-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-49-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-85-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-55-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-47-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-45-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-44-0x0000000007760000-0x000000000779E000-memory.dmp

          Filesize

          248KB

        • memory/4952-950-0x0000000007800000-0x0000000007E18000-memory.dmp

          Filesize

          6.1MB

        • memory/4952-951-0x0000000007EA0000-0x0000000007FAA000-memory.dmp

          Filesize

          1.0MB

        • memory/4952-952-0x0000000007FE0000-0x0000000007FF2000-memory.dmp

          Filesize

          72KB

        • memory/4952-953-0x0000000008000000-0x000000000803C000-memory.dmp

          Filesize

          240KB

        • memory/4952-954-0x0000000008150000-0x000000000819C000-memory.dmp

          Filesize

          304KB