Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
10-05-2024 13:11
General
-
Target
c47b15f9672b5795b62a389de76336302127184be510254d08b9b5100134dd7d.exe
-
Size
309KB
-
MD5
29b6f7f057eac5b191f6c8afd570de01
-
SHA1
42d70940116df9fd978d8c6c8429c125fc421670
-
SHA256
c47b15f9672b5795b62a389de76336302127184be510254d08b9b5100134dd7d
-
SHA512
08da0693b309a1b7549610f10e1f90e47deb87033a78403caa0220e916ffb2f4126f07848d7a8c1f94c947ce2915933ad205cb4e5ba54f5d0d560cf486642207
-
SSDEEP
6144:KHy+bnr+Up0yN90QE05F5OYc1u31g4TByPS6C+jIQpO56Iw:9MrEy90uxc1u31TTEP/7vxd
Malware Config
Extracted
redline
mihan
217.196.96.101:4132
-
auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c47b15f9672b5795b62a389de76336302127184be510254d08b9b5100134dd7d.exe"C:\Users\Admin\AppData\Local\Temp\c47b15f9672b5795b62a389de76336302127184be510254d08b9b5100134dd7d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3027297.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3027297.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b5851738.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b5851738.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5a92537fedf49fd467c41d80bde9ba55d
SHA1685abba2395ef1a3405f91e849e452ee4aa99226
SHA256a0e9f5fb78ce13719eba331ddc31e1c9e0c7712c8466692695331657658ff404
SHA512c90ceefe96baeb9583e1834ec1b3b058785cf466a2d998c32e3e644413e9ad515359ccccb87c8575af0120be27af3dd167dcdbe01c3246fb451b6d321c80282f
-
Filesize
168KB
MD5a71b72e1859bd9a5c048a3c5ee5dfc7b
SHA199896b37b82091d11c534ec59e0c4204f4cd0fcc
SHA256141b7eea951585dfd88dbdcd219722d2d8307fc7cbf8c720bd23e3b897966d60
SHA512b970d9a52df7a0f34e53515f0a6ca9f6cd01d6b1efefc0c4ccbd08a789281251a57181f813e2c2ddef1d679e73f15357842367307052dd25204c16904c605ce1
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
24KB
-
Filesize
684KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
684KB
-
Filesize
192KB
-
Filesize
304KB
-
Filesize
684KB