Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
04-03-2024 00:50
General
-
Target
d47c8f91ec2375996ef9a6247f30a70118425ea23afb06d9e87597292eb15f13.exe
-
Size
693KB
-
MD5
b9a1ee247b89fbbfe76c215073d96b4f
-
SHA1
6117cb9a38775531f8a83d42c2c1328e8c1a6183
-
SHA256
d47c8f91ec2375996ef9a6247f30a70118425ea23afb06d9e87597292eb15f13
-
SHA512
bdee37b241dc4f0a496e483982d54810a60479c6ae39a67d5194de558b05f3f9ab611eff3a73d78bdfb89ef7569449b3845549feea89c291a6540656dcec3aae
-
SSDEEP
12288:uMrHy90KdEfVhXaxZILGYumxTDBhCDpCGhHEdamOAY+x8KVe:5yPCVuxmxT73GhH0ue6
Malware Config
Extracted
redline
ruzhpe
pepunn.com:4162
-
auth_value
f735ced96ae8d01d0bd1d514240e54e0
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 17 IoCs
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d47c8f91ec2375996ef9a6247f30a70118425ea23afb06d9e87597292eb15f13.exe"C:\Users\Admin\AppData\Local\Temp\d47c8f91ec2375996ef9a6247f30a70118425ea23afb06d9e87597292eb15f13.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycHp18qg86.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycHp18qg86.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urYK42Nf25.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urYK42Nf25.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 10924⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrUu38Th36.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrUu38Th36.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3996 -ip 39961⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
548KB
MD5a9ef8c3cc4d835a5b00f1ef67e432133
SHA141745259116a9fb2fc5e5b189bc43b2903f28c68
SHA2569bd1bb7e0d6eb69b7eded8959cfdfb95b8391e9df02520a46c4a01f78e58dfb4
SHA512a37902a1a4c35a3f5d250a66f6ece00ca83980bde41356c5a947ab4f3004e2d71182cfd1aacc067d8038e5ce5be4ed0252d18a860047dd61ff066cd5728f4015
-
Filesize
352KB
MD56345b3da7da3d9a3012ba87a252a29f6
SHA1a36f23e5d0802652705df132bce0a8589ff5e7bf
SHA256caf994d14f8b0767df1e38508af9bb7816673aa0b6fc7fbf591a135e3173b7df
SHA5123d82f717809ab81fa0fdb60d262af1547d12a69331b755d02ec94a250f4e25c5aa1adc910381e91bf4d9b32aa8f281f1252e5912068d0378461890a5893fae82
-
Filesize
410KB
MD5cc1e39c942634bbd04ef3eb880af3cb4
SHA1390ee64e70074c204d8c7fc736e69b91940375bc
SHA25698f330627fe244da794aa21cd74d45861fab6d06f9fedc1bcc02eaf434adacec
SHA512f66cac5ccd3318e7c9baca955b64b22f9cb96693557dcf13a7e334878a0e3c2bc18f1757432b78b6c06c28c91881fb2436fc0641f6eb75a57167a4254cb470d2
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
272KB
-
Filesize
6.1MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
7.7MB
-
Filesize
1024KB
-
Filesize
280KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
39.8MB
-
Filesize
72KB
-
Filesize
39.8MB
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
7.7MB
-
Filesize
180KB
-
Filesize
39.8MB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.8MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
64KB