Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 12:02
General
-
Target
a61c9df5c66581a3d4b2cbd292e190ec5c923249382903815fe9a229b2f8a1d1.exe
-
Size
671KB
-
MD5
eaf2d181ec9bf0a26935bdb9159cc2f8
-
SHA1
d1114cd2c505b81fe37ed2216fcbaf775b6845ed
-
SHA256
a61c9df5c66581a3d4b2cbd292e190ec5c923249382903815fe9a229b2f8a1d1
-
SHA512
fedaf8371e28f385dec435537d04faeaa6e618497b5948aefce2c690ada847bff97f8d08bec59fd0a5dd2b81b3dc147130841da8aef921d84ba5e7446e240062
-
SSDEEP
12288:tMrmy90drhOAOoBAAq2lZkMyTKrhbE7SNbIlFzmE0kVAII9:fym1Cgrq2lZESbEgOFSEQ59
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a61c9df5c66581a3d4b2cbd292e190ec5c923249382903815fe9a229b2f8a1d1.exe"C:\Users\Admin\AppData\Local\Temp\a61c9df5c66581a3d4b2cbd292e190ec5c923249382903815fe9a229b2f8a1d1.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un178385.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un178385.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0492.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0492.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 10964⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1547.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1547.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1916 -ip 19161⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517KB
MD51d41a05619d85c8a938a8d467469041b
SHA1f9f536857a6578f31c363acc59ef16aa81035d38
SHA25615d3f29c21f5c073f918583105fe07722e8ffccbef1ddb24dabf2e7da023d4ff
SHA51244686fb86539e95517191e844cf700282ad198261770d7a8f9ff290187d5576c7944fbba195fcb26534bdd3c5934f39af8e004eb97aa86c9b49d8748adaf7656
-
Filesize
237KB
MD512dd67d3bda4d3aa31d4fa1c6363a881
SHA1a0180ff54eb9d23c3c489c32bced1ced2ec31ee1
SHA2565b8f0803073b878a43276b26205801596e7c654d9f40a727705537b15d6f8ba0
SHA512497a46c7d22cd9acaa2e71631432e366ea16b7bb759113df49a5bff623bec6a4846b0d7c08382bae2a276111e1fc11dabcddd56c317ee77008746645cc01f91e
-
Filesize
295KB
MD51816e5def3c23df001c074b1563c67e5
SHA1f47f28b3e3b2fba188683eecd43230f32c8547b5
SHA256ae2cccbae7e904f975c6c5ac5178be0de1fe9fb502f2d043c406e5bdb32b8238
SHA51226b365039cac918ffff7d55b5bd25bc18b47d1af646841e021d6fce3f05dc46558f4c94d278c0b8e21ba806b708cf0f6bcce22ae27e9bb5279f1fab49ca365f2
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
676KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
676KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB