Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 12:54
General
-
Target
1cc8de61685ced27317a99c7f04145f5a732bffa2a1bb062d5518d0165d5f9ba.exe
-
Size
1.2MB
-
MD5
a97748f56e8ebc584cb4e09f55419ec2
-
SHA1
af7da012d6acb8a207487c4581a1b80eeaeb7a62
-
SHA256
1cc8de61685ced27317a99c7f04145f5a732bffa2a1bb062d5518d0165d5f9ba
-
SHA512
1d9759acb064ae17b4edcba626b7b26b1365e51eef19a422c9f660962ab2ad7cc41999e5832bdd2c988f9c68c8c3b6de3e1087acfe1492bd0afadae65ebbf153
-
SSDEEP
24576:W0zwEbpelsnjkyfxpcP7kJxnSnF83PRiGBgy3rIgBQzbypT6bg6gO:W0zNUYjkCcPoJgK3ss+y4bN
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
-
Redline family
-
Executes dropped EXE 4 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cc8de61685ced27317a99c7f04145f5a732bffa2a1bb062d5518d0165d5f9ba.exe"C:\Users\Admin\AppData\Local\Temp\1cc8de61685ced27317a99c7f04145f5a732bffa2a1bb062d5518d0165d5f9ba.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xW437664.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xW437664.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\be231436.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\be231436.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\150960642.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\150960642.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 10805⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\211336502.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\211336502.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1724 -ip 17241⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
762KB
MD5f06e39167486fc96f3eeb3ac7407b38b
SHA1f330a5b7b428a395615b8f95c30107e1ab039b7e
SHA25639a59c9411b604de582b4d0defd8af49451ed7bb019e4eb8bf66fee6250edcd8
SHA5124b97f8d7443c6a4b193940f31673283e11b0751fd2594d5485ee1f26985651d3e32bd7cde6ade4150c804aa5c79faaffdbf5cf51ac7a4b0b3c592e3aa13c6048
-
Filesize
591KB
MD5b5d38b0b9fec4b6c942b149c0e893bbd
SHA12707e6fac8b5cf387d9fdcc489c9e9f3116c5ee0
SHA256dfb7f1f7c6de8988f69b12dbcc4c9bf2ddb8ddaec696fe86a0be556ca94daadd
SHA5124cbc1419c027daf6a762506c2d83d769758663c0ebbef8a7b1ea04facc20b2dea2774a31996779a06f61231480e1817d19f1b78831459830e960a38eaa6d151e
-
Filesize
376KB
MD516143c4bd073fcf8abd2525f982c6190
SHA1549358b2aa895b77df17f1d9fd597ed5b2798478
SHA25614f7f92ecee0d34d1f2d355ecd7c1f45e0c5ed9bb2d2446260f042a9e330bbc9
SHA5120c4d29781074baacd9d75299020938b68058ae91a78217cb07764d3d047af9171ba5f1630da15184c45dd6f20ea0872fdfcc68e6c4a49274eca5d11fe62bd497
-
Filesize
459KB
MD52186dc864e1223afb8e92fe85dc5c4ce
SHA1ee85f66eb3a79d8e1791aebc68ca8992d82ac0c8
SHA256566d0becdc1909aebbb4db85776e196fc0bd50a704f6731286852881723b5b78
SHA512544dfeb63e25fe4dcd761bd653d18bd5fedb3eb24923a99f06415c28cc2f6297e644952f67b824c3a5ba5222afa640166d6e4f019da89e9c9ed469699c977cfa
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
104KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
5.6MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
4.9MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB