Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/11/2024, 17:09
General
-
Target
e99be9a6e1a7468ee3f36f3e4bb7b12e6c2be4ae031e984707287f8552090b21N.exe
-
Size
543KB
-
MD5
e5020e807d5eb316fe7ac44a4b6fe570
-
SHA1
dc5ceeaa1ed5143a58753e9bd58aee736d8a1f16
-
SHA256
e99be9a6e1a7468ee3f36f3e4bb7b12e6c2be4ae031e984707287f8552090b21
-
SHA512
cf8ac1254aa5ba2498db82022f836730e9c48399dea891996318876c633e944e69871948df385698acb34749977b12eae5d68fe0dc065082afc089d4565cf59b
-
SSDEEP
12288:lMruy90TXgsTUP01ezulj5ESwwsLwd66jSeqpoR:7yQNpeuJ6SwwsL9PeqpM
Malware Config
Extracted
redline
sony
193.233.20.33:4125
-
auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e99be9a6e1a7468ee3f36f3e4bb7b12e6c2be4ae031e984707287f8552090b21N.exe"C:\Users\Admin\AppData\Local\Temp\e99be9a6e1a7468ee3f36f3e4bb7b12e6c2be4ae031e984707287f8552090b21N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro9633.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro9633.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu7551.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu7551.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
322KB
MD5b60690116e2f1ed9a449dbd66164de20
SHA1e8a3f1b5a0693e257f2cc125a6e85e8eaaa3cc12
SHA256f38015b548cb00ab02ff4dbcfd395ccf6538713291e19178ef87a998d76202b1
SHA512fa4f612f1207adba95c4457a3577f8ed0d41680572e004698c44ed9bdb85fe0e8ee0e4d8df4d726e143ccc067aa49082766c7084c65df0ffeae3b5a932ee367a
-
Filesize
379KB
MD5b9aaf42096e466205a1a62f7c0635a7a
SHA17ac050d2f8331aa16031bf422571ee4108cd0161
SHA256d7c7b38e576d944a6443a27e528058a82d306a30b39c20310a49b94a971c1874
SHA51297364c056c3f435001699742de6dd3b1b81bb5dc222b88a972eba56da4bc6e3278902b0fbb4a14e3462c544db4cb0a6fcac8fa939d18fced5b15e197f19a8ca6
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.5MB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB