Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 23:53
General
-
Target
9e7489b9666a9de11232aab4c95f98f44eb6d2237a31d6d6bd219bcc8263c914.exe
-
Size
667KB
-
MD5
942d80f526ceccd661b6905f3efa77a2
-
SHA1
710354db5bd884733d6d7c5654c869afe3b41837
-
SHA256
9e7489b9666a9de11232aab4c95f98f44eb6d2237a31d6d6bd219bcc8263c914
-
SHA512
f88e78dc66b784a9b580b3dc78c2865f1acad0e8b0d169f1a7b617ccd325f605339f4717d1e7b2da45c415ef6b16ff491f07cd50d7af86db28ad82cd0a3ac3c6
-
SSDEEP
12288:oMrUy901ZQ9uTPpOT3c4cZu5o+Y0KQOAmdc2VgR4lpcswFrU+0t/wMQxjaxEUGc0:My+y9uFEsR+cQO/c2VgR4lpXyrARwl9n
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e7489b9666a9de11232aab4c95f98f44eb6d2237a31d6d6bd219bcc8263c914.exe"C:\Users\Admin\AppData\Local\Temp\9e7489b9666a9de11232aab4c95f98f44eb6d2237a31d6d6bd219bcc8263c914.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un258264.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un258264.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2221.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2221.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 10844⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4681.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4681.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4488 -ip 44881⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
524KB
MD584b6d433db00fa7eaf188d6777fba26f
SHA1265275303583bf1702d3e8d3c6d3c0da36ed6577
SHA2560389efe1cbb611d76aa0ba1bdbbc5d0b0141a35f047a2fa5273d511277587b0b
SHA512aa1a608b5bb88e0d31fdd89cf7ca5ff972c21588263521e6bde4bb837e51107680d4ee8e4d836a3079a56bee2a1140f920ac16df8379d6d31e3d30beb4182280
-
Filesize
294KB
MD5a56f3892333e8fe1930b038327cf8c17
SHA1c5a751300deca05b73c931cd4b2a91b0fc333ad5
SHA256bc68c46db2148fd8abb9f36610f5ca93b7942538341d04d114bff1692d424cba
SHA5121c6a14f18d5ae3ae92371d66d2365aaca891869b451c0db1b0df860fb9b128249719c554d16ce89f84afed1dae37e9680aad53d4888256720749823aa98234d4
-
Filesize
352KB
MD5a2d3224af848379cf83d533737e7690a
SHA1933bf5b0ab54adc773e18fae783a3edf6e486a67
SHA256da13c2aaa2d2fde7dad520f44b4fda8f57b3db14b37e859b4fc7efdf8c987409
SHA512fafc81bfa8f773884917d5f913c1ed2714508cd35f3d989edb887f11739ea9db26f83c4ab64c160097a3e2483d240bf336585a17adc1bf31fdf67310a76ff781
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
4.0MB
-
Filesize
1024KB