9bf42d30009d4ddad615b803ba623f0520c82c23439142288ce711002d7b3292

Submit
Reports

Overview

overview

Static

static

0f6ce02639...df.exe

windows10-2004-x64

17dbf09aca...d0.exe

windows7-x64

17dbf09aca...d0.exe

windows10-2004-x64

1b624e343d...55.exe

windows10-2004-x64

2faa75c50b...6d.exe

windows7-x64

2faa75c50b...6d.exe

windows10-2004-x64

4be1f370e8...6b.exe

windows7-x64

4be1f370e8...6b.exe

windows10-2004-x64

576cad65a8...60.exe

windows10-2004-x64

6aa8d5d0d6...df.exe

windows10-2004-x64

6eeb3d69d9...69.exe

windows7-x64

6eeb3d69d9...69.exe

windows10-2004-x64

77b8709187...06.exe

windows7-x64

77b8709187...06.exe

windows10-2004-x64

7f4e227924...bb.exe

windows7-x64

7f4e227924...bb.exe

windows10-2004-x64

8a870280a0...35.exe

windows7-x64

8a870280a0...35.exe

windows10-2004-x64

8db6f54494...1f.exe

windows10-2004-x64

b21367ffaa...ef.exe

windows10-2004-x64

b62068be50...da.exe

windows10-2004-x64

be5114d10d...f3.exe

windows10-2004-x64

d191282ff4...7a.exe

windows10-2004-x64

de9167b772...91.exe

windows10-2004-x64

f6dc0b4c65...d6.exe

windows10-2004-x64

f85eca1ce9...65.exe

windows7-x64

f85eca1ce9...65.exe

windows10-2004-x64

f8dfa98c4e...be.exe

windows10-2004-x64

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:50

Sharing

Copy URL

Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0f6ce02639d4d4caede8c3432a529ff995f9d50cbfec335bbe9dc19b8f5c9ddf.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

17dbf09aca5536c41f48cdee19e90cc995aeb0b0973ec6bca572f03b1ead46d0.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

17dbf09aca5536c41f48cdee19e90cc995aeb0b0973ec6bca572f03b1ead46d0.exe

Resource

win10v2004-20240508-en

redline 5637482599 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral4

Sample

1b624e343d222ec9333b85d3af29b913b42ba3196fcb192f618e87ec4afa8855.exe

Resource

win10v2004-20240508-en

amadey healer redline lande dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral5

Sample

2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d.exe

Resource

win10v2004-20240426-en

lumma stealer

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral7

Sample

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

Resource

win10v2004-20240508-en

redline 5195552529 discovery infostealer spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral9

Sample

576cad65a899197ae35e757e578a7c10c29e57c266d1fa4931c6f98f3d2e3a60.exe

Resource

win10v2004-20240426-en

healer redline mihan dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral10

Sample

6aa8d5d0d6b96fe2a165ee46c9e31059a444b4fae6660eee669539f88bf869df.exe

Resource

win10v2004-20240426-en

healer redline dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral11

Sample

6eeb3d69d9979df74b9c482de2344395f5470b94f07494b4a4dd74fb5d286069.exe

Resource

win7-20240419-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

6eeb3d69d9979df74b9c482de2344395f5470b94f07494b4a4dd74fb5d286069.exe

Resource

win10v2004-20240508-en

redline @nmrzv88 discovery infostealer spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral13

Sample

77b8709187b6802be16e005b1139331349304c04ecd4e741e8609229f0134806.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

77b8709187b6802be16e005b1139331349304c04ecd4e741e8609229f0134806.exe

Resource

win10v2004-20240426-en

redline @qwerabuse infostealer

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral15

Sample

7f4e22792482af87ecb52079082a4c33f24544a6b37c4e5da40ac1ac7f9ca3bb.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

7f4e22792482af87ecb52079082a4c33f24544a6b37c4e5da40ac1ac7f9ca3bb.exe

Resource

win10v2004-20240426-en

redline 5345987420 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral17

Sample

8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

8a870280a0dc165cadf46427c4e47c56d3fa42aa2cf823a54358bf48f5102435.exe

Resource

win10v2004-20240426-en

redline 5637482599 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral19

Sample

8db6f544940545b4e7f0eef92bc68e65f5e9efd3707f33b7e5594777d56ed71f.exe

Resource

win10v2004-20240508-en

amadey healer redline papik dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral20

Sample

b21367ffaa0009b30055944fc1052857ec46336d5bfe2efd3dab109667a56fef.exe

Resource

win10v2004-20240426-en

redline diza infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral21

Sample

b62068be50129166f539eb32a63746c4245a497e9b72553efdf326582cc5f4da.exe

Resource

win10v2004-20240508-en

healer redline lamp dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral22

Sample

be5114d10db820426670fbbb41db92b8671a5f55a0b396e2d54b44606067a6f3.exe

Resource

win10v2004-20240508-en

redline dumud infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral23

Sample

d191282ff466919a5feb6c8682f696332eded6dd8747d336fe16593c6ea96f7a.exe

Resource

win10v2004-20240508-en

amadey healer redline nasa dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral24

Sample

de9167b7720db28dc71aba69c32792f2bcfef4425545478b6b641677be8a0391.exe

Resource

win10v2004-20240426-en

healer redline mihan dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral25

Sample

f6dc0b4c65662a9753e54800489b07d9f5a6a4c896a61d93f3a1a3e28d5bc9d6.exe

Resource

win10v2004-20240508-en

amadey healer redline nasa dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral26

Sample

f85eca1ce903e035e1355a0ec74636f6d825aeaf8efa5c98472b6acad6536365.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral27

Sample

f85eca1ce903e035e1355a0ec74636f6d825aeaf8efa5c98472b6acad6536365.exe

Resource

win10v2004-20240426-en

redline 5637482599 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral28

Sample

f8dfa98c4e38deff7955c243f9db7b01692e43c0997eca9e5e141cc565cf05be.exe

Resource

win10v2004-20240426-en

healer redline lamp dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Report Analysis Logs

General

Target

2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d.exe
Size

1.2MB
MD5

fb2fec42f81a255012c589b29e4f086e
SHA1

99110b60ce21039ed15f571a46159ed2409d2ead
SHA256

2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d
SHA512

0c36b9af63f1e1aef4cd1146c9b99902fcc8ca3bd61228b163336f10085170ae31889dc1837ca0b1c547818e4bf4b60450ff1b7599b324ac22bae8290fd5e3da
SSDEEP

24576:EXixqeljPl1pVbGqvHnoPa+YioUMMn/NNT2CPQ6:EyTl1pVbGqsuM/L

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1720	1928	2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d.exe	28
PID 1928 wrote to memory of 1720	1928	2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d.exe	28
PID 1928 wrote to memory of 1720	1928	2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d.exe	28
PID 1928 wrote to memory of 1720	1928	2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d.exe	28

Processes

C:\Users\Admin\AppData\Local\Temp\2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d.exe
"C:\Users\Admin\AppData\Local\Temp\2faa75c50b323133e8cbf507e6a3a4846097090d2e2c1a5afb174f798ee42a6d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 116
  2⤵
  - Program crash
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-0-0x0000000000E48000-0x0000000000E4A000-memory.dmp

Filesize
8KB

Download