Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2024, 20:13

General

  • Target

    e53211d2a16134493491a51c651216136f692678bb87d9f5d445dde06cb09f43.exe

  • Size

    375KB

  • MD5

    a81e8c31e5e3962fe06ea7eb2b2c6cf9

  • SHA1

    d6aab69cc9d26524ac9a39e1386e81f22d6dce41

  • SHA256

    e53211d2a16134493491a51c651216136f692678bb87d9f5d445dde06cb09f43

  • SHA512

    6d26bea4cff094694c47d90651719f0acc3cf5b11e468f450bc4dc61f81fb9a73318be61a7523e11e6a9447339573f932389d6a7015c2670e60fb20d4092f87c

  • SSDEEP

    6144:Kmy+bnr+Up0yN90QEpNA4CWpDj/Ej/FFYCvIenrwlDqorItHLUCseXXcuDq:iMroy90bN1CWFsjhz+qorgHACsgXHDq

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5a9421183a033f283b2f23139b471f0

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e53211d2a16134493491a51c651216136f692678bb87d9f5d445dde06cb09f43.exe
    "C:\Users\Admin\AppData\Local\Temp\e53211d2a16134493491a51c651216136f692678bb87d9f5d445dde06cb09f43.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mKe18ZX.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mKe18ZX.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4212
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 1088
        3⤵
        • Program crash
        PID:3528
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVt47zM.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVt47zM.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3796
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4212 -ip 4212
    1⤵
      PID:2364
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:3300

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mKe18ZX.exe

      Filesize

      235KB

      MD5

      6624f30ded3013757b0c939b54784923

      SHA1

      6ef093b81a84500e1e15478e221a60cef1558284

      SHA256

      ef1da0cddbba5ac7cc5cbbb54d432058e036969776e65d3bfbb06afb705d1db8

      SHA512

      e14cb8e0e3e2a76c2597534a08ef454cdfb6637ae32fb29280a0e38756554de2d160c499b11c8a6a0272522dc577e1d1b2d6b478e37c2e747a5321ba83069391

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVt47zM.exe

      Filesize

      175KB

      MD5

      dd0c9e110c68ce1fa5308979ef718f7b

      SHA1

      473deb8069f0841d47b74b7f414dacc6f96eca78

      SHA256

      dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

      SHA512

      29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

    • memory/3796-59-0x00000000749EE000-0x00000000749EF000-memory.dmp

      Filesize

      4KB

    • memory/3796-58-0x00000000055E0000-0x000000000562C000-memory.dmp

      Filesize

      304KB

    • memory/3796-57-0x0000000005460000-0x000000000549C000-memory.dmp

      Filesize

      240KB

    • memory/3796-56-0x0000000005400000-0x0000000005412000-memory.dmp

      Filesize

      72KB

    • memory/3796-55-0x00000000054D0000-0x00000000055DA000-memory.dmp

      Filesize

      1.0MB

    • memory/3796-54-0x0000000005960000-0x0000000005F78000-memory.dmp

      Filesize

      6.1MB

    • memory/3796-52-0x00000000749EE000-0x00000000749EF000-memory.dmp

      Filesize

      4KB

    • memory/3796-53-0x0000000000B30000-0x0000000000B62000-memory.dmp

      Filesize

      200KB

    • memory/4212-42-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-43-0x0000000000980000-0x0000000000A80000-memory.dmp

      Filesize

      1024KB

    • memory/4212-34-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-33-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-30-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-28-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-26-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-25-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-22-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-20-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-16-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-15-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-18-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-36-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-44-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4212-47-0x0000000000400000-0x0000000000759000-memory.dmp

      Filesize

      3.3MB

    • memory/4212-48-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4212-38-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-40-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4212-14-0x0000000004CF0000-0x0000000004D08000-memory.dmp

      Filesize

      96KB

    • memory/4212-13-0x0000000004DD0000-0x0000000005374000-memory.dmp

      Filesize

      5.6MB

    • memory/4212-12-0x00000000025D0000-0x00000000025EA000-memory.dmp

      Filesize

      104KB

    • memory/4212-11-0x0000000000400000-0x0000000000759000-memory.dmp

      Filesize

      3.3MB

    • memory/4212-10-0x0000000000400000-0x0000000000759000-memory.dmp

      Filesize

      3.3MB

    • memory/4212-9-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4212-8-0x0000000000980000-0x0000000000A80000-memory.dmp

      Filesize

      1024KB