Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 09:28
General
-
Target
744414b50c123f4ac33617fb6df5089e03d332d6b9a657bdaf8a0a3d8dcf69de.exe
-
Size
537KB
-
MD5
f5562d7443b08e30a1ee75e4d73282a9
-
SHA1
ef9358223c0a4a1fc00cfe94419d89eb4ce9a397
-
SHA256
744414b50c123f4ac33617fb6df5089e03d332d6b9a657bdaf8a0a3d8dcf69de
-
SHA512
eddd71f86184bff1ed53759429a04e3e55ae93d22e16e8e1f6f10b17d1aa789d5dc2c7a8e7605ed73c0a44e3f702f25e9d63defb82d94fb7046744e4b8db34b3
-
SSDEEP
12288:CMr+y90rVWe5JUo7rdW473cSusrUTEHowfU70fHCQJ:4y8VWe5JB7rdHMRsrHIwc727J
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\744414b50c123f4ac33617fb6df5089e03d332d6b9a657bdaf8a0a3d8dcf69de.exe"C:\Users\Admin\AppData\Local\Temp\744414b50c123f4ac33617fb6df5089e03d332d6b9a657bdaf8a0a3d8dcf69de.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQv5740.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQv5740.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr783759.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr783759.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku466246.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku466246.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD56e58c2bda50f8e751b0e8b64aa46fe74
SHA1040cc26d517a7cf0c3c5fb60ff98227dd597de1a
SHA256961b402f2a414bdb6eba16ca23f207c9f07cbaae39a41c01d31fa991346c148d
SHA51208c383a48506dabfe702ae304bc86d609a3e066dfd0151304930d1bc8bf82c4ee1d6f72e86d7ba200ec5da12696b349b8c135b91f8c808973619b94d94e24bf3
-
Filesize
13KB
MD591a0f39851a625c7a142dd866de7e2d5
SHA1b0712358920b2991d0201a1efdb6ccd5d1de82df
SHA2567aa474077726ec54f428d13b8ca62be5314c347bda0b0cacf84182b9a86c7b3c
SHA5120ebd21d69214dee4c44e9a43dc3839976927ef3a9a3946ffdcb216136f0bc8417d5f011575ef56d949cc9ed1748c3921d9da0bfa7400174436a320f0a9b7f0b3
-
Filesize
352KB
MD50759f827221c205aad82a5207f6d6dd9
SHA170bbfc7467b52814c3918a37ccbebf1808cd5d45
SHA2563b2293bfe77da10c31d66bda4b22b577713b0400e4563c4ced8cde8a3588b58d
SHA512ae9a73a44dff747a9200941b907a474ded85813c176943434edfb0106136603db907ad5f7054f0dd26657c3675a0ebcff2e04951d248c607c6b1e8515bd60b74
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
40KB