Analysis
-
max time kernel
113s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 03:26
General
-
Target
ea84c1b13cb1d985a4d28e797d968d8688c4cba095f28a966db1ed9cd7655597.exe
-
Size
701KB
-
MD5
921531d129cfdabf7a80bae0a6802dfc
-
SHA1
97564fbfe67aa19b62bb597d9ff4355c4410a1e7
-
SHA256
ea84c1b13cb1d985a4d28e797d968d8688c4cba095f28a966db1ed9cd7655597
-
SHA512
6c3a39db72207a86bcc74205da279386f11d397961dcdcfff735833376c462844af020874d79436cc05c50d9a7fa4d2c4d6094399a5710df80b119ae700b0e5d
-
SSDEEP
12288:7y90Nq0qDk1lY1kFgt6H/NyEG2Zo9wUi1/S27s0zQiT3iS:7yU32cfJGhwB55HiS
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea84c1b13cb1d985a4d28e797d968d8688c4cba095f28a966db1ed9cd7655597.exe"C:\Users\Admin\AppData\Local\Temp\ea84c1b13cb1d985a4d28e797d968d8688c4cba095f28a966db1ed9cd7655597.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un018517.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un018517.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\23943948.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\23943948.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 10884⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk260895.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk260895.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 544 -ip 5441⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5e6b975b3dd08555942357c22ca60070f
SHA1e159a34c5c2f0187251136dafd71428cbab2fbf0
SHA256c6324a189f06b945cba502fbf5e30a7e84cfc8db23cd1f909443e898d14bf35e
SHA5123c6ea36f2e3d7f048157329d74014b550714b7818eca678ba286394a7c4458acda589d8af908e52ee33352794444eb7f16d957c77d4ba468bda8779d53f99b18
-
Filesize
269KB
MD5c64a5d3a40d673e44c045d62e3ad8c76
SHA1805f1fab4dd9f51ce41cced7c600682047461880
SHA25628b43890757f6f5c4ec8f36d7b69ff085e29be67c772f309acd9c29024b19f80
SHA512610859337488063be60bb8870f469b149cf9e1fc4b9b705a9b34e3abcf60b21934eb96ef14fc54abd2a41ff236502ddd796722ccabdfbb1665f9cb4a1a147c88
-
Filesize
353KB
MD58d469656fdddd767ebbf0031e2d1f853
SHA1bfa4af55cdd2afdce02bfc06893463f995f818fe
SHA2566883ed8eb08dc37d3dba2458a54d6d67489ea17963dac926b821aff7098eb6f2
SHA512d3be47914a7d571499cdca01214c624609ea0e315b445a7d83086a194c8f727a14fac2eb49c9c40ba4e485bb975725edb107ccfc736f2a9e908f6281a90fa89c
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
192KB
-
Filesize
39.6MB
-
Filesize
39.6MB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.6MB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
1024KB