Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 17:31
General
-
Target
717dea3c02191bcebe369f536886a5619237dcb4b204027e40c06a6d33c28dd1.exe
-
Size
689KB
-
MD5
5465949c610da7a6dffcb181a30108c7
-
SHA1
349e7e5f066439e47e532ae8cfa94c2d21c3c32a
-
SHA256
717dea3c02191bcebe369f536886a5619237dcb4b204027e40c06a6d33c28dd1
-
SHA512
cb9583c836e3ebdeb300099863a888f653294b19fda65c733e6d76589d915d60b78f50b5b62a7bc67d693733979bb51c3601a39f7679ffc657bae15fc8f52f89
-
SSDEEP
12288:AMr+y90G9Ju/IQox4fgZiyS65hLu4kDq0MSKI3Vq/d0K6LgquXvmFDyfig4A5/Ls:OyD9YQQou4ZvBfaY0LZ3Vq/uDLCXiDya
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\717dea3c02191bcebe369f536886a5619237dcb4b204027e40c06a6d33c28dd1.exe"C:\Users\Admin\AppData\Local\Temp\717dea3c02191bcebe369f536886a5619237dcb4b204027e40c06a6d33c28dd1.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un100294.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un100294.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0584.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0584.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 11004⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1531.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1531.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3656 -ip 36561⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD58ee9b66ed43f33fe2118d7faf00b4b1e
SHA1551b21abe2bf90b7de7e411dd21b9a4f70000dc4
SHA2566f30d584697c8f7d0abe96dfd29b41ecf4dcc0b732e097e14a2aa80cf818feb9
SHA5126a481adee92589422278b4e06e2003ddc6861f67c22fb95af10dd04da843b99f232b5c02fd7a8f60d66125f28179472b369303b959ae4336e324c91bfda2fa05
-
Filesize
291KB
MD5b9f71d999f724d74ed83fdd82f4b84e0
SHA1358e0588a41077d53708dc125077958e6c22337e
SHA256cab268b09f1e9c4086d3d784efbc548685c92412578b25f53c34d9281866ed27
SHA512c2da11a2b2824979b705a828c7a3a15ec1eeb6ab616fee82d3353ad65375f170282d6d8e1dfe3095a08d7d3820eb15d79d2ca0dbb20ac5a00a0a5651fb349948
-
Filesize
345KB
MD512563c92849f145cf99a474b55c2cee9
SHA175894eecec0ecc39c127fc62268b85d304ce9266
SHA256f8a37190bae9556a6ef3afbe113e14ff09a5a030926cce048740126814a20c1e
SHA512a2a202cabc0da197a731c2c92bdda628bcb1de0f1a4bbc5bb7de7f70d1c4ac72e4f00773e9e5ed210be8e9e6502d632e52df237c270a75857ff6e4669a93c6b0
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
3.0MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
3.0MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB