Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 14:16
General
-
Target
8b184c236fd99e49677da43a93a5695509731d61fc15ebde9731c717544af2db.exe
-
Size
706KB
-
MD5
b7d8018d953c487d4d79a64e4223abef
-
SHA1
d8e7781353e837444c733dc4952fafc783b8013d
-
SHA256
8b184c236fd99e49677da43a93a5695509731d61fc15ebde9731c717544af2db
-
SHA512
184e9622cbc8baf75f0d987ece75bf10d8e37f1219cd976fa4b67d2e70e4eeb082bdc202c6794100737a903e11d77e7bf16ba5aaebdd900edebf1a512ba9b426
-
SSDEEP
12288:jy90vItruCxs/F92Uz8jCldIKhAhnlGqsBlYlLLgr4iUHOQ3wEoISAxEHKT:jy2sRxs/FEUzb0RsoyUH3zSGIKT
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b184c236fd99e49677da43a93a5695509731d61fc15ebde9731c717544af2db.exe"C:\Users\Admin\AppData\Local\Temp\8b184c236fd99e49677da43a93a5695509731d61fc15ebde9731c717544af2db.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un182241.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un182241.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr380334.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr380334.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu505034.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu505034.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4172 -ip 41721⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
552KB
MD5edb0202b5fbba7956d90ed43b2b86938
SHA1ca85a17fe1ff0e253c9d3f5afb25384280e723a5
SHA256afa68c38672c2949851e6d2ba5a8b2199c04d694511cf411ccc2161778e6720b
SHA5121e3a56b6d544e2bc38490beba674b712468c2c6c83cc888b44ba08adc94dc424c4e82ca549ada808c1b16e37dae164617d8281c7a150a508d6a945ae763f4e66
-
Filesize
299KB
MD58e2a5cd0d725b2fc7f0fbcad278ff26b
SHA15ffdb011d366f74ef0e517e45cfbe220e629d30b
SHA256de2b6824a1a07fa5dcf2cfaa2a0fdedf12c9908a0c487ffd84445a14c214506f
SHA512c90871b440b968d15dce8aa2d2bc851332015093997fcda67d88f3375eea0d77b53ac452285338a58ff2f2115de5b579b769b012abf3504db8bf1eb9aa00e7d0
-
Filesize
381KB
MD50a671d909ebbba4ddda8360525e79f03
SHA18db12e8b5e079cb0b2ca864ab3639379df2d0d46
SHA25637564a98c7c524addd1920f1bb376a0c4c6f846e19b6d3f5605e346ec1ec4be7
SHA51262188dd904d0bc061712479e4b9cffdb22f82f379defa01193421866cbea33230be193ef73d4b42204d06201dd29200d2a0e99c7854f51eab372fd589f90f6c1
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
39.7MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
39.7MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.7MB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
1024KB