Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/11/2024, 09:53
General
-
Target
40b4db2c2cb13131a3d88fa47fa4b8f28364be77e5f3ef39a995900561b51798N.exe
-
Size
540KB
-
MD5
a32c5627532d59f9f440cefa3c2c7b00
-
SHA1
bb89e8935adbe0089a693fb70b5bca2cb122f367
-
SHA256
40b4db2c2cb13131a3d88fa47fa4b8f28364be77e5f3ef39a995900561b51798
-
SHA512
297ea59544a80c96da01d8bba40629a660b032732b0ee137bc6011aa808518852cfd79c7c9aeb9766c317ed9a571dd340aa3b63d47abc588685933df61e04864
-
SSDEEP
12288:2y90OO+5+w3FT2VyGXKL/fvSdWN6Fv18bvKTA+2h:2y5OJuFAyG6D6Fv18bv4g
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40b4db2c2cb13131a3d88fa47fa4b8f28364be77e5f3ef39a995900561b51798N.exe"C:\Users\Admin\AppData\Local\Temp\40b4db2c2cb13131a3d88fa47fa4b8f28364be77e5f3ef39a995900561b51798N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\07432451.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\07432451.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 10803⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk770313.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk770313.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3892 -ip 38921⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD5dd66a90579e3ebf82ccd392438ee871a
SHA1b016ddd88aee92cc9474b5eeb0a2ff020ce85259
SHA2560c81d874fbec528af37080e461465044e1ecda80118584647da4cf33cf06e01c
SHA51233dfc1ce182b1deeea464f84f21fd0d06297f4f4cb81d305d0f9da33b450100c46262666620f8c188862971e2086e76b88b033ed1f2f4dff3308d979cb6ad3e3
-
Filesize
340KB
MD5d732f55b4bccbc91c6babe8bfc1db13d
SHA16efe2ed9ac22679df05f7f40861a45f78224247a
SHA256367ea18460480cf9eec45bd51bc2d11b79b8446a89a1cfe17c3184929d35cbb2
SHA512ea139695a51d26cddf78d24172cb3ced63314b8b06c0a73558aa262ba8e599c7de5a3b7387aa947bead30fad9e8cd9eb8ef850a00ac52731491a6a181a4646f3
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
76KB
-
Filesize
39.6MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
39.6MB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB