Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-11-2024 07:39

General

  • Target

    65195068e77682b5c34a56e22ebddfafbc1a9bbb371be19be9ba205e73b8b0c0.exe

  • Size

    552KB

  • MD5

    f7fb852e1bf32deb890ef62bc755201d

  • SHA1

    b5ee388ddd8c0ce44154d068d863dd1c5a62390e

  • SHA256

    65195068e77682b5c34a56e22ebddfafbc1a9bbb371be19be9ba205e73b8b0c0

  • SHA512

    59d266d95fe7687fdb4980f7338353ef165fc6e734439dcf48571efc77e1afed5e6d2df7e56325b927d7da6fc133cf3bdd3a23c51b1051e382d252ba39edc4a9

  • SSDEEP

    12288:zMrey90kVZy72+ztY+0wibcuC0LFtuFsezq:xy26+ztY+obm0yFPzq

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65195068e77682b5c34a56e22ebddfafbc1a9bbb371be19be9ba205e73b8b0c0.exe
    "C:\Users\Admin\AppData\Local\Temp\65195068e77682b5c34a56e22ebddfafbc1a9bbb371be19be9ba205e73b8b0c0.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7026YE.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7026YE.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3456
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c87cv62.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c87cv62.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b7026YE.exe

    Filesize

    323KB

    MD5

    ee43881ab62092621b2d2e22a0295878

    SHA1

    0339221e3f787602fea6a0541817565d751a293c

    SHA256

    2764ed1001c0289c438398b43297206b64e883f65c34eec0418f809392bab22d

    SHA512

    df6b636d896665a3ec9ee572dc8dcb79169c02316741d9a693d7c09be7ce419e373b1c4d0635c8ecda95e936313750820fb97ee31111a005b334f44ec6112f6c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c87cv62.exe

    Filesize

    381KB

    MD5

    79183f88b273bd94752126e28a74a872

    SHA1

    4969ee7676f48a9c26c21da543322993704c403f

    SHA256

    35c6bb7d3f63d1c1b25b5dba53cbbbc3b3876baf9c02688ca95768b2b4062f21

    SHA512

    c7f4663100fef6e7206b9f879afb6b1309460ef14af23444f9ef0e115e2d7892831e04dd4a344eac4d77654d400360223c45d1343638cf5f45edaefc1e569899

  • memory/3456-8-0x0000000000690000-0x0000000000790000-memory.dmp

    Filesize

    1024KB

  • memory/3456-9-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/3456-10-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3456-11-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3456-12-0x0000000002260000-0x000000000227A000-memory.dmp

    Filesize

    104KB

  • memory/3456-13-0x0000000004B60000-0x0000000005104000-memory.dmp

    Filesize

    5.6MB

  • memory/3456-14-0x0000000002620000-0x0000000002638000-memory.dmp

    Filesize

    96KB

  • memory/3456-15-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-19-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-42-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-40-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-38-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-36-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-34-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-30-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-28-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-27-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-24-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-23-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-21-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-16-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-32-0x0000000002620000-0x0000000002632000-memory.dmp

    Filesize

    72KB

  • memory/3456-43-0x0000000000690000-0x0000000000790000-memory.dmp

    Filesize

    1024KB

  • memory/3456-44-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/3456-47-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3456-48-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/4964-53-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

  • memory/4964-54-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

  • memory/4964-56-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

  • memory/4964-55-0x0000000004A10000-0x0000000004A56000-memory.dmp

    Filesize

    280KB

  • memory/4964-57-0x0000000004AC0000-0x0000000004B04000-memory.dmp

    Filesize

    272KB

  • memory/4964-61-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-77-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-91-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-90-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-87-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-85-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-83-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-81-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-79-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-75-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-73-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-71-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-69-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-67-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-65-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-64-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-59-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-58-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

    Filesize

    248KB

  • memory/4964-964-0x0000000005170000-0x0000000005788000-memory.dmp

    Filesize

    6.1MB

  • memory/4964-965-0x00000000057C0000-0x00000000058CA000-memory.dmp

    Filesize

    1.0MB

  • memory/4964-966-0x0000000005900000-0x0000000005912000-memory.dmp

    Filesize

    72KB

  • memory/4964-967-0x0000000005920000-0x000000000595C000-memory.dmp

    Filesize

    240KB

  • memory/4964-968-0x0000000005A70000-0x0000000005ABC000-memory.dmp

    Filesize

    304KB