Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 14:12
General
-
Target
71f01e8de9346e22ee67005c8c0d6e043fa863d541b32ce11f48eb3d3b642482.exe
-
Size
666KB
-
MD5
32d84dbf8730f21dfe16fefe7bd8fbb5
-
SHA1
4bc91589ff4fcf072bece8971322841bdd4a8210
-
SHA256
71f01e8de9346e22ee67005c8c0d6e043fa863d541b32ce11f48eb3d3b642482
-
SHA512
45b11cdcbc078460fea27d1e269d0aa654944cdebaae0d821af6498fb64cf67e41bd4ba37b8d93ff04fc7244b6bc5c4a206c66c61f487c0385316171b2cc48c8
-
SSDEEP
12288:HMrzy907UEYA2YPF8Q2W6WymR+pLq8QIo6vtLNFbnDFU7:cypEYgPNR+pLqRt6vlNFy7
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71f01e8de9346e22ee67005c8c0d6e043fa863d541b32ce11f48eb3d3b642482.exe"C:\Users\Admin\AppData\Local\Temp\71f01e8de9346e22ee67005c8c0d6e043fa863d541b32ce11f48eb3d3b642482.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un358114.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un358114.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1008.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1008.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 10644⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2582.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2582.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4300 -ip 43001⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
524KB
MD5b6c9f77b4fa6eb25bd1c49cee48473fd
SHA1d2013d5d286e765822cc176073404b043f5e1063
SHA2562f2ec9debdcd1857ade5c15dc1e8915a12cc8875bd2847d88ce3f0520239b834
SHA51211e5fb35edb52df0159e74f9505bd965e1d2da1e658c87db59c5217aac18d10336a441bbe8393a57474e546f4240f161d5ae2c8081e0bcb914d266d1a3cd07a7
-
Filesize
294KB
MD5ddc624c043fcdfb7025257b0e59f31a5
SHA102fd9af47f13b425c2e03696225cbfd78a443015
SHA256ffd796e25079fd4648e0a5adf35e0542618cd8280184730ad80d974d7732b20f
SHA5127bbcc70dfd140e3675adcb65480fe2707c8d3d1e54a7f18949805ff66ad4b70a285e6530063a2e96aa8b65c8a0e159e867d47918e828b91e308b9f4f0b3dad4f
-
Filesize
353KB
MD511aff3a44973cce6d628ed29341607b4
SHA1c20444542e2a0c8081cfc47c793e2a02826f8f89
SHA256d035c4ca01bf0cee293a8e35ff34768355c8748567108fdd5dfa3c4d89816d3c
SHA51276eae33deb8ebea5d725b134c923711513fd6f1eb642310ac504685f1411727610f4ef7ea7db3f2c085807d5c3b8a32fcf2d46ff634d49f5b10cb94e2336f0a7
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB