Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 22:28
General
-
Target
bd28d8efd43da0202bc87b677c9d28bdcf09e06ab225d3652751df2f3abb1cfd.exe
-
Size
660KB
-
MD5
e340f04c4850b60cf3a8dbd14fe58304
-
SHA1
4177e5e2a53431149594d61a033b90efa919ddd2
-
SHA256
bd28d8efd43da0202bc87b677c9d28bdcf09e06ab225d3652751df2f3abb1cfd
-
SHA512
19bae8ca98cf1989d52020bbbc154a21c781a5898a5dc5381b01ab39e1290486c220881608991d77433ff9432eeddf3bb3e5762ced2b8b128ff54d4c7aa64323
-
SSDEEP
12288:wMrAy90Vnyn8BgqPpPh5aNhv85P/c2x0QFyy6zrTmcSQMBHQsY17t:gyGnG8x9h52hE5Xr+9y6zrThqBwsyt
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd28d8efd43da0202bc87b677c9d28bdcf09e06ab225d3652751df2f3abb1cfd.exe"C:\Users\Admin\AppData\Local\Temp\bd28d8efd43da0202bc87b677c9d28bdcf09e06ab225d3652751df2f3abb1cfd.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un664302.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un664302.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2728.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2728.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5481.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5481.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 536 -ip 5361⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
518KB
MD572b0ce94688f39fe585a3f928dccf168
SHA1629c3fd639c5a4deff97c1a395fec9c9ad69d5ed
SHA256db587d4e7e1fdf15a0dd118a00b72a4e1af667153aba0b6e4e6731bf6643ebe3
SHA512519cb16cb31c1fc8d6dc1ee810bf0af6f29b5f4a1562fcd4fe480ce03501160494dd457cff433642868046ea0cffe043e1b360a1c1388057bf88b966f3ad6b84
-
Filesize
276KB
MD51836c87e637145305a3355757f97cbf7
SHA17c1ed69493b1ee5f6ef3f7d9475dfd597c99c238
SHA25668453c981b1d05cdba959c2f3fd8abaf40c485f2f4b35212a8a3a8f7337358a3
SHA5127b5e905c62b25f9b1a39d2d3b8fe97b01198b9ad16acde072fc7d95a9a8fa2a9de4363e7f1563ecac7c5d6b3d643a768f2ae9f74ca81f395c8d90df389af36b9
-
Filesize
295KB
MD59e96f1a74e00e25fc973ff70b261ff6d
SHA118c556422294d56d0dddeae48d2b3878be177773
SHA256b733c61c8eb1cbe4f81cd07bd1720499d86144ae6c2281462b8addcb96ddef61
SHA512d53acc153479cfa51920178d79a42a088803712ae97c9912a992f1adc17257009c4d9c800f34beec74a72d51330d0eea3d1acd8f7f1fac4c1be83a05a1711a8c
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
104KB
-
Filesize
22.9MB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
22.9MB
-
Filesize
192KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB