Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 15:12
General
-
Target
90b02058346aa247d49dd95c69837d76f5b7b128e3bd1e8ba2545df915631e7a.exe
-
Size
750KB
-
MD5
e2f158f4b5243d75360b9080dd9de3bf
-
SHA1
6e9d66d176fb091215e458c7bd6562cbe559ddda
-
SHA256
90b02058346aa247d49dd95c69837d76f5b7b128e3bd1e8ba2545df915631e7a
-
SHA512
622a539a46386ca0c481a70cf16bd992d6cf41842e9e481424d2b23d761c2994f8c6476310d25ef4d10cb9c7506586065e9b86ac29d669f979d1c645a411b0c9
-
SSDEEP
12288:nDcLl+sdwaC23Fuzt+2S0RnVCHe8MWWg6jPPOVIdWt8GkKBoWkjH2OXFeazr4D:ol+sdwk38kHBWfmIDio7HvtQD
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\90b02058346aa247d49dd95c69837d76f5b7b128e3bd1e8ba2545df915631e7a.exe"C:\Users\Admin\AppData\Local\Temp\90b02058346aa247d49dd95c69837d76f5b7b128e3bd1e8ba2545df915631e7a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibT6056.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibT6056.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr506801.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr506801.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku801740.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku801740.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
MD5f517375ea4dd5f0507ee819390fe2714
SHA11aec142e1954702e1665528d7c17e6302820050c
SHA256ab0eb669a6ed078a5a7856a781f38cb24c098c56a5f55d2f87cda0590d98a1c2
SHA512fef39f5033d38b4bee68a37870ce32f7deb7b4f16fa8a439b0102690c52125ccc8247b96174854efa830e0f7942e2466a84110c77a1dc6852bafcdd784fade7c
-
Filesize
12KB
MD5f998e0d439e230e9a2328f6795673953
SHA162aca608da0970a759217a7dab8ebc22174f926a
SHA2564c4d44de95191bbd13e0c6b8aeb6460dec13089dd54bc8f9601e1b31928e12f0
SHA512456a4a3b77d2bdbdb0c20413330dd636f38309e2e41be0ed0e470968364f0d4a2c0775d8c9aef6e65646026cd8b7cd687ed3a8dbf0cffa810057454d3068ceb3
-
Filesize
403KB
MD5e5f1eea0775d1300a4589e8e86260211
SHA1cb5d660ecb593d89dddb5eac453f57a54275392a
SHA256296a1be8d88090e0b0fcb73b7c4041e2414df0e2b1b5f7e7246166ed0d3e9ec2
SHA51260050fb2cf3377fc0a8a45506103cf14329390f893e1bc24040c36f75e079c74ec7455408a3b83480d37efa3acee9668864308c87a1e36774ef964d13747f59d
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
572KB
-
Filesize
568KB
-
Filesize
584KB
-
Filesize
572KB
-
Filesize
568KB
-
Filesize
584KB
-
Filesize
39.9MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.6MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB