Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 01:43
General
-
Target
068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe
-
Size
671KB
-
MD5
a75be4620f57692f422beacc17d5fd33
-
SHA1
cfbff2f91ccb078db34b77b911317df44bcb69d6
-
SHA256
068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711
-
SHA512
243a154228f491f12d81ab97a3e988987bd9b688b9e351004d07b95cf39c623e17eae024b2f522fd5bc0c9acaa45cb93fcc23cf393e5b078205afdd52eb4caac
-
SSDEEP
12288:WMrOy90A2yvfyELpmgws87ukZ3EO0fgw7Uj204FX3LqsY+b+uWf3d:8yzfvfyEnL873FEO0fES0kX3Gs1b+uat
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe"C:\Users\Admin\AppData\Local\Temp\068242821b22a66a123b067aa5d588f2875329d2d7c4d15f56a9d0dffd1a0711.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un078619.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un078619.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1044.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1044.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 10844⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1288.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1288.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5092 -ip 50921⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
529KB
MD510526ebf3c1a22efcaac9bd1eb29cda9
SHA13aec437dc795fa59c8e2bb87594ddb4c71845cd0
SHA256d1ae88771d8d84df90083384253db3d1144fdd28c51a0bbd0fc62d1695ef79c7
SHA5129546c174e18d40dd75f0b51013ac3e05fe16ef1d08d0343178edf4eec946c04a9964dd7ccc73dafd258bbdc243055ce18cb037a7dc2c196db5e4c83cbd2b61f1
-
Filesize
301KB
MD53746718b3c6a06fe38239e37ccec1e11
SHA1b845bd2e43e17d1f7b43233d807f725410438161
SHA256fa60d5e327685f9e1d972c5b4e0ca4c331b083ea8145c2ed32300b2f58704ffd
SHA5127baa23b4442e041fd6fafcdfb2d3904e7378e6fb9b8d2fc6774b427a1eadf6d2c5a6595b444ef37254be6421b7801bd5dd89e3e48d0e3680446fb0ba630f5403
-
Filesize
359KB
MD5c4c9a3956c40b035c78a1170e3a30c95
SHA1e282aa45a492c9332d3edbb21f71c30e3c56c637
SHA2568fd6b8cf447c8077d0d67deeb67b37da1d154fda6e7563207a3fe33c91eaed85
SHA512b363e72f2fbe621e5a7ef93b2b901a80a29de79356abd46f07a8fc7701e02454f2aefb9b1c2791f175e8f526b16bb1603b07a6a5ee24b4a1f2783543d7e9c841
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
22.9MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
22.9MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
180KB