Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-11-2024 17:36
General
-
Target
3076f377a71b5f1f623f6d5d36b4645748a0190f42490216bb1eee5ba2424c6aN.exe
-
Size
383KB
-
MD5
dabdd3319c727832122a7a8f5e94e910
-
SHA1
b21adc5fdef732b8bdd997bed0855fb38d272257
-
SHA256
3076f377a71b5f1f623f6d5d36b4645748a0190f42490216bb1eee5ba2424c6a
-
SHA512
56bfee4dcf847e12a9ddcdeea857ba56cd5dc0673168d38bc4bf11d07176588c9b518e77dda50a8f389bcbeefcf1c8dd29bab81b6bf62cfebdcd5c1e88cb07e4
-
SSDEEP
6144:Kay+bnr+zp0yN90QE8RVq38RJFJm5VhgUGE4D/zTHyVEsos1FUAXEGRmgQQOaS+b:OMrjy90SRc8byXhgE4D7TmEJniEGUgQm
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3076f377a71b5f1f623f6d5d36b4645748a0190f42490216bb1eee5ba2424c6aN.exe"C:\Users\Admin\AppData\Local\Temp\3076f377a71b5f1f623f6d5d36b4645748a0190f42490216bb1eee5ba2424c6aN.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr171688.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr171688.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku200936.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku200936.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD52f2ef334746d9d95b33a7c3571511f2d
SHA1d990ad7748a85e651aa3d66108e0ad60a28505a9
SHA256cd9cca6914abf3051c93da6abe1721100ab37c4eb6fbf8fd80228c7546601664
SHA51208e5ad3da6f6080863ceb68c8002d39229614720286193f98d7121a0bc3d6405cc3f98b81558566c8fc06c436fa68061b7707611f5be8009416fcdf17ef4fe57
-
Filesize
311KB
MD585c38fca9bd703808c47d4d809ba4f0b
SHA1b0ce0ae0944d2a0dd64627e7bab45148e46eef2d
SHA256944b2c92782cdb4b2121cd8f4b4dde9bad1bb6e28c8b3d6223585382af813b79
SHA51289568af5db4773aa9527ed4007811485f0de509c2ae2ca066f885cc3df918e6b78690ccec3918e0fddc02a4a32224466e54e94f2fdee29d68893f509241a3cca
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
300KB
-
Filesize
1024KB
-
Filesize
312KB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB