Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 01:22
General
-
Target
f9c5caf18d86cc1696e3c308236b0ee4e13ed19343517d41c0d78142229fc450.exe
-
Size
747KB
-
MD5
bb1d4bb66b7028ad95651ee357549eaa
-
SHA1
465325f97382d984c201665f2d758b85197e0b14
-
SHA256
f9c5caf18d86cc1696e3c308236b0ee4e13ed19343517d41c0d78142229fc450
-
SHA512
dca547b44a54d03e28e32f8a705ecec184a5917dbbcf61930ea0083f5d5b006de944c0cde9aa977da329b84c4a12ce28e9726c6057476a5f4a4739aef74c8d25
-
SSDEEP
12288:Sy9073buZ2r1RwXtDcKbzptURVg6weeEzwMjzJlz4JNPtRvFpdSlqATQ:SyOr1acyzvhZe/HHaNPDvFPSkATQ
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c5caf18d86cc1696e3c308236b0ee4e13ed19343517d41c0d78142229fc450.exe"C:\Users\Admin\AppData\Local\Temp\f9c5caf18d86cc1696e3c308236b0ee4e13ed19343517d41c0d78142229fc450.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699977.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699977.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\47145965.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\47145965.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 10844⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk585147.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk585147.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2376 -ip 23761⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592KB
MD587ce6a9dcaad1d35b94805f605ba02c1
SHA1e1fe5ba4eeeeba4d885ca370e8bb1f2efa29abda
SHA25639e260ac6ee5ed3c4e765a8370e572e42382e46bc14b8210ebcdcf8a029e4d12
SHA512defd07923a774fb536e1912f6325dbdc6af8e40c2ccb81ce681bb4c5763dca115b162e45310a4e64e4d1f351d4c79ea96a4aee644a0ad2f1207613a9fe02a2bb
-
Filesize
377KB
MD5c5c4c5ef5b2e1c27cf9d4cce559cb043
SHA1adb549abf8c71cd95d330a51aefba9b703294f86
SHA25696d6a35d35f47dede3541229a565646815e7bdc803700d630616431f5e09dbad
SHA512c66a9932228cda8454fbc6c7ebb59d7efe2d8d83bc135f59738fc01d81406b40454da8292d565beca290c023615c264e9749e0a9a01fce174066613a263dba50
-
Filesize
459KB
MD590621d082f53ec2a0f554a4e38c3584d
SHA131fb7e1002363e42663638cfbd36c2f06a8555f1
SHA256945533f6e56171cbfaf590793a036e4d3c4ea81ca4abee3e50263d6f3112280c
SHA5122d39a2d24839200aecfa95be74f06ce44f103d2194af5bb075655606a05acc0ece00f359c1168e1aaac3c6dede60f7894ff95294efff68e9d5c19dcce5dbefb6
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB