a33c889b1929e9442a2a49de188e05a8ddbddcb32a7231b7c362f6833a45d720

Submit
Reports

Overview

overview

Static

static

2260e01650...fc.exe

windows10-2004-x64

24b96bca46...df.exe

windows10-2004-x64

2590c6aee0...47.exe

windows7-x64

2590c6aee0...47.exe

windows10-2004-x64

2a4e0bfefe...ad.exe

windows10-2004-x64

30b28fbbc6...6a.exe

windows10-2004-x64

45405e3261...66.exe

windows10-2004-x64

4daea23a41...5a.exe

windows10-2004-x64

6568836094...3d.exe

windows10-2004-x64

72a27ce3ad...a5.exe

windows10-2004-x64

7ba9a39823...5d.exe

windows10-2004-x64

7f181e671c...fc.exe

windows7-x64

7f181e671c...fc.exe

windows10-2004-x64

8a74314c35...5a.exe

windows10-2004-x64

ae6ddd393a...d7.exe

windows10-2004-x64

b2402bf5ca...fa.exe

windows10-2004-x64

c39e49cedb...e5.exe

windows7-x64

c39e49cedb...e5.exe

windows10-2004-x64

cd321830f5...bc.exe

windows10-2004-x64

cfcca94dd6...6e.exe

windows10-2004-x64

dfa156ac28...ff.exe

windows10-2004-x64

f25337a343...56.exe

windows10-2004-x64

f5d16598bf...16.exe

windows7-x64

f5d16598bf...16.exe

windows10-2004-x64

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:40

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx

2 signatures

Behavioral task

behavioral1

Sample

2260e01650710f720d71241eb7bd5d4c48d8b8a009804752139cf762bcd962fc.exe

Resource

win10v2004-20240508-en

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

24b96bca469764debd638550bc2704add4701110cc7a691fae627e361d8188df.exe

Resource

win10v2004-20240508-en

healer redline nasa dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral3

Sample

2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe

Resource

win7-20240419-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

2590c6aee0971ee73ddf13b31120ab5a7a7268c588bc55a8fe221b203913c447.exe

Resource

win10v2004-20240508-en

redline 5637482599 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral5

Sample

2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe

Resource

win10v2004-20240426-en

healer redline masha dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral6

Sample

30b28fbbc6f9f8aa27776aa07f15f77a8fe9829ca5ded9e75d26ca377674a46a.exe

Resource

win10v2004-20240426-en

amadey healer redline smokeloader krast backdoor dropper evasion infostealer persistence trojan

windows10-2004-x64

18 signatures

150 seconds

Behavioral task

behavioral7

Sample

45405e326148ce7f80326893b92fe8efe62819ee5465fdc13767a76472e21566.exe

Resource

win10v2004-20240508-en

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral8

Sample

4daea23a41245608877f956cf37370e6533344758835349d21470fee22792f5a.exe

Resource

win10v2004-20240426-en

healer redline dumud dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral9

Sample

6568836094de3a32f9c325ced189bb981eb0cf8f4492e1b8b901ef52879c063d.exe

Resource

win10v2004-20240508-en

amadey healer redline nasa dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral10

Sample

72a27ce3ad4f2daa863374d24914b9bdd41f5b34e08b440b9988fd847de7a3a5.exe

Resource

win10v2004-20240508-en

amadey healer redline news dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral11

Sample

7ba9a3982314fb26523fd5988b2b520e3a32094566503b3706d39e88d9a9b35d.exe

Resource

win10v2004-20240226-en

healer redline mihan dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral12

Sample

7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

7f181e671ca7e88969b8dbb65e5906d2d04178a6bfb5756591ea3bc12c4809fc.exe

Resource

win10v2004-20240508-en

redline 5345987420 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral14

Sample

8a74314c35a7a341a4dec6d70e0d6801d49282a77f6ca44fee133e1d3ae7b45a.exe

Resource

win10v2004-20240426-en

persistence

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral15

Sample

ae6ddd393a98c003c8da6717e815e71c83f5a3b75783ce55e2793d35c51a9ad7.exe

Resource

win10v2004-20240426-en

healer redline dumud dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral16

Sample

b2402bf5ca4c67871f6519e689231078532c147c35500668d062dec52e27e9fa.exe

Resource

win10v2004-20240508-en

healer redline lamp dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral17

Sample

c39e49cedba79cf37944568e6b8975f59cf50c3ee02bad2cb56a9047b12fcee5.exe

Resource

win7-20240508-en

upx

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

c39e49cedba79cf37944568e6b8975f59cf50c3ee02bad2cb56a9047b12fcee5.exe

Resource

win10v2004-20240508-en

upx

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc.exe

Resource

win10v2004-20240426-en

healer redline masha dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral20

Sample

cfcca94dd6bef9e4222fd6347d090711d60251b7718a2a4955753cd95d8e9a6e.exe

Resource

win10v2004-20240426-en

amadey healer redline lande dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral21

Sample

dfa156ac28a140cde5b62ac7d594d1000da526091fd584c8e8caa96c692a5bff.exe

Resource

win10v2004-20240508-en

healer redline kira dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral22

Sample

f25337a343c26cdecd99eb7f095938fd24fb233463a8af3fa69acc5201eed956.exe

Resource

win10v2004-20240426-en

healer redline crazy muha dropper evasion infostealer persistence trojan

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral23

Sample

f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616.exe

Resource

win7-20240221-en

redline infostealer

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral24

Sample

f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616.exe

Resource

win10v2004-20240508-en

redline infostealer

windows10-2004-x64

2 signatures

150 seconds

Report Analysis Logs

General

Target

c39e49cedba79cf37944568e6b8975f59cf50c3ee02bad2cb56a9047b12fcee5.exe
Size

2.3MB
MD5

a4fb9883ee8a8beb10c262b023906548
SHA1

b332a89c7ab5de8e522f00cec3df72fb251e3ee9
SHA256

c39e49cedba79cf37944568e6b8975f59cf50c3ee02bad2cb56a9047b12fcee5
SHA512

9b13e63c323cdc49c48ded53ae80d9249545f8ad8630c0c2613cc48619bf7df669e76e15b6f255a1fc19ebc2a562dbcd03350b90dc90b15ea07405a45dfc5014
SSDEEP

49152:AdeZsBDZfkum6kQgZxV0+qU9NOqbc5alaZVQ9ViNiv5DNwRFCrKB:ASMDk+cxV0+HbFcogZVQ9ViNiv5BwWg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral17/memory/2840-1-0x000000013F330000-0x000000013FD8E000-memory.dmp	upx
behavioral17/memory/2840-0-0x000000013F330000-0x000000013FD8E000-memory.dmp	upx

Processes

C:\Users\Admin\AppData\Local\Temp\c39e49cedba79cf37944568e6b8975f59cf50c3ee02bad2cb56a9047b12fcee5.exe
"C:\Users\Admin\AppData\Local\Temp\c39e49cedba79cf37944568e6b8975f59cf50c3ee02bad2cb56a9047b12fcee5.exe"
1⤵
PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-1-0x000000013F330000-0x000000013FD8E000-memory.dmp

Filesize
10.4MB

Download
memory/2840-0-0x000000013F330000-0x000000013FD8E000-memory.dmp

Filesize
10.4MB

Download