Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/11/2024, 19:40
General
-
Target
0e82587ee4e83620d02b67717663fd0ee8a4a9e27f5ac5fb5a4f6a0340fffaea.exe
-
Size
762KB
-
MD5
1de2df9fb12e65d9ed503038ac2a5115
-
SHA1
93a4e6c4a22a9aef6432e50ba20de33a816454f0
-
SHA256
0e82587ee4e83620d02b67717663fd0ee8a4a9e27f5ac5fb5a4f6a0340fffaea
-
SHA512
9f47969633a94111a18cf28399b1f74ba866fc060c95d0fb9e06bb305e3e5a5c0f3c10b14c64eb227a58c2163c3125bc3cfdcb54023947a35d7df621aa4b88c7
-
SSDEEP
12288:Jy90/qjyGppsWA338zK0Kvw+AnPkkKwMh78mqmqAPLuM7cx0Z90LQ4:JyOyjTq8W25P6wMhgB9AjuucCv4
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e82587ee4e83620d02b67717663fd0ee8a4a9e27f5ac5fb5a4f6a0340fffaea.exe"C:\Users\Admin\AppData\Local\Temp\0e82587ee4e83620d02b67717663fd0ee8a4a9e27f5ac5fb5a4f6a0340fffaea.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un646658.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un646658.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr519473.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr519473.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu397948.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu397948.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4616 -ip 46161⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608KB
MD5add033e55eb508e5aae533d56c8b1b9c
SHA18ef4f3646dd75efa635a41b24244f8c175ce9a72
SHA256cd3876c747287a1c5e964d8eb76a496ce6442a2988c526f5a257ff4baedb3609
SHA512aff7b2293a53e9656060ae80abdeaced0bdbda7fc41ae29fb071406bac8e56c96e3396f720de605abd86f917a1eb51055a89a9fdccdbe6d535f77aecac3b8d5d
-
Filesize
405KB
MD5dda8fea27b8e054b7b1f3a7fe122f639
SHA166e584fcc1ebe5841feb87a738d6d795ad8e6f11
SHA25647b7e21b011a7dbb816409fddc05afbbeaed1bec2f8393c46fcc79fba5b5033b
SHA512e02474d189bfa71c92e23a25eba8aa4c9adcbb69dc0b916234c8454ef1cf681110ac04216ce85f007993c68b5e474e94bd4d58e5b0db54304bd3712b69291f0d
-
Filesize
488KB
MD5c6c2a8ababa35035e14e081942673709
SHA1d2d254912ae4864c37c00d461a0101e1f9adf0c1
SHA256e43903ed249f10eaf525a593b5233fc473d8ea233a10f084a6705bf0ae1a9474
SHA512dbfb4139017b65f147ac2773a634f7a5ff862769afa2f1e7c515f329e6a917b6b5cb7343267c7e2ad42cd1d8ff10e66edd409d2bb31b86099113c8d9a0bb2e07
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
180KB