Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-11-2024 12:44
General
-
Target
a3d61dc93f5b5d2529dd856be316e10e293dd9b3d4a7df223d077e7cc8b20660.exe
-
Size
553KB
-
MD5
0708d1dea218c6aad17820715a4ff0af
-
SHA1
c6e675edc3a315fff57b0aee333e54207982b5d9
-
SHA256
a3d61dc93f5b5d2529dd856be316e10e293dd9b3d4a7df223d077e7cc8b20660
-
SHA512
2120a115583475502b3060c782254c39d4f89d0e4cd8d8bf19896e2367f54d19ace57c84f20909d3712df5b0e29422c256c7848d2346879965cef95d9ae3b901
-
SSDEEP
12288:By90uoTOpeIKuLWVkOv96JBBKEafKLzmUnJfCZq:ByDWuMuBKEafKLzmUnJfCZq
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3d61dc93f5b5d2529dd856be316e10e293dd9b3d4a7df223d077e7cc8b20660.exe"C:\Users\Admin\AppData\Local\Temp\a3d61dc93f5b5d2529dd856be316e10e293dd9b3d4a7df223d077e7cc8b20660.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr902655.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr902655.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu198884.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu198884.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5060 -ip 50601⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
277KB
MD5f172f01434d583407d9df28b8c1e3088
SHA14da7ef1315643ba9f211ec3ba93318dc1fcf9ff3
SHA256e0ab4c43a850db175cd77956e6c18504729fedb45c3876b8320674f8ba57481c
SHA51258fb0b5c9005e74df0808e8880dd2043ac70da1cc00d0670cfd06a4dfecc175d41db91a34a30167469e0b98e4fe8d319fbe707392a03c17566c7a80d11380ba0
-
Filesize
360KB
MD527b338d9c3311abec30e7884a6d30694
SHA109f44a2eef206018b67c46648e7648b4721b4d83
SHA2561657734dd8cfe3e90604679e50fd16f2c78f0c64c12e4a26875eb50d2e0bbe49
SHA51231ef4731078936eee97cba95f0dc8f3b01f35d09cd0c1b89922e75a7f6b68ee9409c1bbe83723eed3ae41905133a738650308eea1447301dff12738875ad782f
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
39.6MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
39.6MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
39.6MB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
1024KB