Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 00:31
General
-
Target
cc6bd85c7cadb8f36dedd1be6c7302e3c8f20d35eb924cdbc8ccd9888863a110.exe
-
Size
689KB
-
MD5
700933c6eb87116776d0b3d3f61d7e4a
-
SHA1
d84bc8bc70d1d7490bdc2ce7c0dce3f4ab6c0bdf
-
SHA256
cc6bd85c7cadb8f36dedd1be6c7302e3c8f20d35eb924cdbc8ccd9888863a110
-
SHA512
a91d27214e5f31e8982013905163cd7a6bb213f4745b47125287b26b0d7d0292bb30022784f96d96700687da442c5a2b22ce3f0e6555f07d0447f14f4903cb4c
-
SSDEEP
12288:kMrgy90WXmWGrDgjlRWfkLljj8Mjdt+TYekLYxUVNtMrlWtV/Nqvg:EyBGrSRWfkLKMjyY1LtfiQD
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc6bd85c7cadb8f36dedd1be6c7302e3c8f20d35eb924cdbc8ccd9888863a110.exe"C:\Users\Admin\AppData\Local\Temp\cc6bd85c7cadb8f36dedd1be6c7302e3c8f20d35eb924cdbc8ccd9888863a110.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7524.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio7524.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8283.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8283.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7209.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7209.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3436 -ip 34361⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD55b6d29cee10a9880089bf202a3bdc6e4
SHA123cf04a3717058ffecfd574d96068b9ad045767e
SHA25696f1999064a6eeebab6913d1c51d56980b8e19a512be53a2cad05e3db966fa08
SHA51215f6fa8a0d7345548f94847e7a8e8c8eb26bf012551f7646d32dba3e5fcd01e3c6476027a17f9d70b89f94ccddb3dd3e64db8990a50cf78d8c9323118cc2927c
-
Filesize
327KB
MD5aa61cdf759c45d17fa35c4d9bec9bb34
SHA1b4f2f93cd518490f6d323e219da2c5c06e583255
SHA25620e59534b32f23316802ac0f680fd335efabafb9e095e39b170c749dd2414290
SHA512a39495d8a545572b26e6a59e08f6cece4b7c905140dfb8375fd1c638831cd6a3e2e9741ae18220a2887082d67d19f708088f13848f5dd67f47604a642b0ae98b
-
Filesize
385KB
MD5252618c2e2044b2a5fd18d2790d53bae
SHA16e9fc9e746c9fbca27d332a12084f08ac2556640
SHA25675a03329913b1eef0344cedc28a8ae9beaf1a8fef82e0389a3be7948112f2342
SHA5121086edcfcaecc4dde8c3637115197db314dc27faa891b754d4e7626f50149b2021871c2e0308951f656a0d378011b8b6041805ec0b5ae3c09451c37ff2e9e367
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
1024KB