Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:49

General

  • Target

    e85f1bbc6036b51cbdd369617718b599b1dfc2b0c3edbc50f468944a83612623.exe

  • Size

    651KB

  • MD5

    27f37bdad06c8547138564bc06264b6b

  • SHA1

    5c1f273f032032ad11d56e26a15b1edbe639eff7

  • SHA256

    e85f1bbc6036b51cbdd369617718b599b1dfc2b0c3edbc50f468944a83612623

  • SHA512

    bf934514c5d60d64de05651d1fcaa0594f9fda3a2e075f0273eb1ccf8c036def54a5961cbedbd51398e2a760f4fe1a5afd4f164107be3052891309fb5148022a

  • SSDEEP

    12288:iMrLy90MIUv54fJ2VpazeQdma+zb7tB7A5mzZ4lh5o2auIYO:xyNAIV0Fma+zbfOmVTwO

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e85f1bbc6036b51cbdd369617718b599b1dfc2b0c3edbc50f468944a83612623.exe
    "C:\Users\Admin\AppData\Local\Temp\e85f1bbc6036b51cbdd369617718b599b1dfc2b0c3edbc50f468944a83612623.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidM9435.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidM9435.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr905985.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr905985.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4516
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku366032.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku366032.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4428
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1380
          4⤵
          • Program crash
          PID:2616
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr163851.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr163851.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4236
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1944 -ip 1944
    1⤵
      PID:2892

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr163851.exe

            Filesize

            168KB

            MD5

            403d894c45f0d384cec5dca0cec06bd9

            SHA1

            33014a4321c8b6e120f47b1d89314853ad0239d4

            SHA256

            e77cc69ef7c57c5d40e30ca5075fb7f129633fbd1de602f2bdc96298dde723e7

            SHA512

            a11219a268291a3255e081b47c7dfe2af23cb16a067087198c840b72d9e22de773b7d54e4d822c6ebdf2b662de2e197639d8060605e79558cd836be69edbf3fc

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidM9435.exe

            Filesize

            496KB

            MD5

            f7ebbc4c52f0ade16b33bc23be0db045

            SHA1

            1474a26eee3ffacc267fb7ee7e9bb5502c8ac454

            SHA256

            36f9addac891ee2cc262eeac725de41ce3a57a2be160b174182eca981303266d

            SHA512

            1f5c18277728747f2e4ff1aedc7ce7851d06642afb3056987c1c4fd12435e5298ca5c6cb3aab090eab6060d9e9d7d7724ddd81907ff1c7d78fe4f0c634ff367b

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr905985.exe

            Filesize

            11KB

            MD5

            63e82dedacf4746ece8ab970e4554ed7

            SHA1

            4618d8b778cab80c6f8b36d9b913b5db97ebd7c8

            SHA256

            97dfa4d777fc85f88bb2313b98ffc7b076279f1c9a1ab2f43f13ef3f4fcdd408

            SHA512

            d31eb702b340522ef242246c49538e44ec933c9f0aaddad725681eb19d5b4b6afe2f1f06a6f1e0dfcd9fe8c005f817dc395a1a2ac2db92eafe84d6c134030b31

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku366032.exe

            Filesize

            414KB

            MD5

            40fc922d2a6ec7f62f53ecad05f1b820

            SHA1

            7c1e80f0a41438fd430ad275fad4e40f1a786721

            SHA256

            3c1da8b14ca4bc89b4efe0b019f33a96214bd9a11bd54806a0150662da200d2b

            SHA512

            513a43f00553a8749405e9ea119489f070f61e06d9edfb8d5532b5e4a3457ed028afa9a5e2918c9653c627ba8b3fa431f520338433a5dc5e46e5f90c107f80b1

          • C:\Windows\Temp\1.exe

            Filesize

            168KB

            MD5

            1073b2e7f778788852d3f7bb79929882

            SHA1

            7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

            SHA256

            c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

            SHA512

            90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

          • memory/1944-51-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-75-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-23-0x0000000005360000-0x00000000053C6000-memory.dmp

            Filesize

            408KB

          • memory/1944-25-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-37-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-87-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-85-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-81-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-79-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-45-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-47-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-73-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-71-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-69-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-67-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-65-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-63-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-61-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-59-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-57-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-55-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-21-0x00000000025B0000-0x0000000002616000-memory.dmp

            Filesize

            408KB

          • memory/1944-22-0x0000000004DB0000-0x0000000005354000-memory.dmp

            Filesize

            5.6MB

          • memory/1944-49-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-77-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-43-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-41-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-39-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-35-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-33-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-31-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-29-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-27-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-83-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-53-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-24-0x0000000005360000-0x00000000053BF000-memory.dmp

            Filesize

            380KB

          • memory/1944-2104-0x0000000005550000-0x0000000005582000-memory.dmp

            Filesize

            200KB

          • memory/4236-2128-0x0000000000AA0000-0x0000000000ACE000-memory.dmp

            Filesize

            184KB

          • memory/4236-2129-0x0000000002CC0000-0x0000000002CC6000-memory.dmp

            Filesize

            24KB

          • memory/4428-2117-0x00000000001F0000-0x0000000000220000-memory.dmp

            Filesize

            192KB

          • memory/4428-2118-0x0000000000B50000-0x0000000000B56000-memory.dmp

            Filesize

            24KB

          • memory/4428-2119-0x00000000051A0000-0x00000000057B8000-memory.dmp

            Filesize

            6.1MB

          • memory/4428-2120-0x0000000004C90000-0x0000000004D9A000-memory.dmp

            Filesize

            1.0MB

          • memory/4428-2121-0x0000000004B80000-0x0000000004B92000-memory.dmp

            Filesize

            72KB

          • memory/4428-2122-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

            Filesize

            240KB

          • memory/4428-2123-0x0000000004C20000-0x0000000004C6C000-memory.dmp

            Filesize

            304KB

          • memory/4516-14-0x00007FFD776A3000-0x00007FFD776A5000-memory.dmp

            Filesize

            8KB

          • memory/4516-15-0x0000000000250000-0x000000000025A000-memory.dmp

            Filesize

            40KB