Analysis
- max time kernel
144s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
09/11/2024, 04:37
General
- Target 98db979ed8285c665084b2a71ee75cfe1309aa1ae893a8fabd44f0f515955431.exe
- Size 677KB
- Sample241109-e85ajazrcp
- SHA256 98db979ed8285c665084b2a71ee75cfe1309aa1ae893a8fabd44f0f515955431
Malware Config
Extracted
-
redline
-
rosn
-
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
- Detects Healer an antivirus disabler dropper 17 IoCs
- Healer
Healer an antivirus disabler dropper.
- Healer family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 20 IoCs
- Redline family
- Executes dropped EXE 3 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98db979ed8285c665084b2a71ee75cfe1309aa1ae893a8fabd44f0f515955431.exe"C:\Users\Admin\AppData\Local\Temp\98db979ed8285c665084b2a71ee75cfe1309aa1ae893a8fabd44f0f515955431.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un075723.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un075723.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9949.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9949.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4960.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4960.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2732 -ip 27321⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
un075723.exe
pro9949.exe
qu4960.exe
memory/692-70-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-74-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-970-0x0000000005AE0000-0x0000000005BEA000-memory.dmp
memory/692-969-0x0000000005440000-0x0000000005A58000-memory.dmp
memory/692-94-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-96-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-64-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-63-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-92-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-68-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-972-0x0000000005C80000-0x0000000005CBC000-memory.dmp
memory/692-973-0x0000000005DC0000-0x0000000005E0C000-memory.dmp
memory/692-72-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-971-0x0000000005C20000-0x0000000005C32000-memory.dmp
memory/692-76-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-78-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-80-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-82-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-84-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-86-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-88-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-90-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-66-0x0000000004E00000-0x0000000004E3F000-memory.dmp
memory/692-62-0x0000000004E00000-0x0000000004E44000-memory.dmp
memory/692-61-0x0000000002810000-0x0000000002856000-memory.dmp
memory/2732-43-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-55-0x0000000000400000-0x00000000007FC000-memory.dmp
memory/2732-56-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2732-52-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2732-51-0x00000000008D0000-0x00000000008FD000-memory.dmp
memory/2732-50-0x0000000000B60000-0x0000000000C60000-memory.dmp
memory/2732-22-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-23-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-27-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-29-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-31-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-33-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-35-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-37-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-39-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-41-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-45-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-47-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-49-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-25-0x0000000002530000-0x0000000002542000-memory.dmp
memory/2732-21-0x0000000002530000-0x0000000002548000-memory.dmp
memory/2732-20-0x00000000051F0000-0x0000000005794000-memory.dmp
memory/2732-19-0x0000000000DC0000-0x0000000000DDA000-memory.dmp
memory/2732-18-0x0000000000400000-0x00000000007FC000-memory.dmp
memory/2732-17-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2732-16-0x00000000008D0000-0x00000000008FD000-memory.dmp
memory/2732-15-0x0000000000B60000-0x0000000000C60000-memory.dmp