Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 22:28
General
-
Target
abfcc533051a56be4687593044ff1a5c5d5a2e38a6280e867712bfc99bf931c3.exe
-
Size
689KB
-
MD5
d29e5f6c8e2870a72c6bc247e2a72d0f
-
SHA1
135b453e7e813ccf0a19a9d896321481182b50f6
-
SHA256
abfcc533051a56be4687593044ff1a5c5d5a2e38a6280e867712bfc99bf931c3
-
SHA512
1dd91e4128f349516ee1e7a2c8fa235610881a99cc689f0c98671bcddb5e6d1dd7a560aace5b6c8538e4f28caef7a715093b3ee7219cf41c4719612dc3f6b89c
-
SSDEEP
12288:yMr6y90ckG9rP2uY3eo6YLpB9jpewZ4ZIlEEjsFGrx4VaNmgodBWjVnXI+Tw+eg:cywbO3Yb9NpoIJCdgmNdYJXIYwHg
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\abfcc533051a56be4687593044ff1a5c5d5a2e38a6280e867712bfc99bf931c3.exe"C:\Users\Admin\AppData\Local\Temp\abfcc533051a56be4687593044ff1a5c5d5a2e38a6280e867712bfc99bf931c3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2327.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2327.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5884.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5884.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 10964⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1497.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1497.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4044 -ip 40441⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
548KB
MD55e4e41571579e7033c714852a47d5e0d
SHA1ec9468aa59ece2f9f1685c82b7b564ad71e6859a
SHA2568710757a65d83773a5b7002daa5cd280d519d3e4b657552ba1f3a37307dce033
SHA512e813163f74bd7265c0abc21137373d5ed46d1a526fae491b782d8c7ede889106077c916460f2f5240b4cd766bb21d272fd14fd6b96dcf8f586dfb7e4847f461b
-
Filesize
329KB
MD542eb31a277c1b9ad1c7491ec498b82fe
SHA1993a225b816f37f3f4a08dcb1a2d09166e95a7db
SHA256fd9d5fb25ce45ad1badb4c9025bf9975ce99812c821c7bfc77e901341c267c83
SHA51267b171b49d8de3c1031ba3182aad1698d3ce75faefb37f162258d5288bc54482ed263950c32524618d7ce88a0b167a7c107c127b834b8986e818c99832cd64c8
-
Filesize
387KB
MD5b7784efe7d40506cdcaf789712d7a458
SHA169b7d5a98327b788d80b19f5172a5a61c7a08b51
SHA256fa0aaf4fe74ae01557ba0e1d8b78688e69d930fbe4220c26c0743e2af3623d70
SHA51210ed3b7324f80e5e120a35f376b8eb1a3989366e99d8d2e739ae1a5f0e7f95328a47377f1351ae34a3caff15d7d85d5e6316a4f07eac2dae42e22bb2b752f8c0
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB