Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 21:43
General
-
Target
8b9cb29f479864c25ad52df05d007f58f686aea3fbfac3982a491971b9a9070e.exe
-
Size
642KB
-
MD5
f0f150574b9dcb096f124084f6288219
-
SHA1
6903f6b499d7e5d1e3fa1aefc75f3fcaf5c97412
-
SHA256
8b9cb29f479864c25ad52df05d007f58f686aea3fbfac3982a491971b9a9070e
-
SHA512
a5244f7ccd8848ae04e53e442daa63a27f1e20b41c9af04540f3a8a03ede75a8f9fc70dc2c2fbb14cd3ddf7e21d92faaf2887796b0cb916dbc1dfcbab3c10f65
-
SSDEEP
12288:Uy90DlGK9Ada9x1tn17OrvVy/WW6tq1qbPKyA+rPV05DUd:UyClGKadaP17Wvcl6tq1qbPN1N05DUd
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b9cb29f479864c25ad52df05d007f58f686aea3fbfac3982a491971b9a9070e.exe"C:\Users\Admin\AppData\Local\Temp\8b9cb29f479864c25ad52df05d007f58f686aea3fbfac3982a491971b9a9070e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st805462.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st805462.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\09517656.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\09517656.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp613473.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp613473.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
488KB
MD56c83e846eb640c1670562b5e85ebbb34
SHA127c5efba96323ac3c78ee35301a0bbd0976cf8ba
SHA25680da0f11cdea6cf1221ce2c9703559d2a3aa1e3baa218ab8e9e28ed74c7de96f
SHA512f0257ddd98d33a6233b143bc2903e88765a605c6d4c4928b38a9acaadee597620d0165f288561a4227d5f415f2f8c459dca3d0f19925038f63f227b26b956047
-
Filesize
176KB
MD52b71f4b18ac8214a2bff547b6ce2f64f
SHA1b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5
SHA256f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc
SHA51233518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177
-
Filesize
340KB
MD5ea4b0b66c871bbe4d689be4e6df74da8
SHA1a1d841f99a42cadca6f0fe766ff200f5155d56a7
SHA25683a94190296682c061894792e0a9a596a3f74514c4346a9c36d123f544312994
SHA5122fa040d19684e51dc5eee3b831213087c9653a8c56146fc25723b88596ce84f29911c8a7fca8bef66aebb056e13a1033368fb63682cb5e7e53a53c9e80e96b63
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
76KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
4KB