Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 13:54
General
-
Target
260496875b246963322753c0d259e320abee2974fe398171cdbb96e907a91a16.exe
-
Size
568KB
-
MD5
ca7def6efcfc4bc4334ec39282f59a7d
-
SHA1
160f42d44433011f2123e8a37bd4acd83ccdb0b5
-
SHA256
260496875b246963322753c0d259e320abee2974fe398171cdbb96e907a91a16
-
SHA512
5d94d3dfe72ba41ef7db33544be6b30703e311ae4dd479ef1e7293f9d683298479b8e6288731dc578c8c8db48bf9dc190d0a7493c255e2878eb31e15b752d109
-
SSDEEP
12288:Uy900AZTxOo3ZoLNTJE/uxFBIriiEnOsO6bhOrWKIpG:UyfM+hC1EnHO6kKzG
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\260496875b246963322753c0d259e320abee2974fe398171cdbb96e907a91a16.exe"C:\Users\Admin\AppData\Local\Temp\260496875b246963322753c0d259e320abee2974fe398171cdbb96e907a91a16.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHw5746.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHw5746.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it587880.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it587880.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp736967.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp736967.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
414KB
MD5c8454292c4764cbed4e171fef66a3deb
SHA1006195fae02f6404d2ebbf99f14e7f8fe47512d5
SHA256f738df449cdc5397c542419371a545cdfc58927006be5f9d00812ec754dbf138
SHA5129e5498c8bca118db84364f76e76164530bfc9b3dca3247c4027816a7c586fb648320304a457911c17d47f8b6c2c3c6768877115492e0cb98809ee5af1926b7b4
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
381KB
MD52dc0c97b74915e2bead7fbc05a69c2bc
SHA13feab9aa0190b51ef2b11ae7989eea00a1e14a14
SHA25655dc70d8013bf267186da9efe81beb15562c2fee4b9a2a75a1a12c08464551a7
SHA512bb8d855ec9fbb284d2c3c6f2b521b652e9367e787aac058fd1fbf0931d9e1db9d32a9b4568eb1fe2654fa85b460002cdaa97e8a191ddb09f3fdb4091c83f71f5
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
5.6MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
304KB