Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 08:59

General

  • Target

    c211c71c4e05ad54ca8412302494e62cfef12eeef34da04bcf9b3c667514656a.exe

  • Size

    1.1MB

  • MD5

    2d969c73c1d99c6a9a198d6381eb0532

  • SHA1

    c2256985a4f08c0766ff290c7c9efa62ca00b782

  • SHA256

    c211c71c4e05ad54ca8412302494e62cfef12eeef34da04bcf9b3c667514656a

  • SHA512

    6268b98d236277b0049c671d4f7f18c8a5b26d5adca89c617ae0cba71ebdf3151af46aac1d371d3ffa063edc903df39446d17c11e59d0d2d0ccb86bf2622a7e1

  • SSDEEP

    24576:Wya9L1FwDXXiS0m0qxE9KYiojPccVF47tBHXvoB9uDu3P2OaIBbVhq:lkM7SW0qxwK1ojPccVW7PnhabVh

Malware Config

Extracted

Family

redline

Botnet

maxbi

C2

185.161.248.73:4164

Attributes
  • auth_value

    6aa7dba884fe45693dfa04c91440daef

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c211c71c4e05ad54ca8412302494e62cfef12eeef34da04bcf9b3c667514656a.exe
    "C:\Users\Admin\AppData\Local\Temp\c211c71c4e05ad54ca8412302494e62cfef12eeef34da04bcf9b3c667514656a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i30199716.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i30199716.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i29593467.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i29593467.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:612
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a79350827.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a79350827.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4612
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1096
            5⤵
            • Program crash
            PID:804
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b42430628.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b42430628.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:372
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4612 -ip 4612
    1⤵
      PID:2116

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i30199716.exe

            Filesize

            646KB

            MD5

            7b10849c090d55ebabec6c88681a58a2

            SHA1

            68a0cc7b6c271889be06fcd5887a079b8de65c35

            SHA256

            d22fe2f55fbacc45800db3e805d1787b9816ea08ce0cd302903a41f4ba1c6623

            SHA512

            9fde6fe75a8c2edf0cbd0dadfda027a3b0cd8821d5cc1322caac5e5e6a7cd18489854bc26294ee4447dc1fb9ad2260c2b3cdda7ca599614d3e9f45d57cd8e865

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i29593467.exe

            Filesize

            386KB

            MD5

            2ef99d8b78b22f10f0b0c76e833fb278

            SHA1

            f84bb3a9889f03640a37232b71ae9ec0b3042c44

            SHA256

            3f7eed0eb69ec24e1f8623a492088fd566a1fd61e2ae4cfff4f33d7778931586

            SHA512

            a6a9087c85f420df132bbe3b63f3601d46b77b66874298286aa7871bc55515a69dc14b96b60feda718ec70289e286559b293d4c611f59430cdc51103763a0561

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a79350827.exe

            Filesize

            294KB

            MD5

            f1477fec2edbf82cd829e8c8a3c26265

            SHA1

            d8cae5e77c025b4c122b970b7c6d04833e7330cf

            SHA256

            fa314f8240e9d4791a87e35cfb914e28eeb8551d51a005a1c2a0bc757a6d6e25

            SHA512

            d01dc1ae737f28830c823357fbc8cca104f652a2ce4db1338bcd509c4c6051575f7e8468f9aa08ece45da315c71fcb5b20d713d2a2663fa7856d326ec7f03a1d

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b42430628.exe

            Filesize

            168KB

            MD5

            17f75b96ee94b0e55b69fdf7f14d6852

            SHA1

            4fbbfe42674d6418f70681e55c561f0445f46ac6

            SHA256

            67a207f23396e4c437fb989150f2a55b5452aa82445799a6dd341a1479245739

            SHA512

            497f03f4009a85bf32aa5759b95d8e0ac6f70c639d38d8c7aa7c819f22b938a515452e62e018b732ae1f4b269801755914e9aefc7190f8120413cebc81e064ea

          • memory/372-72-0x00000000042C0000-0x000000000430C000-memory.dmp

            Filesize

            304KB

          • memory/372-71-0x0000000009F80000-0x0000000009FBC000-memory.dmp

            Filesize

            240KB

          • memory/372-70-0x0000000009F20000-0x0000000009F32000-memory.dmp

            Filesize

            72KB

          • memory/372-69-0x0000000009FF0000-0x000000000A0FA000-memory.dmp

            Filesize

            1.0MB

          • memory/372-68-0x000000000A4D0000-0x000000000AAE8000-memory.dmp

            Filesize

            6.1MB

          • memory/372-67-0x0000000002270000-0x0000000002276000-memory.dmp

            Filesize

            24KB

          • memory/372-66-0x0000000000040000-0x0000000000070000-memory.dmp

            Filesize

            192KB

          • memory/4612-37-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-56-0x0000000000780000-0x0000000000880000-memory.dmp

            Filesize

            1024KB

          • memory/4612-49-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-47-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-43-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-41-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-39-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-53-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-35-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-31-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-28-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-33-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-29-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-51-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-57-0x00000000006D0000-0x00000000006FD000-memory.dmp

            Filesize

            180KB

          • memory/4612-59-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/4612-58-0x0000000000400000-0x00000000006CA000-memory.dmp

            Filesize

            2.8MB

          • memory/4612-61-0x0000000000400000-0x00000000006CA000-memory.dmp

            Filesize

            2.8MB

          • memory/4612-62-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/4612-55-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-45-0x00000000024F0000-0x0000000002502000-memory.dmp

            Filesize

            72KB

          • memory/4612-27-0x00000000024F0000-0x0000000002508000-memory.dmp

            Filesize

            96KB

          • memory/4612-26-0x0000000004F50000-0x00000000054F4000-memory.dmp

            Filesize

            5.6MB

          • memory/4612-25-0x0000000002370000-0x000000000238A000-memory.dmp

            Filesize

            104KB

          • memory/4612-24-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/4612-23-0x00000000006D0000-0x00000000006FD000-memory.dmp

            Filesize

            180KB

          • memory/4612-22-0x0000000000780000-0x0000000000880000-memory.dmp

            Filesize

            1024KB