Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 23:38
General
-
Target
8cda87c3e19c8469bdd1f3ab61eda7346cd1b8fb7b3800452b35df90050fbd65.exe
-
Size
662KB
-
MD5
5129ae6df70d0b5b965825db6d5eaf23
-
SHA1
fcf856942ee1cf9c0419446b46791df09621756f
-
SHA256
8cda87c3e19c8469bdd1f3ab61eda7346cd1b8fb7b3800452b35df90050fbd65
-
SHA512
d59b628a7b5c40c54a436e411d152396c9be077250447bace870c30a456af8540924193efb9c855f4c6349b4a42ef18a803e4f683b32b167930a25b31654a012
-
SSDEEP
12288:WMrKy90ZvWwDIEE4qpgtrP0vk/udB1u/f1B2q7hex3M7HuDtP+HLr:wy+WsYiBczx69B2q7wx87HuDQP
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cda87c3e19c8469bdd1f3ab61eda7346cd1b8fb7b3800452b35df90050fbd65.exe"C:\Users\Admin\AppData\Local\Temp\8cda87c3e19c8469bdd1f3ab61eda7346cd1b8fb7b3800452b35df90050fbd65.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un519918.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un519918.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7465.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7465.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8828.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8828.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520KB
MD50a84579d716cdc0195b0bb0e052a887d
SHA161a01f72db62db630d58e0a693abd0ce9553144b
SHA25629ce5988f99428cf882b28c7c397547a62378ecac4ba01e538b4a0460ad78ce5
SHA5127105f8e5ed53414d7b31493145298ec0498e01c7b4575d5dd8f0b286e56f36cc16bf9dc9a5f6f9b8790281c80d42d2ecf914cf4e5f8695e04da651888f481575
-
Filesize
236KB
MD59a2517453244bcacac6baf0a88d70ff8
SHA1cc12c00933dbb53b6b9269734481edb3e4c3a80e
SHA256103eb5b2c40a67cfc173471e043e2dbff4e043de0ed0109657bb369d019e35dc
SHA512ef699015f509b51127264adff1e3051df70c9d4bf5171c6a455c2acfa737f66c97888a5dff25f3dca4c3a6f725b9b16f845e542184485b714b9cb9b0106f82f5
-
Filesize
295KB
MD5a5b6d35269c35d9180908afa00662d43
SHA1b904b29480ab7a4240b924ac6a8a3b41553714fe
SHA25624e8f64b9092dd18c075ba42224b61729d57c38fc32a7a5ec487018bcc8d43ea
SHA5124d34bb49ecdcdcbebb255843391a78a513a512603641a828468d61e965828022d748452977ef75900d416433a939182079660a5e22de22df451210eb95c725c3
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
680KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
680KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB