Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 10:30
General
-
Target
269a78294101405b789cabeca7b3d2b90b989ef1bb3f1b59b03f345b606aecc4.exe
-
Size
671KB
-
MD5
c4dc8976463a6f8cf21100ae542f0581
-
SHA1
30d435bc1c553751e04ba381f2b456289918f386
-
SHA256
269a78294101405b789cabeca7b3d2b90b989ef1bb3f1b59b03f345b606aecc4
-
SHA512
1ad015feafaacc9718ac6a642ebfd1ce5be98fc8c104590fff4392847d4c2dd14f4dc3f87e3e49058900b3bacf2bddc30604338fdb973f9b34ddee29cf6faa81
-
SSDEEP
12288:gMrey90Ivyds+YPqQFyxcZ5H88mjozX9SV7rv4cuCNH6ft/juAXwh2ul:uyHvisXEq5clUj9SVH/NaBjAh2ul
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\269a78294101405b789cabeca7b3d2b90b989ef1bb3f1b59b03f345b606aecc4.exe"C:\Users\Admin\AppData\Local\Temp\269a78294101405b789cabeca7b3d2b90b989ef1bb3f1b59b03f345b606aecc4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un811260.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un811260.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6549.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6549.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 10084⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3552.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3552.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3220 -ip 32201⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517KB
MD522eaaa858150ec811d272c1b36d1717d
SHA144063a022c5b75c4c1df2599f88eff2260177777
SHA2565ff63fab3eb7dac3161281621daff1e8325753a09e4a5b859dfea7ff86e04a1f
SHA5123fd5c6df5ba184eaeb19b8e33f53cfeb8601c06d1989d3571c18cd8e1da1c7e0f8829fc5007b9d0c3329fda71718088905eb9d8c0c2a9e9afc49199a95f38663
-
Filesize
237KB
MD598738460f3f93624c92b789227896689
SHA1ca63f02ba59a3202cf0dfe2d079002d5596678bf
SHA256fc08647ca2d5c87a4f6ca5cd31586676e43ccc292b8e32b03735ccffaa94aa38
SHA512323030cb3f84b47c4da7ab067e05005e3180fb57659fc1cc83fd4b2a3962dcd9930ead0ad2bb7b17287ecac0b134c8983e18afe41a7923c0d9ca93a90299b580
-
Filesize
295KB
MD524dd70b1de9303b7eca4c4df92f66ccb
SHA105abdbc89de5cfa12b320419bc7f654881834c2b
SHA256f6a547bfdbb129c911cd076de4322e949683abce3691a95ae81d5b55552580d8
SHA512d3bb343514600c090f64357f8e51640f47e65644a796c520699ef2f95ada1174ee14bd89207cfe10038dc464cadffc7430d5c729227f0cf59092408e6ecc5e74
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
676KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
676KB
-
Filesize
192KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB