Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 10:45
General
-
Target
73d1cbf7ac454990bc843b1be45f62b203372a2984785750045c77bcc471f4b0.exe
-
Size
658KB
-
MD5
bdfed1fb70f590df4576ad084a6ad6b9
-
SHA1
850ad6734aa26e45820ad8e93cee9d4385305730
-
SHA256
73d1cbf7ac454990bc843b1be45f62b203372a2984785750045c77bcc471f4b0
-
SHA512
5fe7dc761bf109ac2f38500dfa3be29e98470ea92e7f3fe483712d63349689011b736fca60754a1cb1d15dab9a447d634d520221b207510b6fa5a06c828ca28e
-
SSDEEP
12288:XMrey90oLi0qTf5nBi1Da53jcrym8gpnCPGeBSw9+twnJfu+EZZxXpeo1m:9yrIZm58gpn2NEsfu+EZzXpeJ
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\73d1cbf7ac454990bc843b1be45f62b203372a2984785750045c77bcc471f4b0.exe"C:\Users\Admin\AppData\Local\Temp\73d1cbf7ac454990bc843b1be45f62b203372a2984785750045c77bcc471f4b0.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un156947.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un156947.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2166.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2166.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 10844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9659.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9659.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4884 -ip 48841⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516KB
MD566501515a26c0cb99ddd1ae7dc761f59
SHA101c00cec0eac59b2739575b02bf2538905a12926
SHA256791a9751f6d432a61d8d22389bb91ac7fea66388e4281173b7a22f15f8d90477
SHA512a037f7d645c79d11f738bd752cdab801b8a366a3ceee943fc353feab219aa900c85c7cd6ac885758d5c6ae7eb832847d831b17b2d16269fe12644a24f17953a3
-
Filesize
295KB
MD5dafb7b9b2857e25d286dbdaf127a8230
SHA136ef104980958673e2cc3b26205c56447f25a869
SHA256249b1a5cacdab7065a92d89ec796d868da5447c7687f21f3d8f161332bc0f722
SHA51213db5ca29378193b0e87aefcd205c859897cf030001c2b2b26e1594c2138ce5cfa6cd85c4e40cea19f6193dd189dab39a67f4ae462eda6a98de4fbc2c7c19c62
-
Filesize
354KB
MD584cd5a7025f45c4bdb4f4bd5ad610b0c
SHA111ef0176435fe541060c34ef969813fff0d3ecc7
SHA256f3191771489a389680c8b994c677713bdf7d6dab71f51cd045f8f7d35a3d0c90
SHA512a750c5f4f33e890760e48e7b6524e1c0d57dcb22131859572ae062f86786bf463d74db60529ee17b2f4bc245fa03a0748417555705b7f3e0ce02dac0449c7270
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
1024KB