Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 16:58
General
-
Target
ff480e7b7a29e8722f19c552c052dec0cfc3e5461e97d717729da477554b7d15.exe
-
Size
925KB
-
MD5
b928b18dff599c5144770ea4fc35fb97
-
SHA1
12d0a630a38280abaf191852c8d83970bc2357cb
-
SHA256
ff480e7b7a29e8722f19c552c052dec0cfc3e5461e97d717729da477554b7d15
-
SHA512
ffb9e8e9d001be4cb36573ef15e578db696f629fb58cf4096637d6995b2eff4b9f077a7c57bc9812ebd0063c57b2ff7c4695620f6d4161ad7999048fee0a267b
-
SSDEEP
24576:fyKzGV+VnIGzoTKrpCcxPd+yrps8Ne4z:qKzpBIGzou1pxPde4
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 4 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff480e7b7a29e8722f19c552c052dec0cfc3e5461e97d717729da477554b7d15.exe"C:\Users\Admin\AppData\Local\Temp\ff480e7b7a29e8722f19c552c052dec0cfc3e5461e97d717729da477554b7d15.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un665414.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un665414.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un723004.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un723004.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr633800.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr633800.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu009756.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu009756.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2084 -ip 20841⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD547db0fdcce4e32e5281b484d43b80c4f
SHA11762352eb2c79276c701603c390858d9f7477218
SHA2568e9601abf169325499432ecbae77690e5a31a7209ec76921284ea4fd7827329a
SHA512df2f54e62dabcc90e77eb9d6c845ca008d6138e13b349a7154b54023318ad67a91c49f3cd3ca0d81b06bec740f0e3e1989ebc103db1b5c023326afe4e1ce42f3
-
Filesize
518KB
MD5c3fe6239e822fe5bb25ad82e1948a61b
SHA1957f4c279dd4c66b8346cb44d08a7ce5ebe81a4f
SHA256c7d601ce4299a275cd94c1bfee348e9c5216cb04c77a793aadaae4b3280b174a
SHA512be61b87d5e59874fbf55c79fd084f3421992446fb01e7d92a4d362fd82c62cb4a32ea9f1772bb66fe35a6bd549b26fa49918aa4a75ab3790b114739c67a65137
-
Filesize
238KB
MD56a05adcc295bc1e3afb63b58aaf223b5
SHA1934a99fd0d0a04154dc5c112ea7838780608ba83
SHA2562ed1a88ba8a870eecb565be01a7a70e0fa0f40056d5dddff5191f20ab97444d3
SHA51225e703491e2fe6ee9637cb1d600634c21910447eed1360564adc45c84cf84b574618393af9bef61827692f241111681cfa586f3c27ef6c6faf043bbe9d7aeb7d
-
Filesize
297KB
MD537bbc1db41c46e795a491b4631bb4ad4
SHA1ca5b7e71aed062e8d973fcfc2062f9f42d7414e7
SHA256cda85bedff8208ad8e799a1deb9d194ba54812391d5feb8b2d7eaff745a771bb
SHA512773ceb4a4dd8be41e5a123b0a241d4f2b49f5dde744f1256bbb2a518c3d426b423aaabd6d222fc8a4f98a572c6ce823d9c6f264b7a25cd7753d3db48642b84e0
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB