Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 21:41
General
-
Target
243fe2077b67a8927acc2735ec4fe2aec2fcc8755f8bf6f140cb88627e53cd00.exe
-
Size
611KB
-
MD5
315f1dc5b515aa635c131b165ae10e0f
-
SHA1
83e71a090abfe8c671b8615d98a90fa4ea92621d
-
SHA256
243fe2077b67a8927acc2735ec4fe2aec2fcc8755f8bf6f140cb88627e53cd00
-
SHA512
1fa54afd4dca431f002ea658bec28ae7f5ce954c0594634798c77b68b3d4ca8e3d9ef8aa9569d2b0280edefb18e5109089c94a66b576b4f4abeccec7644274f9
-
SSDEEP
12288:uy90p4GJVDhv5xU0bg0XvVyDoE6ovm+jn7s9bgWtVX9dTNxv1mDzk:uyvGJnbg0XwE96jujVX7TNODzk
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\243fe2077b67a8927acc2735ec4fe2aec2fcc8755f8bf6f140cb88627e53cd00.exe"C:\Users\Admin\AppData\Local\Temp\243fe2077b67a8927acc2735ec4fe2aec2fcc8755f8bf6f140cb88627e53cd00.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st066922.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st066922.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\51818713.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\51818713.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp858618.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp858618.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457KB
MD5825f86ea57bb03682e683f6c7aed5709
SHA1fce928338ad6963c6eaa53172084d7e214747534
SHA2565c07e59ed99cebcd0624e954c1f4265c0c5371c60f796f997bc7732534d8b48f
SHA5124343fe7a497694d6839bf5be35c73ed8369a14ee1beaaddc5c54b6e8653a965f6e94456ae7306e48baa87e673315dcccfe5633c201c4483af67d7ada9466e0b2
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
459KB
MD5f9a508e4ee8e3b4c11c4356eb225e653
SHA1b0f1b10ccadfd72f6b7d4dbaf80830f9e820c3bb
SHA256179d3564a18869c57af06f1518b4f8d6121252a8bc377b99c087b786beb3aac9
SHA51237a40adca3ef4955ff74e04673883d802cc6627c2cd17a764f5eac69d9b08db837f9198fcf7fa2e38a9ea1043edb12095ab3a65d1b6e459c7f0d9a2bf23a0d99
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
5.6MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
304KB