Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 23:50
General
-
Target
758731262e1423c5449b17922f8b98bed16cbbfb94e3e1988533c947a7aa1984.exe
-
Size
660KB
-
MD5
f43d3f25ce3cb843c3e9b7810abcaab8
-
SHA1
c9550fd2b5fc8652753912c0a81a221750b018f3
-
SHA256
758731262e1423c5449b17922f8b98bed16cbbfb94e3e1988533c947a7aa1984
-
SHA512
aabe71668e591d5afe6e8bc38b85d9255f81dd21412df04055aa94ff220e1f420e1322d2840714a50a3820dc17d5d4fc9632c583e5154ed1a5cf6fa508598f69
-
SSDEEP
12288:sMrGy90DpcV0kcaWilU4tl8hiLpPAiQ5IzLZ6HG90fs4rLi3iwaWPxA0Y:qycE0zBijIiLp5Q5IzN6m9Gs463iw5q
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\758731262e1423c5449b17922f8b98bed16cbbfb94e3e1988533c947a7aa1984.exe"C:\Users\Admin\AppData\Local\Temp\758731262e1423c5449b17922f8b98bed16cbbfb94e3e1988533c947a7aa1984.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un268706.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un268706.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4246.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4246.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 10084⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7292.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7292.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3164 -ip 31641⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
518KB
MD5dae2f4e4a607034e1ad7c3320668da94
SHA1327a8aa474e009634bad061293dc90a64c43d1c2
SHA25642a391e3015484212bc778f785d417cdf6f47578b31bb97f2df5d2abd76de25d
SHA512b8803d08725e971bc3abe3a6f98ca37136295d4f3ac801ae3c7c993583a1641ed9c9be69f665e12a215432b12330f1837ea5b8c696bf69a44db477dbd0219911
-
Filesize
236KB
MD50e4c7bc066bd4ba9ca41bdc8f4c6b90f
SHA1f1a40b8469e253c69b1955ec7b41d1238b1ddd0c
SHA256791abd0e2e142fd27315374f651d667f5bf59c499f6b39a4133eaf86d459c3eb
SHA512c6e6b00d44161ac635e6e233f48ff4932e2bdd38c0e693f25c64a586f3d02c038a5a7ba1af7ac0164bab97b25fa04bd4fcd47fa4a5c2699ef921225b122b24d7
-
Filesize
295KB
MD5a6f5ef180fc7657d381575fdd689cd53
SHA14525627edc28a8ba2e591f95260eec13a4b50867
SHA256e57c73807cae78b0c99eec4578604c59e9bb549e0f199e81cc7989de8c989926
SHA5128d1ad9bdb3d1b4eb12ef00bdb538c69b6e723c8ee98c6d67eb4a225381a9da9421eec292407b7c16a5a69418b3d5f9af7e0329e0cfbe58d0b47741b29699c000
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
192KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB