Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
10/05/2024, 13:11
General
- Target c47b15f9672b5795b62a389de76336302127184be510254d08b9b5100134dd7d.exe
- Size 309KB
- Sample240510-qfa2rsbe83
- SHA256 c47b15f9672b5795b62a389de76336302127184be510254d08b9b5100134dd7d
Malware Config
Extracted
-
redline
-
mihan
-
217.196.96.101:4132
-
auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520
Signatures
- Detects Healer an antivirus disabler dropper 17 IoCs
- Healer
Healer an antivirus disabler dropper.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c47b15f9672b5795b62a389de76336302127184be510254d08b9b5100134dd7d.exe"C:\Users\Admin\AppData\Local\Temp\c47b15f9672b5795b62a389de76336302127184be510254d08b9b5100134dd7d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3027297.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3027297.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b5851738.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b5851738.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
a3027297.exe
b5851738.exe
memory/3184-56-0x0000000074230000-0x00000000742DB000-memory.dmp
memory/3184-55-0x00000000023B0000-0x00000000023FC000-memory.dmp
memory/3184-54-0x000000000A040000-0x000000000A07C000-memory.dmp
memory/3184-53-0x0000000074230000-0x00000000742DB000-memory.dmp
memory/3184-52-0x0000000009FE0000-0x0000000009FF2000-memory.dmp
memory/3184-51-0x000000000A0B0000-0x000000000A1BA000-memory.dmp
memory/3184-50-0x000000000A540000-0x000000000AB58000-memory.dmp
memory/3184-49-0x0000000004B20000-0x0000000004B26000-memory.dmp
memory/3184-47-0x0000000000240000-0x0000000000270000-memory.dmp
memory/3184-48-0x0000000074230000-0x00000000742DB000-memory.dmp
memory/3200-40-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-43-0x0000000074280000-0x0000000074A30000-memory.dmp
memory/3200-20-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-18-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-36-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-34-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-32-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-30-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-28-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-13-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-12-0x0000000074280000-0x0000000074A30000-memory.dmp
memory/3200-22-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-24-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-26-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-41-0x0000000074280000-0x0000000074A30000-memory.dmp
memory/3200-38-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-14-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-16-0x0000000004990000-0x00000000049A2000-memory.dmp
memory/3200-11-0x0000000004990000-0x00000000049A8000-memory.dmp
memory/3200-10-0x0000000074280000-0x0000000074A30000-memory.dmp
memory/3200-9-0x0000000004A70000-0x0000000005014000-memory.dmp
memory/3200-8-0x0000000002290000-0x00000000022AA000-memory.dmp
memory/3200-7-0x000000007428E000-0x000000007428F000-memory.dmp