Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/11/2024, 19:37
General
-
Target
68ddb9646dd820d2cdc11bbe112c9fead8e2df69136ee7034fc48660243f0c9dN.exe
-
Size
610KB
-
MD5
7a8774a4f986172ffc7fe6ee10b4d240
-
SHA1
5298c2ff830e8a314880b0710389effc59b7103d
-
SHA256
68ddb9646dd820d2cdc11bbe112c9fead8e2df69136ee7034fc48660243f0c9d
-
SHA512
f2bd88adedbba60ca933c65f081837ae5aa95e12edfdb341f9c052e87648e604f54fe7254081fbcbd4af97fc05d671d2d59129455013e8f917852c8c27576e13
-
SSDEEP
12288:sy90jMT4oISsovRsmxnVTigenKQFGUbZJghkaRC6y:sy+7oCoWCwKWGirg3Ny
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68ddb9646dd820d2cdc11bbe112c9fead8e2df69136ee7034fc48660243f0c9dN.exe"C:\Users\Admin\AppData\Local\Temp\68ddb9646dd820d2cdc11bbe112c9fead8e2df69136ee7034fc48660243f0c9dN.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr715384.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr715384.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 10803⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu001858.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu001858.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 928 -ip 9281⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
403KB
MD5408505372fd3e07d3fc9425350fb229e
SHA1df824d5652d43d2ce93225a87715f9c7368356f2
SHA25649ac4d0dde7ae5197ae608bdf4b3d4354099901eef9d908da27339c27104385f
SHA5120abd8202f8e0ecfba76a0be11eb732a87be9968c91c902bc0853e1bfa221a6b53586f21e558ea36c81369272fff534565727ae809bf507e57cf4182fa6729430
-
Filesize
486KB
MD5641055a225a4ffe972d0658bf8a60ba9
SHA1bf8b983ef939e155b6032ea9cb9bcea8b7c866dc
SHA256c6e4af66be6e1ae184566c5923628d25164bfec525de5adeed0b711d9cce1d3b
SHA512d499366221bc1b51d340e619d656c1dae77bc45d207a0d317995c97da45db26b2edb90b6f380818752cf96bc5ab3be4d01662b89fbe3865176068008b24ecadc
-
Filesize
4.0MB
-
Filesize
1024KB
-
Filesize
4.0MB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
4.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
4.1MB
-
Filesize
240KB
-
Filesize
304KB