Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 01:39
General
-
Target
0a82b1fa068ed53b96c3b406d7eb3eacd85967384bdcefc502af14e3f84c8302.exe
-
Size
657KB
-
MD5
25cb5c606aa0e559cbdc765edb9ba99e
-
SHA1
7aa351a82187ed68846d1b7e46b1d2a9ce60ecaf
-
SHA256
0a82b1fa068ed53b96c3b406d7eb3eacd85967384bdcefc502af14e3f84c8302
-
SHA512
59125f717511c444f580f18fc873c508ed156778a036c5fa9a77bd4140799f2fc7a41588d100f2ca987b3713375d2f8313a4b58a5ddbcc8c5b75e6d3a3a256c4
-
SSDEEP
12288:SMruy90i7o1PS0LDVO/TxoCIWKVxiLS4T3C5l7rZR+ESZxDDq7slyoAGOuohb:gyb01PS0LDVQxoCIWKrqrgrb+ESzvq60
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a82b1fa068ed53b96c3b406d7eb3eacd85967384bdcefc502af14e3f84c8302.exe"C:\Users\Admin\AppData\Local\Temp\0a82b1fa068ed53b96c3b406d7eb3eacd85967384bdcefc502af14e3f84c8302.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un008602.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un008602.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5630.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5630.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6169.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6169.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2364 -ip 23641⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516KB
MD5a855387ee7d1c8564bb5c7e2e6efc097
SHA15aff81e128f277fc411f443ea67d0e58ce509cbe
SHA256887c6ffa6542db6668f0bd19228bf1dded6a35fb7546ea5561126b106bd5d43d
SHA51249142ad532b9b0e017336e9f8f9badc1b9bd13504ccd5ed695a3c4caca8a15561bd3cb70c4aba57a12c267b2c49d52f1695e0ea203c52987abe1357b0b3b05c0
-
Filesize
295KB
MD5b9565950a543213fc9f25d6034625c71
SHA188d8f0b4448fadee6ce41992a7c1c22c7c863efc
SHA256a803956239b0bc9d28d2e685ba7b7dc6ad4fd46369c8c62b36d6163328c88549
SHA5120d469ac1c07f340aa3698bccba8104d59c2b9d9a9a9a7947eae6c8e9e27ceb25cb15586d3037b1a106c8ddcd252eba0d92dc15525bbeb8ceff9a760fdc2b613c
-
Filesize
354KB
MD5d5cb22dee4d7ebdc2e139ff85a94e561
SHA1443eb26b6a0716ffa6544e1067c4ccdc80fef658
SHA256c30e09013f478a722b8f54ac9f336fd7d2462147c1e7b9fe7477178bc0bb3b42
SHA51292e828cc74e2613d7dac8a7068cd15f3cc43da8e9d57003d9d6cebb1c8401982e7545a56cf102f72f5eacedbc1b2f2d103a6e1d66d4352af76a602f44aee7b7a
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
39.5MB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
1024KB
-
Filesize
192KB