Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 16:34
General
-
Target
7603fca97eded6adbb1cd1341e20ca993f3bec42689882c856cfe5e2415f71ea.exe
-
Size
673KB
-
MD5
16cbc1c59c400eeb3c36adc7adaf1cc1
-
SHA1
c0f71e175b5af47aed28e274b8b1f856ff05a328
-
SHA256
7603fca97eded6adbb1cd1341e20ca993f3bec42689882c856cfe5e2415f71ea
-
SHA512
e2f661f48f0336cfbb4d40e5a186d26bf12d8c8fccafd528f11355b51885259d37bbc3ff82b62481ad12dabee8534442046608998623a3d924a8ed0849a026c0
-
SSDEEP
12288:gMrGy90JSfXA8tIXVuu52MeFWIa+UdirxuWphuPzbrh:2yuUQ8oua2ra1KuSCB
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7603fca97eded6adbb1cd1341e20ca993f3bec42689882c856cfe5e2415f71ea.exe"C:\Users\Admin\AppData\Local\Temp\7603fca97eded6adbb1cd1341e20ca993f3bec42689882c856cfe5e2415f71ea.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792288.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un792288.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9616.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9616.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 10044⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0170.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0170.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4820 -ip 48201⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
531KB
MD56b8e8dc4df4ec86d075b26c25bd50833
SHA111bf26e72b40a8b94510deb464a232e4aa277cf6
SHA256a52a3cf5e3c2d456e971c685dfe5c3d66f49dad21ed53776218bb087dffcc5fd
SHA5129cdd5fb3f76e61d74780dfe42e28919caa2f41ec46bb29d7c3541910b231846c7c301cc0e48d2a222dcef77b1434358e5d34584cbd796abf8e513706d316e0c8
-
Filesize
260KB
MD5a0a19b1ea30a1381e2ebc9bc595cdd6b
SHA199df4743ea6dcca7d2ec612d5801417095eb2518
SHA256cac9e66d2e2e8669e1b1397c5c21787b777da45dd8d1dc74fc445549f086dab4
SHA512edda57c84005c38672655bdb4d970fed75d3d1ad52e9a66ae370827864110a53c91e7e31cd576ac48e2c7cc3380640a0056bef29107edcbea13065790f03e06f
-
Filesize
319KB
MD5bf951c6978de1370c7196fa886d02167
SHA13d8ef4542f82212d56071d0f4f24e05ea154349d
SHA2567c914a5bf4525dea89f3eac2360d2f3c9a0643a10358f4ea05319964c8b717b8
SHA512790ddc002e7719aad68d3ea3324b8b7ba4ba25ba56e22fc14259598e63b4234a939ab108f7410bdb17483e98dd0752af80324505287b67eb871e4a967560323d
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
708KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
708KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB