Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/11/2024, 02:37
General
-
Target
db5e0a7d7dda10e8498b04b515ea83beffdd8d8a991347a4295d4e4a18864836.exe
-
Size
642KB
-
MD5
2970144e68a0affa649b571c9d555ec8
-
SHA1
578fe9a657c5103e01c1996a7bb848a2318837ad
-
SHA256
db5e0a7d7dda10e8498b04b515ea83beffdd8d8a991347a4295d4e4a18864836
-
SHA512
3a7cb96f9a9621bf3f244a41e9b4f18f2b2819b15008849d2ea37fd96591fe36495df3576ff473b61156af486daadd11ccf97596fcfb8908734e2d35dca55575
-
SSDEEP
12288:/y90D2KUA2tWHhRj9nYlVtB1JiXvlHqWW6jI1qbPK3A+1UQS+VRC:/yC2KhtHfj+b1Evt66jI1qbPorUQJVRC
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db5e0a7d7dda10e8498b04b515ea83beffdd8d8a991347a4295d4e4a18864836.exe"C:\Users\Admin\AppData\Local\Temp\db5e0a7d7dda10e8498b04b515ea83beffdd8d8a991347a4295d4e4a18864836.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st995672.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st995672.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\26504028.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\26504028.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp968585.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp968585.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
488KB
MD5b018fc31e779cdd4b1e8bf87e875b593
SHA1d30a128cf0be7bb8bad4c73f83f40b4997622835
SHA2567cc3b9aab5cd44e57863fe0556a78194f901e7df3e2b38e6726b4b8afed98495
SHA5125ea57b88aa1049957c245c8049d2cb92e6253c523ad487d7a9d0aa65ab05b80eb69ecd17f910bd234e6c6371df171a664d1411ab42ff3c3b38a0409fc3a8a9f8
-
Filesize
176KB
MD52b71f4b18ac8214a2bff547b6ce2f64f
SHA1b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5
SHA256f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc
SHA51233518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177
-
Filesize
340KB
MD549b8c19408a2059b3ef04d26cbd66be5
SHA16827abafa907293098a1f0a3fbb6935429313a05
SHA2563d7cdeb453f6e77e2ce65ee7626ed458196dc4ee5963b2f514f7abb075c350cb
SHA512f4801ef61dbdaa57e597f41cef99f34f6dea082be7ad271a590a8b7902f7b0a107a95b9fa6ba545ce4ad3455fa3e03fc332ac9b5eaa4b736a906af70ad861236
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
76KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
7.7MB
-
Filesize
96KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
4KB