Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 13:31
General
-
Target
0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe
-
Size
690KB
-
MD5
34d8717e57e1e30d1d72c07eef65ddfe
-
SHA1
cbdf2e972a0dd5d9225fd404a70b1b6264fbceff
-
SHA256
0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00
-
SHA512
8e753a5219c153eba5e7369da3ef98a1f0a47edddb3d96cfef7b4f73e96de665927440c4f93cbcf6e1a40b4fc66531a3547c744bd0c7a081bd8726fc883807ce
-
SSDEEP
12288:xUlkXVb1OMBbwB+Pw2Bt3D46kp1j40d8CHYEW1jKGw2T/UVmVFcM:xUmrOMBo7etT4pjf8CHYEW1ji2T8Vg
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe"C:\Users\Admin\AppData\Local\Temp\0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilH1185.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilH1185.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr194876.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr194876.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku843123.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku843123.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
404KB
MD5fc26679ca223c30d775882fc2fd4ced4
SHA1e26c8a65b3a6c0b52a88876f6cae0bf3bf806f6b
SHA2566c34804ae1fb2383ce034c8a68be5bb16984c3aa5638f25ba50ab9111eea1b32
SHA512dd8f3e2840220662794bdd3342c2e6d1cb63b08bfc36fd4066ff0a6e13a0ee8dd633271891ec36805d4d4f9f4fc31a3829fe5e8eddb5d7ebdabd557179202c90
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
358KB
MD5ccef72544333fb6d240d7834c6529657
SHA14598184479cc118f51717408313b47d146c66443
SHA2565e0cdfa2cd6aeb1b3d3e6f41296227ea63449dea84439f42db0ff32383c05782
SHA512d889137ab8d1f242dbac3815c33b7509681327aa93b381cbdd894d722ae1b625c7c4e6adb0c13c4f099d85ca95f5c5f82c06a3b72f954f969fb2c88370307564
-
Filesize
248KB
-
Filesize
304KB
-
Filesize
3.1MB
-
Filesize
248KB
-
Filesize
1024KB
-
Filesize
248KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
1024KB
-
Filesize
312KB
-
Filesize
3.1MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
312KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
568KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
3.4MB
-
Filesize
568KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
8KB