Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-12-2024 21:36
General
-
Target
3673e6bd432f8cd8614783aac1420754bb99b506f598f9977d7ef1eb5e6ab9d4.exe
-
Size
399KB
-
MD5
3b681ca6108610d1e7d8b5190bacc2d6
-
SHA1
999a450735d985dd46cdd467ce845d440526fc98
-
SHA256
3673e6bd432f8cd8614783aac1420754bb99b506f598f9977d7ef1eb5e6ab9d4
-
SHA512
d2ae3a5a5ab56b97dee75686d2aa4d054b8a25eda98df4aff04ef2e594320abb2fdbfb20305f682424ffdf38cd018c8530e35425d22836cc6763327a7a20a648
-
SSDEEP
12288:rMrmy90+kwXifFewYeEHJ3FVJS3m4zQU2:Ny4wsFWx1KW4y
Malware Config
Extracted
redline
ramon
193.233.20.23:4123
-
auth_value
3197576965d9513f115338c233015b40
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3673e6bd432f8cd8614783aac1420754bb99b506f598f9977d7ef1eb5e6ab9d4.exe"C:\Users\Admin\AppData\Local\Temp\3673e6bd432f8cd8614783aac1420754bb99b506f598f9977d7ef1eb5e6ab9d4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bDe05dI51.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bDe05dI51.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cUq48lv79.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cUq48lv79.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD50dedb2624e3d8afbff42fd944752a7cb
SHA132c96f9b4eea64204d18eb155925e25dc1ef4492
SHA2564f0631230435053b132b4ea993fed46852ee0b03c066d518f14ee1c5556cb07c
SHA512de83e37a7fef41196d5ad2b8fe2aa72f1d06d10a6a762965107465a3dc37f3b668bb7ffbda1300212fbe56f6728d61c5efd16eab63552237dbfc0bbdc7066a1e
-
Filesize
374KB
MD59b5ef04e3ab3c694ea112595c7c274bf
SHA1143b74803ab63806854158d3c49699b2f4693039
SHA2566ff032e10de78fe3a37d2bfb52e383f5e6c4e31ee7c8527ed88cd5dc836c34cf
SHA5124b07597d77e417a3e93f8fad63f304a65c98af6f95e36d48dedcf339b6bf6d767520843f36303764b4b7d771c51ea50cbc7e0784cf3c30c6a2611e3b08cca2d6
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
8KB