Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 00:16
General
-
Target
9cdbe7c5cd62aa1ac0129b74f69c159acefbdf6809ec3edef7e9629f14d1ac6f.exe
-
Size
695KB
-
MD5
5853fcf0ee1ac3bd51b139cb3c55ed51
-
SHA1
68753e6f47a896b27209985f155719c041f484da
-
SHA256
9cdbe7c5cd62aa1ac0129b74f69c159acefbdf6809ec3edef7e9629f14d1ac6f
-
SHA512
a7bbec8441b510625c660660aaa1c02313e893f1d065903426e3053993eb5561a291d1c478fe9a81ab3c654aa83a6d7873bd29c1353de6bda0b5a90a774b6a18
-
SSDEEP
12288:vdy90xhXDv1KJf3aJmxmrSEvYJwVGraRyndXBcppCQVogH:FyKDvoJf3xcOEAqErau8pNVoc
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cdbe7c5cd62aa1ac0129b74f69c159acefbdf6809ec3edef7e9629f14d1ac6f.exe"C:\Users\Admin\AppData\Local\Temp\9cdbe7c5cd62aa1ac0129b74f69c159acefbdf6809ec3edef7e9629f14d1ac6f.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un300004.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un300004.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr872676.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr872676.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 10884⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu856367.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu856367.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4028 -ip 40281⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
541KB
MD5973d6336ad75331cc126c139f12f8c34
SHA1ab5bf160d355098879b4d2c3dabc9752c04e0a8d
SHA2567949889b24e6560c5520b907535190beed96b69a5736e5b4fdb0012fcc19c1d9
SHA512c3e15f32d30baac3bca1e4482c5c16678f8057349496bd4df39b6aaa9cc53894566529e3f4b2b9d527acfaa1a4f846bb8c7609a64bfa83f8dddaf07e69dcdb8a
-
Filesize
269KB
MD53c016f8a9cdbaa53de561700393c8ed6
SHA1c94dfc11411e0d75869faeff440fe38e426ae9d3
SHA256c09f5929adb51d715fef916172a27327575075ba2aa3e56747c068207fcd0e0c
SHA51297caf716c9e2d6030c2283cdaef9f2ad25c1972467316f084189be9f0a25fb6b4d9f20b8118012a7c2e7b226f91d4db9c7713dac746d36a6edb929dfc1c2a877
-
Filesize
352KB
MD59fa99c615e2f02d7d18a06ea2c5b3b0f
SHA17bd54544b29e6e64de4d511bb42ac348d48de56a
SHA25602ef2bacec9be2248bd4073f2d9ce6a1fa8a44ca7d19e47c19bb0b0b36c97b29
SHA512e9b8cec235cdc58f7f33912975856491d6199a39af0a39154ab0eb8e0dfdac90c3dea16d30bb944c1689acfb17fcb7a98c0e4f8481790a975f434aa3e2f9d7d3
-
Filesize
1024KB
-
Filesize
192KB
-
Filesize
104KB
-
Filesize
39.7MB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
192KB
-
Filesize
39.7MB
-
Filesize
39.7MB
-
Filesize
192KB
-
Filesize
240KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB