Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 02:43
General
-
Target
ac804bc4a73e66a72e15b0039744428876fc437952a5c44ba3103eceb30e556f.exe
-
Size
684KB
-
MD5
e7a1063eb69cc4a251b9fb574cf19420
-
SHA1
b8ce29653e5a9096c3b37b7980aaa640b921b0e3
-
SHA256
ac804bc4a73e66a72e15b0039744428876fc437952a5c44ba3103eceb30e556f
-
SHA512
bb7014f62d3f889d86406707825f35727b613a3b1cd240613175438af092aa8ba46821cccc203b1e692c4fe6804fce7d9706a7dee26fcb46b5b68c3e30fb3963
-
SSDEEP
12288:LMrmy90px0f6YYbo8jms7wj2wKxBIQOFGmfSsVr9ykCvymWRcCgpqu:ZyMx0f6DbPjms22VFOFrVZRcEu
Malware Config
Extracted
redline
stek
melevv.eu:4162
-
auth_value
4205381daf6946b2df5fe3bc7eacc918
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac804bc4a73e66a72e15b0039744428876fc437952a5c44ba3103eceb30e556f.exe"C:\Users\Admin\AppData\Local\Temp\ac804bc4a73e66a72e15b0039744428876fc437952a5c44ba3103eceb30e556f.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycgj66YI41.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycgj66YI41.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urvv99ss88.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urvv99ss88.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 10844⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrQO32me75.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrQO32me75.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3728 -ip 37281⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
540KB
MD54d1eb26402b6178d108be86e2632d575
SHA1fdc8175fc1cca1297d38b96d08e54acc6c222d41
SHA256c85ad2c06e333c8ca3f782504b668676b8bc5e5c9c362216d94c515f3c5f571a
SHA5124fc8cad7e06b0500f1d8e0a5a599216241edc33a20b6f01cacdce955d734102d3d9136b075199c5d3f40362925c88ac3fb2fdb3b7fb2f75b90bf4393927246ab
-
Filesize
319KB
MD5d66666c84435499c7ff17a7899997658
SHA1b4714a70e2c3054eab6687df28d086708fce4489
SHA25692c01f94cb7694542fca697168dd658c8dce53633421e047924ba239dae68023
SHA512bae8889189fcd9e0800f1fbb188adeb8ac54e136386c80800792b66e69db04aaf0ea527ad6282725b3b985a20d03d94a70b6bea16fc90b2270f66c84b4f6d07c
-
Filesize
377KB
MD5a9bb941524fc5973d45dad1da3e23d17
SHA1357a2a768bbec255880067c4a774ca2d4bee0588
SHA256e2e687091711d776f73e3877ee7020f8ed6472855af0db8ee6f5ea796fc34659
SHA5124beab17e28078481420dfdf5425a6829695cdfdf50c1231c509654bdcaf21d6de21f12ee44b4cbe9c3b555bed3a91542b2dc37b25b2d093e03af9941723d9256
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
240KB
-
Filesize
280KB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
272KB
-
Filesize
304KB
-
Filesize
72KB
-
Filesize
39.7MB
-
Filesize
192KB
-
Filesize
39.7MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB