Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 05:17
General
-
Target
8197a23a0e1d0764f985b313c7d7e58a97700fe13b289107075ea63cc15a9f42.exe
-
Size
707KB
-
MD5
250836ddeb0a22c1e7e30d3355f05e64
-
SHA1
b5c4afb09e6003e1d92bacdbd75502e26eb61cd1
-
SHA256
8197a23a0e1d0764f985b313c7d7e58a97700fe13b289107075ea63cc15a9f42
-
SHA512
ec6eeac817c9b97cc2d520661059fb0dde0ad597f83f6ad21125235276f2ee28362d89f2090fc1e6d53bc166aaed3bcbb9bbdeb80c96142f51c0e2c51be4a132
-
SSDEEP
12288:1y90yu04J+VDNlpvzB2wTaYXXbHW8I5K/SpQbYXbGWPFkA:1yGJ+LB7a8Xb/SXbG2FkA
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8197a23a0e1d0764f985b313c7d7e58a97700fe13b289107075ea63cc15a9f42.exe"C:\Users\Admin\AppData\Local\Temp\8197a23a0e1d0764f985b313c7d7e58a97700fe13b289107075ea63cc15a9f42.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un139067.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un139067.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr487006.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr487006.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 10044⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu137355.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu137355.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2724 -ip 27241⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
552KB
MD5258213b564847b320464a0da6290c405
SHA1468f7052d78d56eaf3173e6436f6b316afd5386c
SHA256cf6a92c65e2b0137fb70df4f3631a591d9083d06090bd16e672b3311c1a7df6e
SHA51286fe0f30dd54517e36b05baf8fce3011e14e2ed2b9556ae06cffb82469d23d0b807ca35e86f9df7936f59cf6a4e7d4e67ae70f72b59ff2b5353b70cf93d62828
-
Filesize
278KB
MD57ec208a5c4f2075246cb22581252e45d
SHA1d8aba01e1428437bee89480fc9449d8656145c64
SHA256b648f66cbe6af67867ed2a5217e841fa35032425de21f57aae877f356d9e975c
SHA5121945c45c3efa38cc0898193e449526da6524d07e654453c9e8be8f2a48a5b61117c20a6bac477c8965185fd65624d6df26e6cc729f3eb61794f68d850e7cbf24
-
Filesize
359KB
MD5617d2c2fc53a628184247ba13209da6a
SHA1854fe23f35b0f734b6407e3e9cc78fdd408cda0f
SHA256ed26326c2924182e10680c290f434f49584b1f5310e1082a90c1ad8bbdc574f9
SHA51206bd9fa2ca08917937982dadecb4f229d8dc5faa50fbc260ae83c2595586f666350ace6853827dbb59fc620455e242e9b46014d742fda0dc5689270888d16a31
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
240KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
232KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
39.6MB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
39.6MB
-
Filesize
180KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
1024KB