Analysis

  • max time kernel
    116s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 19:52

General

  • Target

    541cecd2fe318b8102042fda4b8322d3308eb9ea417db33d74eb4cc06c85c0c1N.exe

  • Size

    385KB

  • MD5

    84b9335fba6769263b80c8eb90c95c00

  • SHA1

    4cf4ea7d200e53ee731bf0757ae7efc3b253046e

  • SHA256

    541cecd2fe318b8102042fda4b8322d3308eb9ea417db33d74eb4cc06c85c0c1

  • SHA512

    341d752cad51a3203bda876e6b9dda231c023ce8e2f6c9fa650f57122c812fa1351df58c2a2c118ac14dce2a9788625c1cfb60a7071f19c033f06b1e1a1eec94

  • SSDEEP

    6144:8Mp0yN90QEccmITqfL88msJB6Hrpszqvbc9cFACd2q2K9fOwHCWbjQaR3:Oy906gT4D+TzcCFhX2K92T23

Malware Config

Extracted

Family

redline

Botnet

maxbi

C2

185.161.248.73:4164

Attributes
  • auth_value

    6aa7dba884fe45693dfa04c91440daef

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\541cecd2fe318b8102042fda4b8322d3308eb9ea417db33d74eb4cc06c85c0c1N.exe
    "C:\Users\Admin\AppData\Local\Temp\541cecd2fe318b8102042fda4b8322d3308eb9ea417db33d74eb4cc06c85c0c1N.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a92405775.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a92405775.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3272
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b18432150.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b18432150.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1308

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a92405775.exe

          Filesize

          291KB

          MD5

          ce27553a2a3454e82a427b2a8a7847b8

          SHA1

          572ce8d9daf60ba37132dfef202a22bf1db391e0

          SHA256

          97734c5b3a6cc99d4baaafd1ca3e844e27b35b5c2072b2dd2fc258b3504a5373

          SHA512

          036a00e8a137b9d746573598d4b4d51fe9c5f835abe72af0992261fc96e7a6d575209f4daafdeb6910fffcf7ef85fc10a42957c3d5c25d76b55c5fb31b1fda37

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b18432150.exe

          Filesize

          168KB

          MD5

          df9334955bb2461c384e61f8f8d7a628

          SHA1

          8a277eeb18bf974fdd58c5e5825c6779fde6ae51

          SHA256

          827f9a77b86cb4745363cfeb07be2d2ab04149536a4085324289b9de1011bb5e

          SHA512

          0055f0fe6417ff86d1d1ccb4cf8af88e1c481b325366922d1829281d1d3b957a54efaafa12f6fd8249ed96e1985d50f44d9aca8600e9fc2bcb5deec40a28019c

        • memory/1308-60-0x0000000005030000-0x000000000507C000-memory.dmp

          Filesize

          304KB

        • memory/1308-61-0x00000000746BE000-0x00000000746BF000-memory.dmp

          Filesize

          4KB

        • memory/1308-58-0x000000000AB80000-0x000000000ABBC000-memory.dmp

          Filesize

          240KB

        • memory/1308-59-0x00000000746B0000-0x0000000074E60000-memory.dmp

          Filesize

          7.7MB

        • memory/1308-57-0x000000000AB20000-0x000000000AB32000-memory.dmp

          Filesize

          72KB

        • memory/1308-56-0x000000000ABF0000-0x000000000ACFA000-memory.dmp

          Filesize

          1.0MB

        • memory/1308-55-0x000000000B080000-0x000000000B698000-memory.dmp

          Filesize

          6.1MB

        • memory/1308-62-0x00000000746B0000-0x0000000074E60000-memory.dmp

          Filesize

          7.7MB

        • memory/1308-54-0x0000000002EF0000-0x0000000002EF6000-memory.dmp

          Filesize

          24KB

        • memory/1308-52-0x00000000746BE000-0x00000000746BF000-memory.dmp

          Filesize

          4KB

        • memory/1308-53-0x0000000000D80000-0x0000000000DB0000-memory.dmp

          Filesize

          192KB

        • memory/3272-40-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-48-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/3272-26-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-24-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-42-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-22-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-20-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-18-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-17-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-15-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-43-0x0000000000880000-0x0000000000980000-memory.dmp

          Filesize

          1024KB

        • memory/3272-44-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/3272-47-0x0000000000400000-0x00000000006C9000-memory.dmp

          Filesize

          2.8MB

        • memory/3272-29-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-30-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-33-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-36-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-38-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-34-0x0000000004C60000-0x0000000004C72000-memory.dmp

          Filesize

          72KB

        • memory/3272-14-0x0000000004C60000-0x0000000004C78000-memory.dmp

          Filesize

          96KB

        • memory/3272-13-0x0000000004CC0000-0x0000000005264000-memory.dmp

          Filesize

          5.6MB

        • memory/3272-12-0x0000000002250000-0x000000000226A000-memory.dmp

          Filesize

          104KB

        • memory/3272-11-0x0000000000400000-0x00000000006C9000-memory.dmp

          Filesize

          2.8MB

        • memory/3272-9-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/3272-10-0x0000000000400000-0x00000000006C9000-memory.dmp

          Filesize

          2.8MB

        • memory/3272-8-0x0000000000880000-0x0000000000980000-memory.dmp

          Filesize

          1024KB