Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 20:39
General
-
Target
2739adcc3825c2e989503f9d8750d88b4872d8201427e3baab4be58b22dc2e0a.exe
-
Size
552KB
-
MD5
27a5bda558815b3ad76de08072e0bcb3
-
SHA1
f8b40ac1616fc8beac38355594eb91c86038e53a
-
SHA256
2739adcc3825c2e989503f9d8750d88b4872d8201427e3baab4be58b22dc2e0a
-
SHA512
0af63da570b21c73e3235a1434ce7d5140cbc639bb26936a7ec4631177ff9e29bdde97759d346cd0ea9df73a7a6113f88a514472be77de8c8a9d6fbd5079bece
-
SSDEEP
12288:Jy90og+IFvkQZ+9EvWJdkphJxFtzoXdqdrnJY8c05iZQb:Jyv/ukgykphFo6rnTcSz
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2739adcc3825c2e989503f9d8750d88b4872d8201427e3baab4be58b22dc2e0a.exe"C:\Users\Admin\AppData\Local\Temp\2739adcc3825c2e989503f9d8750d88b4872d8201427e3baab4be58b22dc2e0a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr340132.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr340132.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 10843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu265053.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu265053.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4436 -ip 44361⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299KB
MD55c5b80ccb0123d5a59ca9a6d1dbfa822
SHA121174ffaa7a56a0ffec3c648e92860b79634b28c
SHA256614820920ecfbd8f98e26039d5301f3a23725a983b3d45ea4a42c828d936a937
SHA5126a969e62f07623f1fa34c008fc098c9e5125bcc061db43d164f628fee3fe160ccb344774f6c64d55ff4a9ba1fa24082cee56c14190d5405dfd98e3910e29ca22
-
Filesize
382KB
MD5a98f3d642ac3390e9efd64ecf3850ca8
SHA1c9fcfe88a7a8b7c6eb4bf084a120646c6dccc7bc
SHA2566836dba43f5810f8d023914a6557952100ef3d09e7721ed30457aa4e61fbe0cb
SHA512d6b2ede829c0f9afc57ec9dc004ba555418f888e056f00429c24225a78e7814c2cd34993eae9f738e7f79233806426271b63f49cbef32cbebfb32c4a75d810c8
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
39.7MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.7MB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB