Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 01:33
General
-
Target
edf7a4acf8e91bf7f240e7c3042794ed56fe39558d80bda3fdf19b40d3180973.exe
-
Size
662KB
-
MD5
d3d84f149a051fc6a1fd0c0d168fde4d
-
SHA1
1504998a04763dc5ddd27fe6f51dda5f875b35cb
-
SHA256
edf7a4acf8e91bf7f240e7c3042794ed56fe39558d80bda3fdf19b40d3180973
-
SHA512
8d266b01a73ee1403e8f0ba143c9db609f1b89aacfd54eefad3768c8f475b505cb77c1f479a0b7518a5de665988fb655402067683e9d14b22c845ad5a61fab23
-
SSDEEP
12288:9MrOy90stK+pfG8j/83Zp8vkZum6m3qKxl2qgaex6C7H1ixBWLhF9:Ly7K+pvr8/czm99l2qg7x57H1ixBU
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\edf7a4acf8e91bf7f240e7c3042794ed56fe39558d80bda3fdf19b40d3180973.exe"C:\Users\Admin\AppData\Local\Temp\edf7a4acf8e91bf7f240e7c3042794ed56fe39558d80bda3fdf19b40d3180973.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un919787.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un919787.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8251.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8251.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5249.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5249.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520KB
MD58f38d479132daaeb9abda5760602c279
SHA192b84e8a3dfe71c7bd28d84b261f1664d56322d5
SHA25661dc65e06123d644d495cf8d65f0ea266a55a17de8db4bfe71062462f5f2e802
SHA5121c2dad9989290d33e7563ef4d9bf1aff503e813161d6bc0b70b96fc5d74b941cadd43c7a8bb5c8a2a61e8970332938fb3a5fe5b6f060142932ba13872ea12c91
-
Filesize
236KB
MD5dedbaeaad24c77ceef5623ac12f49f85
SHA163db67cea821becf653b03ba6ed9cb3c6905b03e
SHA25622a9095c735eecf2e7d4b64d78ef8900fcda06804c7339922252ec0b4699059f
SHA512eef03c8ea84635fc6b0bd85fac01e4a574f039c40e664d9de449e29a0550b043a33ba613e85f5d061dbad0211a9158b820ca548563f762791b47173f1a226368
-
Filesize
295KB
MD55177835060e7be0e8e2f681e8f18f655
SHA1ac770fd013d59dbc8ed61797c4126800a674c386
SHA256bab84ae29d2506e363423ee2229c32289c13b3a2bddb516b4b11615af893ade3
SHA512a23bbbce738a1b5162f71885ae0c94098df72fc13e4f3b3533833bc6d75416a58c9045a0636414a1f987e6a2fdfdc0212eb5a41598922499b738d41d8d8ef6c2
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
180KB
-
Filesize
192KB
-
Filesize
680KB
-
Filesize
192KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB