Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 21:09
General
-
Target
8c67bf9550d7375eb5de51243412c4ff1f0244bb89f115835a9a8063b379c997.exe
-
Size
662KB
-
MD5
22de8e7b9b3871c6f46875b616c1d29d
-
SHA1
258b7b37aa531bb68059d9569c39c84ee53748f4
-
SHA256
8c67bf9550d7375eb5de51243412c4ff1f0244bb89f115835a9a8063b379c997
-
SHA512
6c31eebb7d3a0ee42eb016a5ab7d10fc2c84515efd29c83c22ad9740b4e135258f848f576c622eed32f023f7572b590f0d60f015fb287e00e32442ae771f0fd0
-
SSDEEP
12288:LMray90DtT67ODfX2ArfwDJ3BR7WK2q0ELMZT2M5:pyctO7u7s7WK2q0ELE
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c67bf9550d7375eb5de51243412c4ff1f0244bb89f115835a9a8063b379c997.exe"C:\Users\Admin\AppData\Local\Temp\8c67bf9550d7375eb5de51243412c4ff1f0244bb89f115835a9a8063b379c997.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un965356.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un965356.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1258.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1258.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2986.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2986.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520KB
MD56c50527548e5c2e617884b7608fa5367
SHA1d5d349e79bfa7effda364796229c52750a9a5c0d
SHA256c58d55c8ae990491cf8da0612f6ee3f0b2ff612c2b7377993b341db960cdbd30
SHA5122f2b866c7e275fe30500d7b062e9f696704e6c88bf7204491b1feece28e517d57cfa4fa4845ca481f32f6adb11d5225ba80124503232e4d5f1b4cb9c5ed67d3b
-
Filesize
236KB
MD5eafbf6755ff7364cd4d784562934057b
SHA1981bc9cb59d914f0c8fb69bdf3dcd5f40945496e
SHA2565e96e16738e99990bf7029ac02e13f9644c4a390e4b1c5ff1b431b2502036186
SHA51293572272d0846d1a3fd3f9ac560b945e9f42317f7e4aa462e83162fa7702bedaa00755d50a0aecdf852b19f0757eb8f075fd2ec1b4a2acf885748d2e2e450f9b
-
Filesize
295KB
MD5dd84ce3ba4481fdabeffaa914b496bf7
SHA1854273c5406b7bd1e3465d1deeae362e60fa96af
SHA256471da32b1cdafba3ca6938e23587700a56326dfe6d29eef4cb1c213f37eb5020
SHA512f7d207e2cb4518c9b7b93f90ccfda181384f535fa53a4bfd2bb74672f86be95bd41d68370fd00e3ea7887d84c215a6d1e9a1f1cff7e8f4f425d6f03f0aaee3d5
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
680KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB