Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 08:09
General
-
Target
e4b26b5f08107b7f47e89ed3ab0781c0d6c9f4d19fa338a4cc6020e7076a705a.exe
-
Size
696KB
-
MD5
fc163b9eef2ad1145d6bab39057c78b9
-
SHA1
9a8b0a0318c979a1f0b4a8ef814d8c94aaf27385
-
SHA256
e4b26b5f08107b7f47e89ed3ab0781c0d6c9f4d19fa338a4cc6020e7076a705a
-
SHA512
78a6d95c1d62d31995173b81cf97e677087f93808b1b76de67148acc6a9f42e259964c27ea160600b186517ae3a3f6bb61daf26ccf344d699522fe5fdd661b9c
-
SSDEEP
12288:tMr/y90+gPWKtJUMc4yCb5Yl69W7mQLjrWLaDVP9apunhmQQs6mIUV/j5lR:iyxC3mvCOl69HQLjrWLaBPEpchmQQsTj
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4b26b5f08107b7f47e89ed3ab0781c0d6c9f4d19fa338a4cc6020e7076a705a.exe"C:\Users\Admin\AppData\Local\Temp\e4b26b5f08107b7f47e89ed3ab0781c0d6c9f4d19fa338a4cc6020e7076a705a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un809168.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un809168.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9836.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9836.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 10884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2088.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2088.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5008 -ip 50081⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
554KB
MD55d02d8bdfd87da37007519bcc1081231
SHA12ede408fdc27103a556fd85bd9322622381e20e1
SHA2564f6cea5834c4e8f56887769c6bde1cfa13fc04624396bc6be7b651505ebb95c7
SHA51241fe75a950393c3c6d3ccf96fec8a7b7af6da278649fb1735c5ecb7e2a70dd2479b040d0f0dd688d9749770bf04b30fc16c2e42ad0bc00120f8e44c6f4441587
-
Filesize
308KB
MD5f5644e4a0c0a487c88c85d4756b3d289
SHA1665ff395f2af2ecc9f34f64478548b3dfebda5d6
SHA256ea2a8e012c4d4b74eef77b8de9636d7eaa452030ee9d12fd4ce3c0c7d036e51b
SHA51215ccb2ad000ed5d9b7c049426428465872b9cc5f399277298d86a1d1c4365c383533ede7721baaec67bc9a271868b2c7b61b56aff87d1f503272f3ee3d3584a3
-
Filesize
366KB
MD5807a32f598e4a9558edada8d81f23018
SHA122fe9544f0009cfcce027caa4c13c58f7fa77992
SHA2566b7947d61296f4736088f0c5bf0dc0c5a0f4157a75c96adf72b9024e9efca744
SHA512d840900e205fca11d1788306f5856dc0be65d36e55d6b9a59edc9bde1b9b82e9542c5fb78597ec171fbdf57422b0f7fa08e418997789f8693cdb8214a4773c4d
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
3.1MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
3.1MB
-
Filesize
192KB
-
Filesize
3.1MB
-
Filesize
1024KB