Analysis
-
max time kernel
114s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-11-2024 11:25
General
-
Target
d84ffc49297c60e6deb96fa465907cf4b7624881aaf6edad44171f9f717056c3N.exe
-
Size
551KB
-
MD5
637416edb6535e0803a07bd3db417e20
-
SHA1
8c1b929abad12fb7dd6637f7ab661f5f4cc480ed
-
SHA256
d84ffc49297c60e6deb96fa465907cf4b7624881aaf6edad44171f9f717056c3
-
SHA512
d7a530854ed47aae9ecca1e3fc4f6dfef13dc31433375101a1c9fc3032ada32756a6f3067b9428395d7fa394a2f7bafea92792f46687367ed70349dd4dbb317a
-
SSDEEP
12288:/y90wWlOperKHgzaBk6EZIKlaRzm9QJfCYZ:/y7HC+BwTlaRzm9QJfCK
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d84ffc49297c60e6deb96fa465907cf4b7624881aaf6edad44171f9f717056c3N.exe"C:\Users\Admin\AppData\Local\Temp\d84ffc49297c60e6deb96fa465907cf4b7624881aaf6edad44171f9f717056c3N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr127026.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr127026.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 10883⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu650285.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu650285.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 220 -ip 2201⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
277KB
MD5fad22d1ae2535fb18806501a5d9b8a14
SHA188262fd27056e25ed6c7cfcf56b366f7a45cbeae
SHA256dc2d3a33763236c39f7c5b6b18c6822764b6010afa0c2bf17cde6724fcd47689
SHA51238dd7c5275fec407cc472209c367eaf2fd33fda3cd54c5dba1883de4014b61be7d4c025e5f0482ebfcfec03896dc2e70f3ec417c5f6c3ce5cef579d4a5d41e50
-
Filesize
360KB
MD5f602d9774230d97e9eb0b35ebe2a9c3d
SHA1cee4fe97300ce46a4148fe537cccf4c630888b73
SHA256e1712b4f539d47c6cc925987751c717113df30c1548d77bdcb5ebd0b54a2601e
SHA512e40bb6be04dda0c293223a5baec0dcb9dfb7d52ed8d3277abf278e6edfe92c4b9b7cf75fefa6dba98e9ced27b9df52c9d616f068dfb9a97b5c0be916c0beb83b
-
Filesize
1024KB
-
Filesize
39.6MB
-
Filesize
1024KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
104KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.6MB
-
Filesize
39.6MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
5.6MB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
212KB