Analysis
- max time kernel
144s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
09/05/2024, 14:29
General
- Target 7f80787d38486459a9c104bc8c42dd78c68e0e27411be54897379c415c7c73fd.exe
- Size 690KB
- Sample240509-rtms6aed2s
- SHA256 7f80787d38486459a9c104bc8c42dd78c68e0e27411be54897379c415c7c73fd
Malware Config
Extracted
-
redline
-
rosn
-
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
- Detects Healer an antivirus disabler dropper 17 IoCs
- Healer
Healer an antivirus disabler dropper.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 20 IoCs
- Executes dropped EXE 3 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f80787d38486459a9c104bc8c42dd78c68e0e27411be54897379c415c7c73fd.exe"C:\Users\Admin\AppData\Local\Temp\7f80787d38486459a9c104bc8c42dd78c68e0e27411be54897379c415c7c73fd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un866970.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un866970.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1420.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1420.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 10764⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8957.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8957.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4800 -ip 48001⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
un866970.exe
pro1420.exe
qu8957.exe
memory/628-75-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-73-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-970-0x0000000005CA0000-0x0000000005CEC000-memory.dmp
memory/628-969-0x0000000005B50000-0x0000000005B8C000-memory.dmp
memory/628-968-0x0000000005B30000-0x0000000005B42000-memory.dmp
memory/628-967-0x00000000059F0000-0x0000000005AFA000-memory.dmp
memory/628-966-0x0000000005350000-0x0000000005968000-memory.dmp
memory/628-60-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-83-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-59-0x0000000004CF0000-0x0000000004D34000-memory.dmp
memory/628-65-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-67-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-71-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-61-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-77-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-79-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-81-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-85-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-87-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-89-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-91-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-93-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-69-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/628-58-0x0000000004C40000-0x0000000004C86000-memory.dmp
memory/628-63-0x0000000004CF0000-0x0000000004D2F000-memory.dmp
memory/4800-21-0x0000000002AA0000-0x0000000002AB8000-memory.dmp
memory/4800-25-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-52-0x0000000000400000-0x000000000070B000-memory.dmp
memory/4800-53-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4800-23-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-22-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-15-0x0000000000710000-0x0000000000810000-memory.dmp
memory/4800-27-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-29-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-31-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-17-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4800-33-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-45-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-16-0x0000000000900000-0x000000000092D000-memory.dmp
memory/4800-39-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-43-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-37-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-47-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-49-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-41-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-35-0x0000000002AA0000-0x0000000002AB2000-memory.dmp
memory/4800-20-0x0000000004EB0000-0x0000000005454000-memory.dmp
memory/4800-19-0x0000000002430000-0x000000000244A000-memory.dmp
memory/4800-18-0x0000000000400000-0x000000000070B000-memory.dmp