Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-11-2024 13:27

General

  • Target

    c9a1cbe8f295dde4abe1edd919718690e420515a4496ae4be4542216dd78bedf.exe

  • Size

    1000KB

  • MD5

    5691b0af86bd1a3c9f0e294eb33efc92

  • SHA1

    5e95a2e19f70db0bd86bc96ae6e8b40a979944a3

  • SHA256

    c9a1cbe8f295dde4abe1edd919718690e420515a4496ae4be4542216dd78bedf

  • SHA512

    d0668ba6c3915d41d67fb152b052831d0fdbe62050b7e1e870f98648f3665f775da4c7e5fbf14c6c7a89bbd15b46c72e59f7e058c020d1ce73eb2ab608624058

  • SSDEEP

    24576:YTLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:OrvFqYjbfJV+QvCoyZzt9p

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9a1cbe8f295dde4abe1edd919718690e420515a4496ae4be4542216dd78bedf.exe
    "C:\Users\Admin\AppData\Local\Temp\c9a1cbe8f295dde4abe1edd919718690e420515a4496ae4be4542216dd78bedf.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2652
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe

    Filesize

    278KB

    MD5

    e1b364b4b96ca742b39a069ca1390a0b

    SHA1

    970e15712c7b43117b2144d2dbf2aed590fff249

    SHA256

    dc2f6a4b3d395642bdd40c133807093078b2e6b7f4e683a878d63e258d58cb4b

    SHA512

    4b48624e84da9949c79e3116f9327cd1f1cd1a68cf495db1c7203db470fc668afca3f48674fc47244e6d6e9157a0d3adaa22183a20470a57df1c5f4a31f8573d

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe

    Filesize

    719KB

    MD5

    d65c8e9f391cf20655232c5c987b746f

    SHA1

    bfce684cea9f3ad1f8319e3dd581f58ec22df410

    SHA256

    0376e92c9fdd3170bd6c4589d0ab56494bbef6ebb0c1ec8c2be1ea0c637281dc

    SHA512

    226c17e238df5c15eb0a90d5e6922f131e45daa44bee1d7dffe934068cb0db54e03fb23d45826e6daf21f5251bc1cfa65948f19dc45c4c9099376f724e342597

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe

    Filesize

    548KB

    MD5

    79bb8aa7f82a94ba01dc4b70c63957e0

    SHA1

    535a7c0407de96fdce4bf3017f07b4333e9acc01

    SHA256

    337c493481660ea88e0c92612f9caafff009cf7820f9fb84746b24ed2b64fff9

    SHA512

    c7adba7203490aee60aa1b678632df1b1b168f47810bc927978f9b8b7e8ace467446c58f8ae85f3f5bbd3fa4cbae2ace32f67b893c02282de618878b98b50139

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe

    Filesize

    360KB

    MD5

    848ce28183931ae67c8a0d8ce3a1efc3

    SHA1

    a39582bf82be42b8cf83b0015130273ab0e51c90

    SHA256

    1920e51f6e64752f4dd7474638b8d86c646e1b8cc4099415d2319d038fe1aff3

    SHA512

    430e793cac623274f0082eaec2377e946d9238f394837272ea4237ef305a00b3db28c081d6c82d2fbcadab0dc5a11769ebd9423e9129279a91ffe4b7aeae4b1d

  • memory/2652-59-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-53-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-67-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-65-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-63-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-61-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-39-0x0000000002CF0000-0x0000000002D08000-memory.dmp

    Filesize

    96KB

  • memory/2652-57-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-56-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-51-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-50-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-47-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-45-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-43-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-41-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-40-0x0000000002CF0000-0x0000000002D02000-memory.dmp

    Filesize

    72KB

  • memory/2652-72-0x0000000000400000-0x0000000002BAF000-memory.dmp

    Filesize

    39.7MB

  • memory/2652-73-0x0000000000400000-0x0000000002BAF000-memory.dmp

    Filesize

    39.7MB

  • memory/2652-38-0x0000000002C40000-0x0000000002C5A000-memory.dmp

    Filesize

    104KB

  • memory/2808-3-0x0000000000400000-0x00000000004E1000-memory.dmp

    Filesize

    900KB

  • memory/2808-2-0x00000000045C0000-0x000000000469D000-memory.dmp

    Filesize

    884KB

  • memory/2808-68-0x0000000004490000-0x0000000004564000-memory.dmp

    Filesize

    848KB

  • memory/2808-69-0x00000000045C0000-0x000000000469D000-memory.dmp

    Filesize

    884KB

  • memory/2808-71-0x0000000000400000-0x00000000004E1000-memory.dmp

    Filesize

    900KB

  • memory/2808-1-0x0000000004490000-0x0000000004564000-memory.dmp

    Filesize

    848KB

  • memory/2808-0-0x0000000004490000-0x0000000004564000-memory.dmp

    Filesize

    848KB

  • memory/2808-70-0x0000000000400000-0x0000000002C64000-memory.dmp

    Filesize

    40.4MB

  • memory/2840-111-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-103-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-117-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-115-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-113-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-84-0x0000000004DF0000-0x0000000004E2C000-memory.dmp

    Filesize

    240KB

  • memory/2840-109-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-107-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-105-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-85-0x0000000004E30000-0x0000000004E6A000-memory.dmp

    Filesize

    232KB

  • memory/2840-101-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-99-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-97-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-95-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-93-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-91-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-89-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-87-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB

  • memory/2840-86-0x0000000004E30000-0x0000000004E65000-memory.dmp

    Filesize

    212KB