Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 23:55
General
-
Target
256c15a088c7ce4f51ee7227efd60d78d411afb518d97ced9b21ee71bdb8c7c4.exe
-
Size
696KB
-
MD5
76c8b5ff24f8c9477f8696118c0a8a25
-
SHA1
56f850594592f6ecf9dd93f344c3ff5be91193d2
-
SHA256
256c15a088c7ce4f51ee7227efd60d78d411afb518d97ced9b21ee71bdb8c7c4
-
SHA512
24418547efa642ffe03b192521da7e653d0a9e439c72bd887e2258349183946ffd32d1efaa5197d3bb995e32c67777ee3620a93720cec0f1f120522c23226f38
-
SSDEEP
12288:9Mrhy90HHpLMNb0Bh40JH8CXIaDzHLkUc4O4twMCzYpVvA9ZYIHr4AtSC:YyUKNb8hdcqIOjhBwMNS9SI3d
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\256c15a088c7ce4f51ee7227efd60d78d411afb518d97ced9b21ee71bdb8c7c4.exe"C:\Users\Admin\AppData\Local\Temp\256c15a088c7ce4f51ee7227efd60d78d411afb518d97ced9b21ee71bdb8c7c4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un401122.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un401122.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4081.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4081.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 10644⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8858.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8858.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2372 -ip 23721⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
554KB
MD5830ab1b8a9222683fa4971102fed8cf5
SHA1912f7f9ac7a4e0cc6b3eb54def29a3fd2892c1ac
SHA25644a90b0b467485ab7f5668f3af12ed0f9c338ce13b460bbcefb9487f5206e14f
SHA51288d01d9f2cefb3b01f3a7266dc13c36ddcdbb8e658160e4cd94f4dec8ea557d3cbd78945272825328bf730e97005648bbe4ec3419e28c820cfaf52b5758ce7ab
-
Filesize
347KB
MD586ed77437089e9d7e4cef084bf095f8f
SHA106b5b118578049e24a4707f4c81a2c09a49d5f90
SHA256bfc94a49633621bbd5d4e5a379b9def929a1cc9f79283d8fd72d0445313d193b
SHA5122da8d9959b17da34ae026878efac0d7944ad212c9b39be95d9323db7e6bd090a63c676e5b6696c23206e585fe9958c6812512da53d8f421bfad4b9e81aa5b613
-
Filesize
405KB
MD5474136e2c4af38d9629e0a1c90df51dc
SHA132b744cc7f882ce7a7afe22da80018f4f0f69f36
SHA2564e9aca9b59bf24d6106ebfff8ec3f27f7f4a7d75384cb8da0553723930fae25d
SHA5122efaa27aed9ab381623423783f9909840117df738e98010223f1fc8ebdf79ce4b3b9064df3454ff9ec008c451c85808435fc3d16fc319505a427903943a2fc8d
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
1024KB