Analysis
- max time kernel
142s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
10/05/2024, 13:11
General
- Target c429566ed481fe562466b6e87d2cfe6fc492efeb3007819b63dd4cf45594d639.exe
- Size 309KB
- Sample240510-qfa2rsbe83
- SHA256 c429566ed481fe562466b6e87d2cfe6fc492efeb3007819b63dd4cf45594d639
Malware Config
Extracted
-
redline
-
mihan
-
217.196.96.101:4132
-
auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520
Signatures
- Detects Healer an antivirus disabler dropper 17 IoCs
- Healer
Healer an antivirus disabler dropper.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c429566ed481fe562466b6e87d2cfe6fc492efeb3007819b63dd4cf45594d639.exe"C:\Users\Admin\AppData\Local\Temp\c429566ed481fe562466b6e87d2cfe6fc492efeb3007819b63dd4cf45594d639.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a9236674.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a9236674.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b3995746.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b3995746.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1392,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
a9236674.exe
b3995746.exe
memory/1448-40-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-18-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-10-0x0000000004A50000-0x0000000004FF4000-memory.dmp
memory/1448-11-0x0000000004990000-0x00000000049A8000-memory.dmp
memory/1448-12-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/1448-34-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-8-0x00000000022B0000-0x00000000022CA000-memory.dmp
memory/1448-38-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-36-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-32-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-30-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-28-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-41-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/1448-26-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-24-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-22-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-9-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/1448-16-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-20-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-14-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-13-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/1448-43-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/1448-7-0x000000007463E000-0x000000007463F000-memory.dmp
memory/4968-47-0x00000000009F0000-0x0000000000A20000-memory.dmp
memory/4968-48-0x00000000745E0000-0x000000007468B000-memory.dmp
memory/4968-49-0x00000000012E0000-0x00000000012E6000-memory.dmp
memory/4968-50-0x0000000005A90000-0x00000000060A8000-memory.dmp
memory/4968-51-0x0000000005470000-0x000000000557A000-memory.dmp
memory/4968-52-0x00000000745E0000-0x000000007468B000-memory.dmp
memory/4968-53-0x0000000002D10000-0x0000000002D22000-memory.dmp
memory/4968-54-0x0000000002D70000-0x0000000002DAC000-memory.dmp
memory/4968-55-0x0000000005580000-0x00000000055CC000-memory.dmp
memory/4968-56-0x00000000745E0000-0x000000007468B000-memory.dmp