Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 22:06
General
-
Target
989a2f0a7e09f335bdee2bb25a02ae692a3c0e860fce47df70b558ace79bac7d.exe
-
Size
658KB
-
MD5
7822807b57935376c42ba325b680a700
-
SHA1
3849c777461220138d0839cc40d7433de6750111
-
SHA256
989a2f0a7e09f335bdee2bb25a02ae692a3c0e860fce47df70b558ace79bac7d
-
SHA512
03c965df73482b21c82579032c1d91082825dd40b9630e515a2d7f7aa62f2d1bdb899956cfc9c04a355da0ca4a1104d493d749190e79698ed353dd01279ad2a0
-
SSDEEP
12288:bMrAy90+8FwVByuynl/Yp9ohU4hGcdxqTs7RVgnp9PB/ytkfJ5fs:Hyl8FwPQl/XnfdBFV0p9PB/YkxJs
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\989a2f0a7e09f335bdee2bb25a02ae692a3c0e860fce47df70b558ace79bac7d.exe"C:\Users\Admin\AppData\Local\Temp\989a2f0a7e09f335bdee2bb25a02ae692a3c0e860fce47df70b558ace79bac7d.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un722688.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un722688.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7218.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7218.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 10284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3134.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3134.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2144 -ip 21441⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516KB
MD52726e99239a89e0ab11074a0f04ea914
SHA1d97a734d3364ba60db7a9b15aa8e55f5128efe11
SHA2569830a65628c48ca08a209ae0428c6661256c64f4d00d4c82fec1215b420e2b6c
SHA5126c1a3c6ee47b1e8354009d6e4291d4e77a2b017f8acbdc95916fd42aefc04479165cfff24ded7e81783bcbcd443c387f7d8f3380924effd4bb49b95233a71fcd
-
Filesize
236KB
MD51ba44856395c178385a300449dffea6a
SHA1c72339f48c15dad0bd030b2f4d4e1a956b555268
SHA256a1bbc66268889f195f78fdbb2aff55fd73e6ec45d908c5efe32986afb9217e4c
SHA51244d26fb946d04dfe81afb626e12713c187c7d2f1309023dcc6104c744c105266bbaa94cde982d461d1dfd7f89da7d0a5e5d223ab75aaec13f32c1f7523bba50a
-
Filesize
294KB
MD534a81dd3db57096ba4d75ce3b43d74c9
SHA12a93a6d824c05353fc27fa43b35f71a40ded643f
SHA256e71470680ef056a237622552123688bc0623f0ca063eaa26434e367ccde23b60
SHA512554ddf1594ef807b70a676887b3ca54ad8ce63625a87a6c600d7598e2eda99a2d64ef52e93a30b8dad03e7961d0d2e833620687e06e8d4198bcd77bd5a13a88b
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
192KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB