Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05/11/2024, 22:45
General
-
Target
55b4a82a129f7748e5dec22c943c83db81e6634240aef9139d491d856d41bce0.exe
-
Size
666KB
-
MD5
4572dc5cfa6d972825f4a5ffb85f2f6f
-
SHA1
18e214f8b21dc257c17588bb24d33d5b2d08afcf
-
SHA256
55b4a82a129f7748e5dec22c943c83db81e6634240aef9139d491d856d41bce0
-
SHA512
98d4d15ba7eac992f6ccde9d6de32860801ee55cf6aafe2661dd5f1aa87760fedf95ca1475609070eebfb0db610e3f69cb455fdb051d7c012a07d1cc141ba458
-
SSDEEP
12288:DMrEy9022vFJ57Pnq5BAyF0PQhqiNmqu0vAyWwrU/DH/wHv9Qe8crBcrgcr:fyr2vrc5dFJhlN1uWVrOfw1QzCmrd
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55b4a82a129f7748e5dec22c943c83db81e6634240aef9139d491d856d41bce0.exe"C:\Users\Admin\AppData\Local\Temp\55b4a82a129f7748e5dec22c943c83db81e6634240aef9139d491d856d41bce0.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un123065.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un123065.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8582.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8582.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6085.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6085.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1424 -ip 14241⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
525KB
MD5d3ba970f77dd89eb186d44bccfc76071
SHA1f7f8525efc9d2af448b4c540160ce37b005abf4e
SHA256fd715d3ffc6c5b3f84594d099c04a6f46afe5bcdfc579c94faf70d207f7d3964
SHA51234b1cf9fe7cdccff0ac700431dfefd63d833cff5288cb8f8599acf9828ac53929a76ef4d943d4c871c66044a15369d4bdc000ac5e3ad712be8b91b6886d58b7d
-
Filesize
294KB
MD5e9bb7e145995c8f667168e80e85d7b10
SHA10e4c7e883f168cde049a044a90542ab53df6749d
SHA2567e9a9f9f27cdc06db31ee1e61826e67b0bfe27e60ab79899919f64583fe96bef
SHA5123c578a633e7194472d748e108b871b4e2d8cea2d875f97992349d509a85c8812a0c652475e32eeadf1dfe1b663ea10fc58d227c4171391d030bf8ba8df411121
-
Filesize
352KB
MD5b6032a7f2618d58919ef0a72dcf4f878
SHA1539c04d89dd26fdec0bf88610a9bfb68c59a5855
SHA256db440e8ad9d3053d9df36e21441733731b6fdab94476477ec5cb2ed74a845f8a
SHA5124ec7433d49d766b3adcd14413e2284a65645e8ede230619cdabc0a751d30659449502e72df88d60438f57a4708408a310bbd0c538d42fa90a0e11d9f8cff56b3
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
180KB