Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/11/2024, 01:23 UTC
General
-
Target
d7d72f6cb9e36f7a834e6371cfa1881182884d78b430d212f62dd3b053aa4c7d.exe
-
Size
560KB
-
MD5
960c32862d7fc8c4f6987432c0de3bb3
-
SHA1
3671e7b4e69cf075404d13271a2f7c190cd77085
-
SHA256
d7d72f6cb9e36f7a834e6371cfa1881182884d78b430d212f62dd3b053aa4c7d
-
SHA512
dcfca06617fae9e05ceeab1514ccfd15413ef1344a42698ec8776ad3e535ac05fe16ca6d93ccb7372c3677ac02663592be4fdf9abdb8b3fddc383fb560589d0d
-
SSDEEP
12288:6y90PvIkI5hzjLoPz5Uvqg4C/cephSc5FT41BJudVJtq5+g+KLH:6yWV4p4CjNOzng6LH
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7d72f6cb9e36f7a834e6371cfa1881182884d78b430d212f62dd3b053aa4c7d.exe"C:\Users\Admin\AppData\Local\Temp\d7d72f6cb9e36f7a834e6371cfa1881182884d78b430d212f62dd3b053aa4c7d.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAd1180.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAd1180.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it999099.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it999099.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp762152.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp762152.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse -
DNS83.210.23.2.in-addr.arpaRemote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
DNS68.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request68.159.190.20.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
DNS72.209.201.84.in-addr.arpaRemote address:8.8.8.8:53Request72.209.201.84.in-addr.arpaIN PTRResponse
-
DNS29.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
185.161.248.142:38452 -
185.161.248.142:38452
-
185.161.248.142:38452
-
185.161.248.142:38452
-
185.161.248.142:38452
-
185.161.248.142:38452
-
185.161.248.142:38452
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:5383.210.23.2.in-addr.arpadns
DNS Request
83.210.23.2.in-addr.arpa
-
8.8.8.8:5368.159.190.20.in-addr.arpadns
DNS Request
68.159.190.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:5372.209.201.84.in-addr.arpadns
DNS Request
72.209.201.84.in-addr.arpa
-
8.8.8.8:5329.243.111.52.in-addr.arpadns
DNS Request
29.243.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
406KB
MD5da9be14a76bac6a21e5fd2486744e235
SHA1cd4e5c29b827dbc5455497a69b96e94e22edfae2
SHA2568bb287da0f04da2f2a468e14c19d8088bcd1bc936e4f4668214339bb94f72845
SHA512abdd2ebfc28f5e5fb10544e280678f57ab69f3185acb53718aef98b7e45c578b7ce533ff030a47e64e04ccc13000e0b072ef130f90c81ff68fd521edeeeff342
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
353KB
MD50ff770222648b0a870bc90d75a97fd4c
SHA1577080d4a744c60ccc3160c1c66313d6112a9a21
SHA2562cd922e989d4908c6264f2a60c555118c8ef0f29033786e05e103abcce12cb0b
SHA51260a57688247b15cc039c0ba5daeb092e9904508a351dbe865e425f189a04c022663bec292d040f6dc3f3b8e991dbc9ac8e88b7d2117ee8117e77d37dba587393
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
5.6MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
304KB