Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 10:47

General

  • Target

    e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe

  • Size

    529KB

  • MD5

    ee9f947fd512d62a3330478d0cb151bd

  • SHA1

    8cc30a4f5091152e69bf96edff6c0645a3c13897

  • SHA256

    e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70

  • SHA512

    0914aee41a4b767a0dda452807c71629725923108296b17b1feed117dd4674ff44b537b74c1c4d16dd4e83b7d03d34d9112c386573caacfc141cf3769efb201f

  • SSDEEP

    12288:zMrIy901/xLNPKtttzRrjJOS7E8+x4CGG8:XyK/atRrjp7E8UlGF

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe
    "C:\Users\Admin\AppData\Local\Temp\e4df5d2340d120f3b3b99a029349543f40cbdd2166b867f4ae4d91322bcbbc70.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizp8690.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizp8690.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr201859.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr201859.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1596
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku041375.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku041375.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2348
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:3268

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizp8690.exe

          Filesize

          388KB

          MD5

          72561f604ea3dec5f67cd49dcb915c61

          SHA1

          27c80d71c57c6cf8682bfc09380cef0c3f64d57d

          SHA256

          373b64ed15138fb8e5ef2cf4ec405e105d0d918d9dc10124102400a9779e708d

          SHA512

          ffe843cd1899157d22f7356545e5bf627b50bedbd57c074ce2525a0d8914aa146ec60f3ac5558291dc1cf22f5490d822c74ae4d668c7db0f733dcf6bda288054

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr201859.exe

          Filesize

          11KB

          MD5

          23b33000afb994059f5da681c613980f

          SHA1

          fca986918b5542a5c35402498556e075f15e91cd

          SHA256

          70c4e7772e9bff2137631185bd0d7e0871d7db6fae1ccf0f2588583dd33299dc

          SHA512

          044c9ad9cc0f67863981ffa13219dccef6493cbf6ec3de537481526f082968c22b0293b51adade65a4e7ba9533c7f8b5fc33e02ddbe007a71510682b07770d55

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku041375.exe

          Filesize

          354KB

          MD5

          7a41e6091d04288d798493587759de59

          SHA1

          a6173ac8a8cc593c3e80eee4c8862fe015914577

          SHA256

          25295e04008342ff2cf093b1c9a7f1d7f490999fdcd6c5287bf9a6c263950f2f

          SHA512

          5d88334fb965f722602e0b8480091d8abd66a02936c815112f6b74d075324aa6cdd996460ed2fc871a6d1f2f782f7e7ed9eaa8bc63ef1caa4b00d610d5dc508a

        • memory/1596-14-0x00007FF81E343000-0x00007FF81E345000-memory.dmp

          Filesize

          8KB

        • memory/1596-15-0x0000000000430000-0x000000000043A000-memory.dmp

          Filesize

          40KB

        • memory/1596-16-0x00007FF81E343000-0x00007FF81E345000-memory.dmp

          Filesize

          8KB

        • memory/2348-64-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-52-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-24-0x0000000007160000-0x00000000071A4000-memory.dmp

          Filesize

          272KB

        • memory/2348-32-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-38-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-88-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-86-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-84-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-82-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-80-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-78-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-74-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-72-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-70-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-68-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-66-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-22-0x0000000004970000-0x00000000049B6000-memory.dmp

          Filesize

          280KB

        • memory/2348-62-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-60-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-58-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-54-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-23-0x0000000007210000-0x00000000077B4000-memory.dmp

          Filesize

          5.6MB

        • memory/2348-50-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-48-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-46-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-44-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-42-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-40-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-36-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-34-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-30-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-28-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-76-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-56-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-26-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-25-0x0000000007160000-0x000000000719F000-memory.dmp

          Filesize

          252KB

        • memory/2348-931-0x00000000077C0000-0x0000000007DD8000-memory.dmp

          Filesize

          6.1MB

        • memory/2348-932-0x0000000007E60000-0x0000000007F6A000-memory.dmp

          Filesize

          1.0MB

        • memory/2348-933-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

          Filesize

          72KB

        • memory/2348-934-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

          Filesize

          240KB

        • memory/2348-935-0x0000000008110000-0x000000000815C000-memory.dmp

          Filesize

          304KB