Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 01:32
General
-
Target
79ac44b9f977eb61b03717dd0dcedb7051461361ad74cf128c903171765a7478.exe
-
Size
727KB
-
MD5
332ce294791a9087724ad71d205d0301
-
SHA1
bffc2e69db0342d9f690dd313533162f23501241
-
SHA256
79ac44b9f977eb61b03717dd0dcedb7051461361ad74cf128c903171765a7478
-
SHA512
a7e9797ff248feef93a2abf2f7cb1c05742779e45dde98cc03fbee5e23d162e7d517257d1dbed576fac3245947f76f8c52d1a2ce14c95c4821871eadb39ea67e
-
SSDEEP
12288:by90uPy9s0V7t75N8vkI0j/FCBMBFlunUu2jDFw/lq+N:bygfVt7iKPXunv2j54lq+N
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\79ac44b9f977eb61b03717dd0dcedb7051461361ad74cf128c903171765a7478.exe"C:\Users\Admin\AppData\Local\Temp\79ac44b9f977eb61b03717dd0dcedb7051461361ad74cf128c903171765a7478.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un661811.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un661811.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\92683468.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\92683468.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 10844⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk793922.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk793922.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4216 -ip 42161⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
573KB
MD5a001c8e0bd9706a074e89e1f252d368b
SHA18ed0ef602d5e41d6a7f1868bde249850e4e0925c
SHA25682bea6f29e04d581e312ccb53db75114acbd930833a427655c8a30b0ec941ff0
SHA512dc07b15241497c22297024c1234d93b3b6c3fcb495d9687e1fcd6d9bf2af2f576b0b95b204289caba810a02d017b04b8b80de5a9aff55d6412ca4fd3c8811a0d
-
Filesize
332KB
MD5bb3dff89584a0e5e209b9cfa080db01d
SHA18bfa9d035d4c723f2d094b7bfd92ec3642c7f989
SHA2561660053d05b48284abc0ea70df05eb50394971473f0b16acb960e1690f952590
SHA5121c2d07f0d7b5c3eb6ece3744ff5708164a644fa056c2e694a5f48256302bf367303ca9d1d947e736c5fa99608375b7871c9d650c90d6604e8fa3b1d4fb8a307d
-
Filesize
415KB
MD5c399d1c210c90c32c0a32a307bf84599
SHA1b0adfc469e04aaa59f31d27754362a3bacd4ea45
SHA2561234f45823d1193dacbaa787ea437ba7261e032d607792226820cfaf0848267e
SHA5129ad8aaef2b75bfc75f18539357315046de5b33f8006cbb12a7319c00a7c8b398137ae07435dbf053e62251c8f7e05c331921f2c752b316a0a3c22bb4ca23caba
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
408KB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
192KB
-
Filesize
1024KB