Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 08:54
General
-
Target
96d4ea652f50043b77c3a5bda7095b5e64b11bfcaf95ddae4caa9736ac60aaeb.exe
-
Size
659KB
-
MD5
dcac3c6101dc33173f14c1cb245f98e5
-
SHA1
7e86994800dbb6ae97342c8fd4aa280cc43f846f
-
SHA256
96d4ea652f50043b77c3a5bda7095b5e64b11bfcaf95ddae4caa9736ac60aaeb
-
SHA512
36729c546bb2798b2b9ff7bfc1312f55db0de518617b4a5ffe8bbe3d34684b9577fd1800cfacc0da1395025f223cd7b6bfd167d5c05578910815880796ce43cd
-
SSDEEP
12288:6MrKy90ivMzQ+nHojAk3jpsIWChEgSMDR7PX3OXBNJTtvaMT0o0K2:0yXvMzTMAmjpsIugSwPnIbaMwg2
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96d4ea652f50043b77c3a5bda7095b5e64b11bfcaf95ddae4caa9736ac60aaeb.exe"C:\Users\Admin\AppData\Local\Temp\96d4ea652f50043b77c3a5bda7095b5e64b11bfcaf95ddae4caa9736ac60aaeb.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un688126.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un688126.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3855.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3855.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 11084⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1212.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1212.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3804 -ip 38041⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517KB
MD57ff398f075ba5a478d2886ae0ddb6bb1
SHA1fb96aa643641155892ca02bab52a4d3e872b0936
SHA256aacdd6a87d4bfdc42e4221ff4e4cf43abdde16de57d17f25c36a5942bacf241f
SHA512cc7b9debed409156974eece0a00218a93fd10d6b3628aed0c845596bda8fad60a9923c5d2f7519ddf105091c21d560c1c9248221997150e7cc514c3c8b2058d5
-
Filesize
296KB
MD55d33d104cb9a83a354f0aaa94b108973
SHA1edab4e05a977ec8d1de92461dfaf4216f57ab753
SHA256344bdfe81693b9008583ed9c66aa847f203570de01cb09850d12ab1d77ea4ed7
SHA512aea9e1db8b7045a4e5ca79744ab394d3286a25cb760b8a6fd0c25d4c06984ecd862e46024a6427843ffc0198f4627873484e3168f77742db374df487d37853f6
-
Filesize
355KB
MD52d480743eca4e0cb016501c58685edbb
SHA1b959348d2de1d1aa01831137be8c7c47e4aa5bef
SHA256bb9b3edb01d84923dbe56c595c1746e4e1475681a443a3182e37c5878b8f8f4e
SHA512eb3df8abf46e7cfdca225188405016bcebb8e1ed4848ff5bd25f44e6592db41c0cb00b85b5147462bcebd623b3a1eee817e093f945fccf804b1e30d85f530b41
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
1024KB