Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 22:57
General
-
Target
55fb461dd10d7e906e7d3919963cda3d7f7509b32622028b868ba44e8e432c4b.exe
-
Size
689KB
-
MD5
10cdfe061daaa43b3eef3266cfcd8c43
-
SHA1
a8fdbee84c99ca77268df811c922d5b85a3f017a
-
SHA256
55fb461dd10d7e906e7d3919963cda3d7f7509b32622028b868ba44e8e432c4b
-
SHA512
5e3eee0c69680329039d32be4d6bfd96c6e7b0e517c2ca22133a7ebaf72187f50fd17a549eeca8687588f5c365979a50caa9063a174881dd03413cec78eb21c5
-
SSDEEP
12288:SMroy908m0k7O9gaDaTD5724DbyD65hLu0KIwTobmVezhPOSK5mJfvqF2XfigJf3:2y9kzT44iOfa0hBhPO35mJfW2XagJfrz
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55fb461dd10d7e906e7d3919963cda3d7f7509b32622028b868ba44e8e432c4b.exe"C:\Users\Admin\AppData\Local\Temp\55fb461dd10d7e906e7d3919963cda3d7f7509b32622028b868ba44e8e432c4b.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un500711.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un500711.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8297.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8297.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 10164⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1762.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1762.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3528 -ip 35281⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5d8c30ad94535a60879cda16bf3732573
SHA1182c71c5ced7134bc9742f59e6e25bf6ede6fa49
SHA2563876861375f089067d359940fd7760a2f5370bcbffcd14b8116ca9960f79978f
SHA51205d850b19137b4cdf8c0c73df0f7d79374c8831239a9188066e784d182293faad86b2fca0270d192f2b54f55cf78e697d4260013eff3c4841db0beb2091bc10b
-
Filesize
291KB
MD54b007703bcb69263f0c6448b1ce0063f
SHA1a99dded4bfb61327535940065af65627c8db4349
SHA25670669b1055af70b16d11a765150058a79072df6540b926883429f47d0d7e454c
SHA51261177cebeb155169e106c3ab5138ccd3bb0d0282fc55a2fcf57773af0bba84351dcc12b4e955e23415a52c773abca5de51ae0bbba2618dc9082cf2eda472f1fd
-
Filesize
345KB
MD5adc592d3d7abab50674d0d85bce29d00
SHA14b0963ae29a8ac9cbf19892608e84045ea6bafc4
SHA2562db1e8b37450eb698da4cf26ee0df45fbf213be01931612976011489291ece0e
SHA51260b925ed4da5c830673e766637ddf79e5b52a3e0c8b3d40a73e2aceffdd71e2cfb5611f780fbcc60602b1df9f367d14fd261d41932f69274b12fd3f90bad6004
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
3.0MB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
3.0MB
-
Filesize
192KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB