Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-11-2024 06:40
General
-
Target
dab2b7c97f19d3f4062e215a3cbce2a6106523758d90b7299d4ffc7fe619e7edN.exe
-
Size
524KB
-
MD5
9bbbe9ecfd65974e80fb62701a1e7e70
-
SHA1
d37efbf6adf03d5dcc5fd29b1cd9008838c8df1e
-
SHA256
dab2b7c97f19d3f4062e215a3cbce2a6106523758d90b7299d4ffc7fe619e7ed
-
SHA512
67c24a9e5ac72da6971b92caad96192e94f9830737d9fad71386e3f1986bbb5b46f2bcdf650ab695d5c1d580a9495be1b8bae44ca70f227c2085fd8bc5e16a6c
-
SSDEEP
12288:eMrRy90nxDV6r/h7urjuCM/laMNkP6Pat7NwbwT0uoyi:/ykxArOKZdnNXalNwiS5
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dab2b7c97f19d3f4062e215a3cbce2a6106523758d90b7299d4ffc7fe619e7edN.exe"C:\Users\Admin\AppData\Local\Temp\dab2b7c97f19d3f4062e215a3cbce2a6106523758d90b7299d4ffc7fe619e7edN.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro8609.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro8609.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 10803⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu6823.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu6823.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3744 -ip 37441⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
294KB
MD5e0ccb6b1c92be3f01be29c33abf57ad4
SHA141d077644d2c2c209068c6ca3ded34675e2e0ebd
SHA256c55ead14567ffa56a825bccc0897e25cf36663d00466f1b2d876efd073166d67
SHA51255c8941b67e37a98673b9f32775e7e0ef6ca0fa12d15e326147a0f15db000301b93b8b3a332599c4d99355a71d25d5f076b56df12d051752a68d7f9747437a17
-
Filesize
353KB
MD57cde3f2048e50e35af31ab569b8ffadf
SHA13e806a88fe2c955346cd1ddd15e9178e44e5a8e1
SHA256b2e2d3012bb248affd1499e017a96b614522b37b3c729275d8ff4dc92e1ef13b
SHA5127eafeb09661ee07bc5d07af2ef04fcf82531c69b0a178da411a8d0d490d8c1621eb1ed94a24b38bd4f208949c29c93b9116e98a4771cbd82027972a4e14e0b67
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
4.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
280KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
5.6MB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
104KB
-
Filesize
72KB