Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 05:19
General
-
Target
ea3b6fbb4d48852592727c65fe4b3bebf7c36941a1f703cd7bd5ad7baea6cc4b.exe
-
Size
704KB
-
MD5
b88a26a8cafcafb49b24316e8695d6cc
-
SHA1
d2f00be63ece81870f211e36c6281357ba24a3a2
-
SHA256
ea3b6fbb4d48852592727c65fe4b3bebf7c36941a1f703cd7bd5ad7baea6cc4b
-
SHA512
d3185d385fabd9b8dfbbcada8d3fa13dfd4e21e21f299f3b48559f619253e3ce89ce1e30a960049bcf47479cb4deed79bb2a4eb5d79debb314a4ffd5c8087be5
-
SSDEEP
12288:my90H9AcgVm1P9PkvurYKL7twTvBDTBqeqvvTMpGBQ:mywA/m1Fcv4n7WlPBqeqvLDBQ
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea3b6fbb4d48852592727c65fe4b3bebf7c36941a1f703cd7bd5ad7baea6cc4b.exe"C:\Users\Admin\AppData\Local\Temp\ea3b6fbb4d48852592727c65fe4b3bebf7c36941a1f703cd7bd5ad7baea6cc4b.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227742.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un227742.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr892680.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr892680.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 10924⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu102495.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu102495.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3760 -ip 37601⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550KB
MD5a4131c1d4446bbca7d599f13f933fc2a
SHA1e59c86e53bb91633680ee18ff6ff7ac38227b962
SHA256b40269271033df805a725ca0f8562f2ff6da64a42aa5af269e2cfa3348e01c0b
SHA512b3ff0f82f1b611f9dd5dd93e2df6e4919170d421c5df072e8642ca80f33940a979b8ae8ab70a096553e49d34a71e6cf9bc4efde3baaf42ef09df53dc87f2844e
-
Filesize
277KB
MD584b1d033eb8b3159406f81159cb2c3fb
SHA1a757f6250dbc4f3c12868aa350b04ef43f89301f
SHA2569b04d9f9ebf7127e8a5a40ec8c09ffd1a2684346e980297f653beefe397730ad
SHA512eeb584d5bee699190e1070cf7088ddd1af9fbefba99fd71f6fa7f01dc308ce9c08e05c4d1aa2584802a520f5d5a0e20afa2a085d31cd30344937d301c43ffe2a
-
Filesize
360KB
MD56e06dda023270f3ef92970cffe13a939
SHA186b8636cc34d8621eed7bb29541ee92f8594b322
SHA256015cb65ab28ce847c5df3e30c6e329ec52899d88054202f2a713811ad4fab0b3
SHA512a472b86e392ce3d6ef2234f9168df236328f22f6fa0c7d74b9a680ff50f536743610ee7ed2f6ee457882e00d6feb6529a2c29c5e03e3f831c27a2cfe1d166d7b
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
1.0MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
39.6MB
-
Filesize
192KB
-
Filesize
39.6MB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB