Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 01:03

General

  • Target

    0ea54fc1edeec1fa9f152a1f4e3a71920efc6e3a2cc6b98ad3a787317b0bfd17.exe

  • Size

    403KB

  • MD5

    908d0a81665bfa996599d6788693196f

  • SHA1

    2fe3351b2d32a465cb456ee9d72707f6ad437e2a

  • SHA256

    0ea54fc1edeec1fa9f152a1f4e3a71920efc6e3a2cc6b98ad3a787317b0bfd17

  • SHA512

    ccc17dbe7e9f8fb5c2ebed4cc746ef85e1aedfabca68b51aecbe77faec72689c678472f836cad4a6db4cf555d2647df18f8f423c21624170ce037eada9604077

  • SSDEEP

    12288:4Mruy90vcn9WCBXt7DFWX5jyLCEIV5ttp:GyZFWX5jrxtp

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ea54fc1edeec1fa9f152a1f4e3a71920efc6e3a2cc6b98ad3a787317b0bfd17.exe
    "C:\Users\Admin\AppData\Local\Temp\0ea54fc1edeec1fa9f152a1f4e3a71920efc6e3a2cc6b98ad3a787317b0bfd17.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro8173.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro8173.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4480
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu5673.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu5673.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro8173.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu5673.exe

    Filesize

    351KB

    MD5

    dbd87db56c20f1e7f26e00111312679e

    SHA1

    8a215e6374425c811d9394e0b5642f654cb4246c

    SHA256

    124fd360759ef46ac8ca23da904ad63038ffa29986c93750f65fca29a4eb3f44

    SHA512

    74b9a7b1ef7fdce63bd2517b40d0a45b750d6992fa64ef37c882364f1a8247773e0ac622aad82b94d4c19e6bda01fc1371f1c09bef18731096119ca9cdf9df0d

  • memory/3192-15-0x0000000000A60000-0x0000000000B60000-memory.dmp

    Filesize

    1024KB

  • memory/3192-16-0x0000000000890000-0x00000000008DB000-memory.dmp

    Filesize

    300KB

  • memory/3192-17-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/3192-18-0x0000000002510000-0x0000000002556000-memory.dmp

    Filesize

    280KB

  • memory/3192-19-0x0000000004EE0000-0x0000000005484000-memory.dmp

    Filesize

    5.6MB

  • memory/3192-20-0x00000000025D0000-0x0000000002614000-memory.dmp

    Filesize

    272KB

  • memory/3192-38-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-42-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-40-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-36-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-34-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-32-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-30-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-28-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-26-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-24-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-64-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-22-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-44-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-21-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-84-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-82-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-80-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-78-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-76-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-74-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-72-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-70-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-68-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-66-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-62-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-60-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-58-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-56-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-54-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-52-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-50-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-48-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-46-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3192-927-0x0000000005590000-0x0000000005BA8000-memory.dmp

    Filesize

    6.1MB

  • memory/3192-928-0x0000000005BB0000-0x0000000005CBA000-memory.dmp

    Filesize

    1.0MB

  • memory/3192-929-0x0000000004E80000-0x0000000004E92000-memory.dmp

    Filesize

    72KB

  • memory/3192-930-0x0000000005CC0000-0x0000000005CFC000-memory.dmp

    Filesize

    240KB

  • memory/3192-931-0x0000000005E00000-0x0000000005E4C000-memory.dmp

    Filesize

    304KB

  • memory/3192-932-0x0000000000A60000-0x0000000000B60000-memory.dmp

    Filesize

    1024KB

  • memory/3192-933-0x0000000000890000-0x00000000008DB000-memory.dmp

    Filesize

    300KB

  • memory/3192-935-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4480-7-0x00007FFAE25E3000-0x00007FFAE25E5000-memory.dmp

    Filesize

    8KB

  • memory/4480-8-0x0000000000D30000-0x0000000000D3A000-memory.dmp

    Filesize

    40KB

  • memory/4480-9-0x00007FFAE25E3000-0x00007FFAE25E5000-memory.dmp

    Filesize

    8KB