Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 02:15
General
-
Target
02c80ebcaf31e16299f14970d3b44e16e9a2ef67566391943bed4e755e7af217.exe
-
Size
657KB
-
MD5
8c25f26d344a15b0a934331843c7bfb5
-
SHA1
ef0e0084b43180ac2b4b1781e438d9015619a844
-
SHA256
02c80ebcaf31e16299f14970d3b44e16e9a2ef67566391943bed4e755e7af217
-
SHA512
3aac15678fa32cc31c0e46a94c4c8806516cc30d1c3d25efa123db93b944c6fd34a70b6b57e72e73667aa869e009b526fad10b1e44a783a3d1887a7727502d03
-
SSDEEP
12288:ZMrky90J2eka/3hlHY06IrPyM5wOjS+t7gDJc05l7yeJ+ENZxf/WnT829i7O:lyD3a/RpjuDJPy2+ENzu9T
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02c80ebcaf31e16299f14970d3b44e16e9a2ef67566391943bed4e755e7af217.exe"C:\Users\Admin\AppData\Local\Temp\02c80ebcaf31e16299f14970d3b44e16e9a2ef67566391943bed4e755e7af217.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un254655.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un254655.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6805.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6805.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2255.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2255.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2608 -ip 26081⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
515KB
MD5508259260ff3f08968047dd360fadd38
SHA1d1d21dbd577bef11f0fa1cd22a2b4814e07e9fdb
SHA2565c1e8c9bc6d4b5d00bba329077833a3cd06f108aa2d371e4687dd0f3a3fd2d95
SHA5122ba748cf747dd3c0c89779d25901e7c528595b3d70bed0b2e5c33e7ba06e52b7c8ad2bfa6f1bb794effee9aa309ff335e2e62b7c3d3b5207410ae0b5ce19661e
-
Filesize
295KB
MD521044bcd84cd41859dbad6db47645a05
SHA165945ec0cda266c15412331b8d6e5979758c44ec
SHA2565b8d57d6c9325684157e21a8b8cd6fd04822acc09a3b4f91302bf0324e2df315
SHA5122a1dbcd61d4c15c5084de0a219375e1c58f2ad2d382e00205a28c4b4683353a442061798cd5c772f1b33e6b19e954723e9688b31778300c6703fce2c89af27f6
-
Filesize
354KB
MD5f9c289aaaec24063f4436c09d772d61c
SHA1c7055e6b2cd4bb1caaccc16048ed4937cf61f8bf
SHA256d6e9d82d82c566e77b6f83a80d5b3ba269d92eb0dbeb3cc98b07836a6380cd98
SHA512eb17c14147e65c1a59aaa1857b28f8a7c6e89de8087ae65f0d955e11e0de63c7529b4bc7ff7352840b9b82a91759287382a60fafc70640de8acffdef46533a80
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
39.5MB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB