Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 16:12
General
-
Target
143e78729a2f340b1b801ca546b790bdfef7aa914127953c159885ae15b1e038.exe
-
Size
684KB
-
MD5
ec49b98d018acdd8ba904437ed3c4253
-
SHA1
cac35a8a3a9219acefdb10dd5a46416718456a72
-
SHA256
143e78729a2f340b1b801ca546b790bdfef7aa914127953c159885ae15b1e038
-
SHA512
1191a77ce783ab098c6d981d57776885f9dc9b15587038ab5f8e4a2b37929aa3fc0b4a7fda262cb246a6b68381cf0ec494a89ea0af5ef15de699e3c483d64d3f
-
SSDEEP
12288:dMruy90nuA5L4SlUQ+OAniRl7dkf0txxZ0PMugT4uW1+YrNgN6ewQ:7yCL4SmQ9VRl5kfM2FHCkeh
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\143e78729a2f340b1b801ca546b790bdfef7aa914127953c159885ae15b1e038.exe"C:\Users\Admin\AppData\Local\Temp\143e78729a2f340b1b801ca546b790bdfef7aa914127953c159885ae15b1e038.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un491648.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un491648.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2692.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2692.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4298.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4298.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1428 -ip 14281⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
542KB
MD5c73d9c4b040563d5b0c61ee2d3633782
SHA14d1ffd3299f501440d35c68df05d2a9874aafe4e
SHA25681b5648540831e845005d69ef0a8c62cc77d1567145be1315f6ffed56a6766ca
SHA512871f30e6e5401db421becc24021c7d2f77030b1f4870d4a6b13ad7ba686e4e408d73e3a130fdb381559fea6e884ce2f2283c9d4aa224fa7ecfc08909a2a0d6f7
-
Filesize
322KB
MD57dc17cf717588cd1c2d3dffb34064ec2
SHA1d2691f8dc6b4852852a5bd0cd65207ba0841ebbd
SHA256d6111b2d0d7b91e3984e9ee770ea81c430ab3a762863149e3899d25ba8ddb1d0
SHA512d1295d470c45edb25f4c01e110c036ea9db04c8d1662b190971025f2e11b1653e923f1a2a49eca7ebeecef3913a95bfe091fcd9cc065defe5f5c66e214548c80
-
Filesize
379KB
MD5fb46e6de56fc0023886a482a427969d8
SHA1c8a57288340b0fc3fed50b702ec0932f46317e45
SHA256477a5687f80c69e9f3c62da318676f3964f5dd8455d428475302e4416297543f
SHA5127c81bc81da0e4edd52fcc8eb160fffdffb15c0392153a0df22a895375a882deeeb7155746a75670cb0161ea5a3d1fac29cbe4a356d74ed5473585b92a50fbb39
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
1024KB