Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 10:32
General
-
Target
1c23c6c70c4ed1c80de82a416c773c25ce589097f68d5dd7dcd2ceff652a879e.exe
-
Size
683KB
-
MD5
8fe95d9cbb47bedce5f3771076000eaa
-
SHA1
0ed1941511f7cddd5b4878e288de11438d69e9fb
-
SHA256
1c23c6c70c4ed1c80de82a416c773c25ce589097f68d5dd7dcd2ceff652a879e
-
SHA512
a60fbf4b97cb4b33a303fe070ce2a77c922875201fae8287c3d27e5ebc8ba2b1337f0d3d8ccf6458994bb757ebb644e550a3da438357073d95e9f0c7699cb850
-
SSDEEP
12288:JMrEy90s/mvCpjjcdmZ0+NgfFS+cKrWB4eWaujFA96:5yd/jpjjcQZM9XWyxha6
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c23c6c70c4ed1c80de82a416c773c25ce589097f68d5dd7dcd2ceff652a879e.exe"C:\Users\Admin\AppData\Local\Temp\1c23c6c70c4ed1c80de82a416c773c25ce589097f68d5dd7dcd2ceff652a879e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un865845.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un865845.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1040.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1040.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5397.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5397.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3596 -ip 35961⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
541KB
MD5e817099fdfa69a276c946dd7db0e1d7b
SHA131aa7a31a3bed54832dfe7883b18f699cfe0a745
SHA2564992adf128f87c44edb3b6ee648e336d819bc248a2c58e0ccebc92e426e62b41
SHA512cca96870125656c1183c3a886c731faa04e9dc8e6672b71954df4811ca4dfbc97af7de7b6027aba9329c0f4d945867e4d8949641d1221e83b7c5c1c5d4ca7ff5
-
Filesize
322KB
MD558d7921cb913f03163f165bc060603db
SHA1f8300488bf055b62eb9373443b60d88a547400e7
SHA256c1551f1a0c173351d196b84a3ded7d7ef8b7a20f2d2e7221a2d418cd5e448f72
SHA512c36b016b24b5cd57d428e8adf6b09678e4b4b823278a445b750fcf11daea4a6aa10a0caf4c8a1263654717abc8990b3720e72bf0e56085f04a5abbe458666535
-
Filesize
379KB
MD5f459fa59de3e9f4b6638b498be41ead3
SHA1d3bb157b07a9b456c9ae89cd02a9fc940066f9e1
SHA256666deacf99394e4b13e2d0a0b599a92d65dbb5d8a07d2c3731782823eacd2c8d
SHA512dca8a1c7392f512972f3ed56d57711234c931e87af49d67291042ea035f55d63380943aebde1ec1286fbf6d66c2f5b7c84513d73a1bf087980ac6d52f0a9b1a3
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
280KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
304KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
39.5MB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
1024KB