Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 23:46
General
-
Target
40face484b87ac53778e62dcfc98d936df89965fe3814b090209269bd150e2cb.exe
-
Size
660KB
-
MD5
494ff0202e3ab277e99296a1add01551
-
SHA1
96b50c412addbb4787bf6a5ed8934d1c956996a8
-
SHA256
40face484b87ac53778e62dcfc98d936df89965fe3814b090209269bd150e2cb
-
SHA512
14dd70ae8946a07ef5898587eedffdf0d851735c5270a44e7fa3f345b42d9bbfc2057d0e7e7176c15fbf49e7bdd162d3eeae9830b448102640ee54d9bab051ed
-
SSDEEP
12288:yMrUy90k1ZWL+i/YXViVBwFWfeDbrTOLOwWtYwLFWUCaj2Lacy:6yPO60YX+B52DaL1WtYwBkLJy
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40face484b87ac53778e62dcfc98d936df89965fe3814b090209269bd150e2cb.exe"C:\Users\Admin\AppData\Local\Temp\40face484b87ac53778e62dcfc98d936df89965fe3814b090209269bd150e2cb.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un107968.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un107968.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4038.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4038.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0654.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0654.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3808 -ip 38081⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
518KB
MD56523869d90d0b6e0ec61a88f2da51f2c
SHA15dcdd7951b0f459d4bd6187935460ba608e1c128
SHA25611942b777f7e962cf80fcca603d23375550e305ab68fd97441e316b6b035719f
SHA51280ffa6382eea5ebd33e1d13bedc621008e912cb5e8be59056c01762dc91a89c940181de6b7e62f1e114454393a8e4b4ec85a98ec6fa57c5dc0d0697f1ca3974f
-
Filesize
237KB
MD5e2672bd0289a1304caf3f987c4bdb3bf
SHA113bb1ab9dca2372f48bda89eb089961f1817b74c
SHA25613d82dfca0ebe11e2ce9e74de234d62674f8e94ddc50f5feaebef425e8dac7e0
SHA51283d630f1687ce786247bd27eedd3184ebd8cb45fccb76eaa4582aaa6b75f59656c44003bfff5d0e5061a1a615a065f4f09fbe2043abfceff5a45758d763445fe
-
Filesize
295KB
MD5d3135b990f6c6e1cf175abd91c8c2b77
SHA1bd63861b5909de054dadff98ab020fb45575e042
SHA256ea87c4f52102b86381d564018d53160784fcf6747a6bbd9830c87d63dc2948ca
SHA512b2a780227cd18a39c9868eb7bdc8486e7e430196f7a08e3da40f058b0c9794af14f9fddcc4ecc53b01941a804319ed36cbc97f67f9a588c08ca043133ecdbf78
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB