Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 23:45
General
-
Target
d4a4f99f5155deeda51db4f5f1b74518af781107f3a83ed89615f1c070a51ab4.exe
-
Size
1.2MB
-
MD5
16c2bd860bad3669ce3218dfa51c2271
-
SHA1
21e8c44d694ab783532c60326f00bb823c11b01e
-
SHA256
d4a4f99f5155deeda51db4f5f1b74518af781107f3a83ed89615f1c070a51ab4
-
SHA512
fb41ee1997f61954f6460a68deb73c02716f0d589506ee86b5dd990ab283abd57603f0531012782618a27dc2057623a3b31d69a88a1010f04c0be56b7f7fceec
-
SSDEEP
24576:DO/ma41pNBrquMHuDpKqJUd5xYsLo11YdH/tFrQhldU8HJVYx+dblqaWSLO:DOXedEODpKqJGYsLMutFEIx257
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
-
Redline family
-
Executes dropped EXE 4 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4a4f99f5155deeda51db4f5f1b74518af781107f3a83ed89615f1c070a51ab4.exe"C:\Users\Admin\AppData\Local\Temp\d4a4f99f5155deeda51db4f5f1b74518af781107f3a83ed89615f1c070a51ab4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 10805⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2316 -ip 23161⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
763KB
MD5f29d111c772c23c3f519a3a2fc3f08b6
SHA1268dc2b2e4f513d4413fad9368bc4e5d373e81eb
SHA2568051db68eba1bfc0d5b55749ddf5280b7070568597253ac8ea0e733184e0847e
SHA512f8a8524eb76e1a8e59c3d88b47f958c9f18b352cab81964bf899daff2bf363f56d14e87f3fde0e93a59ce721f3308cb036cac6b482a97227d5811f35f4818c8b
-
Filesize
592KB
MD50334faee3c8f458beda101583d670322
SHA1431c0120f423c32af37a40b2b03bf4ff2831efcd
SHA25666fbb89f1429d0fd5bb215cd30a3181c59dcc6553558b79367fc6d217f1f4ddb
SHA51280a4f2944ceb2962587b30aa258c257ce5fb5347d7e69ae6dfa0921a11086f1064b2421e9d46802852b596b412785935c7ad7639701ba8a0b94f7c27a8be0506
-
Filesize
377KB
MD583f564c1ed3c578458a63a80a09e3133
SHA1f85f3afbdf8ef9240e9d62d663202e52649742de
SHA256c42d6dfe8ce27758b60ffab1d4111283fa33d0d0616b47ceacb9008470011ed0
SHA51217ca918909711c5d6c0b82844e9f34c2d1f174463ad6dd570e4fb86726917872f513fe8b19dc5e36adbbb0fe4fb911c6e22d3d7459a91a5e5befa10eeb4f12ef
-
Filesize
459KB
MD5573ebefdb8312b08d981837af4379aa5
SHA1c4c2f5b56ed38c2bff5d35546fd9f269825f9e78
SHA256d499c5d2fbdc354790c269b27ab6c1be31368c93f386053415cb5877e47694e4
SHA51252d3014f63ad1b3c571a9df6a61a66f107c4dfc96d13c34d129907527dc29b03854a7dcf41295aad696692f430348b0109035026f24f25dfc3c03ecc41f0236a
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
240KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
4.9MB
-
Filesize
1.0MB
-
Filesize
1.0MB