Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/11/2024, 14:18
General
-
Target
ad1404009edd6df98168c20b8543517a51d0492a145634c68a361b4f32291049.exe
-
Size
666KB
-
MD5
2cd7aba0707d37b3eb97c88f4172cf87
-
SHA1
591965bbf361a41262c60249a09d23eb5eacd526
-
SHA256
ad1404009edd6df98168c20b8543517a51d0492a145634c68a361b4f32291049
-
SHA512
ad6e987dd5bdf5a04247711d52f6c4ef810d0ea88ef8f5a277e836b3d45628565cddac1e2b91b8ef5e7b28043775f60365b1b112715760ad2436101c50ce620c
-
SSDEEP
12288:BMr2y90IPFfyrA7DL8bUxuX2XdGO5k4MrOdmR3X6N3PbB38BPISYdEcghoM5n:7ytMryL8ow8dGO5kr53wzB38B7mM5n
Malware Config
Extracted
redline
ruzhpe
pepunn.com:4162
-
auth_value
f735ced96ae8d01d0bd1d514240e54e0
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1404009edd6df98168c20b8543517a51d0492a145634c68a361b4f32291049.exe"C:\Users\Admin\AppData\Local\Temp\ad1404009edd6df98168c20b8543517a51d0492a145634c68a361b4f32291049.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycdZ54nc75.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycdZ54nc75.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urtm87xl97.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urtm87xl97.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrJw19Em07.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrJw19Em07.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3716 -ip 37161⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
522KB
MD58579bb1d52860c555d9ba2c80c94a941
SHA101c9feff6075e6131fc98077925a08a1ac3f3f65
SHA256bfc39cc5e791ef9ce6f64e4883a65638d930fa2fe111a629db6417121a2716aa
SHA512a949cc30c983bf469335d25cf6010fb2d1b3246a7b93765dc3cb8fadc4fbeed08147286c6ae865d150aee1e89e21177e6307c0c6abdc1ee5a35ca7623c44838f
-
Filesize
250KB
MD5452980bfe4732aaef2162c53c88f7ea4
SHA131b4e28e7ffdf36023ea859f0c343036dfb0470e
SHA256855df086e7969ec6904fde9c5920ab3c6c364ebbc240aa266f78a3103b59d06d
SHA5127ad12f0badc78bb1d42743e8776bece49a55e25244a9b7681c17c345f212bd2d28077e7fe495903de160d43aa7b3d57a419f0895ae3420a3b945d830d1d58707
-
Filesize
309KB
MD5284f5cacca006d191a474f8c3eada4c1
SHA105ccc7b3be213f8543b80cd95e4cbd1aac6190dd
SHA25652e7f367705bf1ad2aed8f9ac8dde3a1c3cd7fc0bd64ae3a3d5a44be416c1341
SHA51226887be6f3f12322ca653e2ba5ee592d5dba31c09312c27d5d29b1d9832f84e42f19a4588787894792d26068dc029ab6abca08a02cc2651e3c8dfe75c41fe4ee
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
1.5MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
1.5MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB