Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 02:19
General
-
Target
fccd582c44ab331ecb2051eb1b2d113ab4ffb00388d1ff7e2ed07af1d4ff4925.exe
-
Size
660KB
-
MD5
1ba6a1b0915311c4e862f47ab7f2a71b
-
SHA1
bb00f8b88f45a95987a1c1353318dbcda77db1b8
-
SHA256
fccd582c44ab331ecb2051eb1b2d113ab4ffb00388d1ff7e2ed07af1d4ff4925
-
SHA512
3e03c4a027e3cd53bddf923a5d6914b9d2fe63fbec250df3b0c349b490d2783e71d47fe886281258b343205d8451bd24c9117aff93ca511dbfdae68585beb0dc
-
SSDEEP
12288:zMr0y904glusmcqhVv4lI7bFwlR610V0ifpoY+YfV2KQ:TywlEr7bFz02ieY+YdQ
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fccd582c44ab331ecb2051eb1b2d113ab4ffb00388d1ff7e2ed07af1d4ff4925.exe"C:\Users\Admin\AppData\Local\Temp\fccd582c44ab331ecb2051eb1b2d113ab4ffb00388d1ff7e2ed07af1d4ff4925.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un116874.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un116874.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9050.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9050.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 10044⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4212.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4212.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3776 -ip 37761⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
518KB
MD50c04af9baf085725714c1896a13bd619
SHA1d69787a0855b43e424d62a734ea3e940d9ae415b
SHA256746caa3882f592ce6cf83a38978c6e9e57974dfc6a051c5c425e675e37596239
SHA51217962c0e21dc0b0be0a3357b54bf6eb8ac0fe0e58020b1c086f240654550ed94fc7d01512505d86dd3ab72b2f9796c24fc03799773f21c48d9c472bb543d7a52
-
Filesize
295KB
MD5593766a6806e3ab449508ff81e9c445c
SHA130054605828359582ce41f3d96318d7162911fd6
SHA256d02927fe9fa433415a8b564783390121be35f54854eada5a2bc3dafbe0d7abc4
SHA51241a72b43646a32fb983236bd015f0ea107aa84fcda8cd6e2366a285671e12038effa1044cfdf060eacc54fbddc847950e440b83665fa55379fb5360de7bc57f2
-
Filesize
353KB
MD5747ec2d54b6b9b84e4353790bcbfd693
SHA11612b03961a27ba790b4b006d8ffc0e83e5734c0
SHA256017a80896e8047bf232a3fcb0aecb60f18a18b23583d488abb3500e57012da2c
SHA51251d94bf584d6a21df95d3163e895c167a89336271cef4e118c79fffbda23b7341cd0f526260bb67cc7d87eed1bd079f8d9cc662567a4101711c4e9b5114a8798
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
252KB
-
Filesize
72KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
1024KB