Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 16:48

General

  • Target

    445f1c4ae882368c8c85b79d61d4d645e202a5a0d646ef231be103f1b98590ecN.exe

  • Size

    394KB

  • MD5

    0c449b63eaadd97b37c6e83730fbc840

  • SHA1

    fac197136dc2ec0ed3cac6fb8589c0576c2652c3

  • SHA256

    445f1c4ae882368c8c85b79d61d4d645e202a5a0d646ef231be103f1b98590ec

  • SHA512

    81f49072ccfb4bf303a810d801e74ceed99ff3c19c8d9319cd1cef0853a843802859bdc07fda108eb226a9135d231e9c2b7321dad3a7290b12b2274525aa7651

  • SSDEEP

    6144:KDy+bnr+Rp0yN90QE6l3Iqp66uwD8NjjO2daa98X7jx6HrfhJkI0i:RMrhy904l4VNHzway4L5X0i

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\445f1c4ae882368c8c85b79d61d4d645e202a5a0d646ef231be103f1b98590ecN.exe
    "C:\Users\Admin\AppData\Local\Temp\445f1c4ae882368c8c85b79d61d4d645e202a5a0d646ef231be103f1b98590ecN.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr726709.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr726709.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3076
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku469043.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku469043.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr726709.exe

    Filesize

    13KB

    MD5

    e9ca0cb1ca59b2096deab75ea096f5f6

    SHA1

    6168a026576cd564c32fcf5c29e5fde3389d43a9

    SHA256

    a58f5aa1284c6abfdff790cd36f22ed6f28ddfaa321ed3937544c20e3f67ed0b

    SHA512

    413c9402a3dd13153f51236079bdbc6cdda17847b1d9112a8004cc494738ba80d0fc8a1020579c4eb5e00516b41315ff694dc5bed7a68d2b5d0d5e8024d8aa37

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku469043.exe

    Filesize

    353KB

    MD5

    fe996a0d8913455a9512c9cf02d022b2

    SHA1

    49d68f44063063392e2ec7e4b178703f63c524ae

    SHA256

    e6d9cafc63c0660752a872c58d3d44b866d61281b12c98a007ef4b9adaf218bd

    SHA512

    e325a01e22b47251fa31e37d15a6f7dc1a053d79d51b54f1b9fb762cbb1a48370163321cd6fe59bafc98186daa45661496880dc7f531d3e14434be9f5342deae

  • memory/668-15-0x0000000000820000-0x0000000000920000-memory.dmp

    Filesize

    1024KB

  • memory/668-16-0x0000000002480000-0x00000000024CB000-memory.dmp

    Filesize

    300KB

  • memory/668-17-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/668-18-0x0000000004D10000-0x0000000004D56000-memory.dmp

    Filesize

    280KB

  • memory/668-19-0x0000000004DA0000-0x0000000005344000-memory.dmp

    Filesize

    5.6MB

  • memory/668-20-0x00000000053A0000-0x00000000053E4000-memory.dmp

    Filesize

    272KB

  • memory/668-22-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-28-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-84-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-82-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-80-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-78-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-76-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-74-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-72-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-70-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-68-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-64-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-62-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-60-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-58-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-56-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-54-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-52-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-50-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-48-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-46-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-44-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-42-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-38-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-36-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-34-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-32-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-30-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-26-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-24-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-66-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-40-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-21-0x00000000053A0000-0x00000000053DF000-memory.dmp

    Filesize

    252KB

  • memory/668-927-0x0000000005440000-0x0000000005A58000-memory.dmp

    Filesize

    6.1MB

  • memory/668-928-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

    Filesize

    1.0MB

  • memory/668-929-0x0000000005C20000-0x0000000005C32000-memory.dmp

    Filesize

    72KB

  • memory/668-930-0x0000000005C40000-0x0000000005C7C000-memory.dmp

    Filesize

    240KB

  • memory/668-931-0x0000000005D90000-0x0000000005DDC000-memory.dmp

    Filesize

    304KB

  • memory/668-932-0x0000000000820000-0x0000000000920000-memory.dmp

    Filesize

    1024KB

  • memory/668-934-0x0000000002480000-0x00000000024CB000-memory.dmp

    Filesize

    300KB

  • memory/668-935-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/3076-7-0x00007FFC18593000-0x00007FFC18595000-memory.dmp

    Filesize

    8KB

  • memory/3076-8-0x00000000005A0000-0x00000000005AA000-memory.dmp

    Filesize

    40KB

  • memory/3076-9-0x00007FFC18593000-0x00007FFC18595000-memory.dmp

    Filesize

    8KB