Analysis
-
max time kernel
114s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 01:21
General
-
Target
d4c4470450f5423dba18fd37155e89c6e904269de8b73e8239ac84700381cd34N.exe
-
Size
516KB
-
MD5
5dbb8124d0e67bad7ef141a14d6cb1b0
-
SHA1
46349e7ff4674ca4566d77f122c6fbb876b64756
-
SHA256
d4c4470450f5423dba18fd37155e89c6e904269de8b73e8239ac84700381cd34
-
SHA512
0982c18f769877c7a14e9fd7c7d62740a8cc539f1131570498ab02a7d1f39ddce53405b21a90ab9f545daaed21ae6e0d3df0b62cdd4c6c588b34e1d57e4edfcd
-
SSDEEP
12288:aMrby90rLt06sTycyD2+CDQ5SR2H2mdQI+EUZx9/WnN:hyKLazy6wH9dQI+EUzO
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4c4470450f5423dba18fd37155e89c6e904269de8b73e8239ac84700381cd34N.exe"C:\Users\Admin\AppData\Local\Temp\d4c4470450f5423dba18fd37155e89c6e904269de8b73e8239ac84700381cd34N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro1762.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro1762.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 10843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu7084.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu7084.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2944 -ip 29441⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295KB
MD545e09aa9fce471cf001022fbee20b4d8
SHA1b2d8ccd1e5327df77f1be24eb67383d0c3886c2e
SHA25690cfc2f7f2163d17e4dbc9a85aa13ce5edb00503641f03c00b40f9635e2d164b
SHA512ab048dd709fa7bf177db1aac3e16c33d60949b84f31dae3d1f09a460359012022c2a00e3eb521472f31a99e46d138bcabafdb793f853a04f00c806c425590770
-
Filesize
354KB
MD5fbf4503ec0ea2ea13097a9061b9b62f2
SHA199ac3a8cc5840e73fcbbae08342c18e7570c97a9
SHA256546ae4117be4b76e2243689f7499bfc7142dd57d1a0459ba5492da3515a1d322
SHA5121207152d20f76e325ff99c59535678b1b732a8dcf8d6a0d4d75c5d2216f5bff1ae6fcaa23833dbdf24d657b98da12fe6698eab7dbf20da6e2c3da87c92402ff1
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
180KB