Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 13:18
General
-
Target
feabe03167cf23b6bb05f666c25a3b8cd5166003e6167dadc604daebf6409116.exe
-
Size
746KB
-
MD5
71283fd4eead3877c1ade1011c69e855
-
SHA1
e95f5240ecca5681b75e7145f2177956a2138f5b
-
SHA256
feabe03167cf23b6bb05f666c25a3b8cd5166003e6167dadc604daebf6409116
-
SHA512
1ef6966fa5d1692d6c9c8030fcbc3234e9d58e1033a294809a6e5097dd8390a3e51e93aa1442bcb464f1d85c4b6918c1ade3f60bba207da2c2d50420406a3ace
-
SSDEEP
12288:iy90do7VNMmdJQMDqHKrq+EUIcSOsy7OSmOfSLbG4wWGVAFAIHWdYbC:iye+izHKr5EAsSfSbGZWuI2dCC
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\feabe03167cf23b6bb05f666c25a3b8cd5166003e6167dadc604daebf6409116.exe"C:\Users\Admin\AppData\Local\Temp\feabe03167cf23b6bb05f666c25a3b8cd5166003e6167dadc604daebf6409116.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un828230.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un828230.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\28789376.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\28789376.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk930677.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk930677.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592KB
MD5a9ccde53addc3861980d93dc8499bb99
SHA106d5bb646ad9597e34ca4aaa2594342f9c05c470
SHA256af1ded6c2b44d049d8a8d5ca4244d59b437874b48f9b6d2f0ceedfdf738bdae6
SHA512f9378a5a1f0d51223009a42cd5c156fe01244dd649ae4bea1b467b8176252a874271dc03daf61c6d895cc37922a51d273615911dfcec46cd6f3082237ca561e7
-
Filesize
377KB
MD5a0c412fbf40d08c8c690f1a86e1ebb2c
SHA115af913de2f236db914b5bf69a33b33f44c14c88
SHA2563cfa430d7f5ec2d1130de1e370f31d1f71859ecb09b44d3fc740dbbd0c1b0f55
SHA5127d356ebeac7d69ac3bfcfb7c98d92f96152236c500be565e45b6d0f7fe97498c092245b801131aae61dc64d2d856c7edff6cca7a1a3ec82667167eaba0dd75a3
-
Filesize
459KB
MD55bdb1e545b7c9450f7585d3ecd962ce3
SHA140f2cde5fc7491d75da5bd25ec81b96d1fec96f8
SHA256b9a7deace24f0ed520f0f54e3a603070e250b08a22df57532dbe40c676aebe80
SHA51232d25ed7eb45adec5acf8082ba92cc473b38b5ec675fd9f1e61738a803c83ed94d93a987b8f0f8af3c140e191a2f37686710a9b5b893117d53729eef048da551
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
1024KB