Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 00:38
General
-
Target
6fcfe8a711d8ae316030a468e42d40b626f6d0098a6c1434f1a5ec54656422f0.exe
-
Size
689KB
-
MD5
99644346537b51cc44f434d0b2b5e8a9
-
SHA1
b5414f655ad35131ac5b2b7f268e4fb72c75e725
-
SHA256
6fcfe8a711d8ae316030a468e42d40b626f6d0098a6c1434f1a5ec54656422f0
-
SHA512
dda61eb22b59ddeda2a35942227e575836c6f137bc7e314afe3ef311eecd9ec65487bb25ce7a4c39d42b281d1216087d23f62a35973917b9e2e551f56e746de0
-
SSDEEP
12288:3y90q2bqpNg8JMxmNiLGidibxHExQBgzZIJz5SDhpEu+sK0brLxrEx6O/TV2Lyaa:3yn2bv8JMQNiLL+xHEzzZ+58KR0b3xrU
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fcfe8a711d8ae316030a468e42d40b626f6d0098a6c1434f1a5ec54656422f0.exe"C:\Users\Admin\AppData\Local\Temp\6fcfe8a711d8ae316030a468e42d40b626f6d0098a6c1434f1a5ec54656422f0.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un140024.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un140024.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99074141.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99074141.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk381252.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk381252.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1732 -ip 17321⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
535KB
MD57465789687525ffff5d73cb9d462c841
SHA1bc06a4e370a2fcd11d63366628dd6f38c7ebe72b
SHA25688a5aa94c63eeda92e54388042f40b20896545cd75eb3f94d4326881c9fdcaf7
SHA512b76a63148c8eaafe7eaebdceaaf40d112e8cffcabedab35084a541485f15146bf47ab7b26067b02307188aabe6964160c3601a7ed7e221770762dbcedf0af5b0
-
Filesize
259KB
MD5e6ea9f69459faf4676ff135702f57a22
SHA1e44b0b13107eba3ccffef2c59cfdf27d0012da05
SHA25645fee3ad24f5c1af1aa7502814f2fd3b7ee1c7b1ce29f2f4273b2e2bc44ae1c6
SHA512306dbd1ba20f7464b79e110c2af9a8beedba4f11fafac74ddec8c10e4769ba73d6810ed3bbafcf6b2ede201bb92833298ddc34983d882653922e2db5a429fc42
-
Filesize
341KB
MD55eb379bce8374d7363a48b203716bb65
SHA1d3691b526d4c8f4622df4a47e74074ce53cbd95c
SHA256ef5775ed7e9f558b63f9f7bd37b97ad459d0e6ae8da3f152049b1a33609699b8
SHA51242bd4e23b92a7753c52f2e558f6853d4817239861ebf48ec3f84eef66c8486b7c681f9a509a9188c86ec3bdd77612d8475c69b1c168b581b7f985d95a45c50f1
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
76KB
-
Filesize
192KB
-
Filesize
340KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
340KB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
180KB