Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:52

General

  • Target

    7e3024bb4f58e854289bcfe6c3ceef3f76351b448fc113c59e16541511176a8a.exe

  • Size

    655KB

  • MD5

    2ed427569d36389c2d3cc3e83de750b1

  • SHA1

    5d43d6c4fb0282b55455ad672910b1aa19da7027

  • SHA256

    7e3024bb4f58e854289bcfe6c3ceef3f76351b448fc113c59e16541511176a8a

  • SHA512

    58c163d86fee8ab096ba8b09239186af5cf1226c43e5a4474380f3295a203d96eef3c921edefdb7a1be30805108d6e1453cadb6543f834b654f27aaa127397e5

  • SSDEEP

    12288:jMrpy90EhhVn7DF1gQcNiFbPSRaO+SxhVIpa2zGzz1divYxLGY+7:yyB7VfPgQLSVIprGdMvcC

Malware Config

Extracted

Family

redline

Botnet

lint

C2

193.233.20.28:4125

Attributes
  • auth_value

    0e95262fb78243c67430f3148303e5b7

Signatures

  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e3024bb4f58e854289bcfe6c3ceef3f76351b448fc113c59e16541511176a8a.exe
    "C:\Users\Admin\AppData\Local\Temp\7e3024bb4f58e854289bcfe6c3ceef3f76351b448fc113c59e16541511176a8a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will1640.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will1640.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will3596.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will3596.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3360
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns5895NP.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns5895NP.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1104
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py27wT29.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py27wT29.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4864
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1080
            5⤵
            • Program crash
            PID:3244
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs2268uq.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs2268uq.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4900
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4864 -ip 4864
    1⤵
      PID:2528

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will1640.exe

            Filesize

            469KB

            MD5

            0183d46462a8432048d5f444f574db2b

            SHA1

            9e3825047dd0501ad1689428266cff9484fae1d7

            SHA256

            b90376e47e48635afe76a8834dc7f29d2cc687ad8f6d06eb19079a5783278ee0

            SHA512

            8f77208fb827cd39fa0dc01a78dbbc7f80243229e99fd279e0632e61e2ba296f74e91fdd9faa0cfee770a3a3c6b060d1ea28b120610b387d663e202c9983c4cb

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs2268uq.exe

            Filesize

            175KB

            MD5

            0ecc8ab62b7278cc6650517251f1543c

            SHA1

            b4273cda193a20d48e83241275ffc34ddad412f2

            SHA256

            b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

            SHA512

            c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will3596.exe

            Filesize

            324KB

            MD5

            16cb30859d491d214b0505385e3aec47

            SHA1

            178f65874fdaaaaf882c637715b235fcf87da999

            SHA256

            d2325b4e70c63535e7c79bce6d90317114ca41976473b871da355c3ca85df695

            SHA512

            e8fdc0cb6bf11e9c35f64bd2c9d9ccdb26ed7e97cb3a33d76cee1c4bda68afee2e09050ed957f25642908b3338e2912adbc67dc873da2982edc366f689b0ed0d

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns5895NP.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py27wT29.exe

            Filesize

            225KB

            MD5

            a568525b24c8343e56fe967268858cb0

            SHA1

            2e8fb5b3db9f552100e94ff1564f2acbf4e059e6

            SHA256

            473dc23efc724f62a562b7585a1e5d760a027ca67d32d11b67139714633ca392

            SHA512

            f233b1592cb0d3b3bec14cd08cc328a0337db58dda943e05ec4f1b111c09d6935435ff290c4bf3c3f94228fca335415fe8c134752ff3f99df7d76ac996908e5e

          • memory/1104-21-0x00007FFB81E53000-0x00007FFB81E55000-memory.dmp

            Filesize

            8KB

          • memory/1104-22-0x0000000000AE0000-0x0000000000AEA000-memory.dmp

            Filesize

            40KB

          • memory/1104-23-0x00007FFB81E53000-0x00007FFB81E55000-memory.dmp

            Filesize

            8KB

          • memory/4864-51-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-41-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-32-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-37-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-59-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-57-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-55-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-53-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-30-0x0000000004DA0000-0x0000000005344000-memory.dmp

            Filesize

            5.6MB

          • memory/4864-49-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-47-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-45-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-43-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-31-0x00000000024E0000-0x00000000024F8000-memory.dmp

            Filesize

            96KB

          • memory/4864-39-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-35-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-33-0x00000000024E0000-0x00000000024F2000-memory.dmp

            Filesize

            72KB

          • memory/4864-60-0x0000000000400000-0x00000000004B8000-memory.dmp

            Filesize

            736KB

          • memory/4864-62-0x0000000000400000-0x00000000004B8000-memory.dmp

            Filesize

            736KB

          • memory/4864-29-0x0000000002240000-0x000000000225A000-memory.dmp

            Filesize

            104KB

          • memory/4900-66-0x00000000006D0000-0x0000000000702000-memory.dmp

            Filesize

            200KB

          • memory/4900-67-0x00000000054F0000-0x0000000005B08000-memory.dmp

            Filesize

            6.1MB

          • memory/4900-68-0x0000000005070000-0x000000000517A000-memory.dmp

            Filesize

            1.0MB

          • memory/4900-69-0x0000000004FA0000-0x0000000004FB2000-memory.dmp

            Filesize

            72KB

          • memory/4900-70-0x0000000005030000-0x000000000506C000-memory.dmp

            Filesize

            240KB

          • memory/4900-71-0x0000000005180000-0x00000000051CC000-memory.dmp

            Filesize

            304KB