Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 13:27

General

  • Target

    c9a1cbe8f295dde4abe1edd919718690e420515a4496ae4be4542216dd78bedf.exe

  • Size

    1000KB

  • MD5

    5691b0af86bd1a3c9f0e294eb33efc92

  • SHA1

    5e95a2e19f70db0bd86bc96ae6e8b40a979944a3

  • SHA256

    c9a1cbe8f295dde4abe1edd919718690e420515a4496ae4be4542216dd78bedf

  • SHA512

    d0668ba6c3915d41d67fb152b052831d0fdbe62050b7e1e870f98648f3665f775da4c7e5fbf14c6c7a89bbd15b46c72e59f7e058c020d1ce73eb2ab608624058

  • SSDEEP

    24576:YTLrvnFOPYjIA0NCw+J3Hl+yV5vCoyvIc5zlYWSSpb:OrvFqYjbfJV+QvCoyZzt9p

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9a1cbe8f295dde4abe1edd919718690e420515a4496ae4be4542216dd78bedf.exe
    "C:\Users\Admin\AppData\Local\Temp\c9a1cbe8f295dde4abe1edd919718690e420515a4496ae4be4542216dd78bedf.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4392
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3416
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1080
            5⤵
            • Program crash
            PID:4872
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4316
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3416 -ip 3416
    1⤵
      PID:4140

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe

      Filesize

      719KB

      MD5

      d65c8e9f391cf20655232c5c987b746f

      SHA1

      bfce684cea9f3ad1f8319e3dd581f58ec22df410

      SHA256

      0376e92c9fdd3170bd6c4589d0ab56494bbef6ebb0c1ec8c2be1ea0c637281dc

      SHA512

      226c17e238df5c15eb0a90d5e6922f131e45daa44bee1d7dffe934068cb0db54e03fb23d45826e6daf21f5251bc1cfa65948f19dc45c4c9099376f724e342597

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe

      Filesize

      548KB

      MD5

      79bb8aa7f82a94ba01dc4b70c63957e0

      SHA1

      535a7c0407de96fdce4bf3017f07b4333e9acc01

      SHA256

      337c493481660ea88e0c92612f9caafff009cf7820f9fb84746b24ed2b64fff9

      SHA512

      c7adba7203490aee60aa1b678632df1b1b168f47810bc927978f9b8b7e8ace467446c58f8ae85f3f5bbd3fa4cbae2ace32f67b893c02282de618878b98b50139

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe

      Filesize

      278KB

      MD5

      e1b364b4b96ca742b39a069ca1390a0b

      SHA1

      970e15712c7b43117b2144d2dbf2aed590fff249

      SHA256

      dc2f6a4b3d395642bdd40c133807093078b2e6b7f4e683a878d63e258d58cb4b

      SHA512

      4b48624e84da9949c79e3116f9327cd1f1cd1a68cf495db1c7203db470fc668afca3f48674fc47244e6d6e9157a0d3adaa22183a20470a57df1c5f4a31f8573d

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe

      Filesize

      360KB

      MD5

      848ce28183931ae67c8a0d8ce3a1efc3

      SHA1

      a39582bf82be42b8cf83b0015130273ab0e51c90

      SHA256

      1920e51f6e64752f4dd7474638b8d86c646e1b8cc4099415d2319d038fe1aff3

      SHA512

      430e793cac623274f0082eaec2377e946d9238f394837272ea4237ef305a00b3db28c081d6c82d2fbcadab0dc5a11769ebd9423e9129279a91ffe4b7aeae4b1d

    • memory/1724-1-0x0000000004A40000-0x0000000004B1A000-memory.dmp

      Filesize

      872KB

    • memory/1724-2-0x0000000004B20000-0x0000000004BFD000-memory.dmp

      Filesize

      884KB

    • memory/1724-3-0x0000000000400000-0x00000000004E1000-memory.dmp

      Filesize

      900KB

    • memory/1724-60-0x0000000000400000-0x00000000004E1000-memory.dmp

      Filesize

      900KB

    • memory/1724-58-0x0000000000400000-0x0000000002C64000-memory.dmp

      Filesize

      40.4MB

    • memory/1724-59-0x0000000004B20000-0x0000000004BFD000-memory.dmp

      Filesize

      884KB

    • memory/1724-57-0x0000000004A40000-0x0000000004B1A000-memory.dmp

      Filesize

      872KB

    • memory/3416-48-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-52-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-50-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-54-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-46-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-44-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-42-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-40-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-38-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-36-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-34-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-29-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-30-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-56-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-32-0x0000000007280000-0x0000000007292000-memory.dmp

      Filesize

      72KB

    • memory/3416-28-0x0000000007280000-0x0000000007298000-memory.dmp

      Filesize

      96KB

    • memory/3416-27-0x0000000007380000-0x0000000007924000-memory.dmp

      Filesize

      5.6MB

    • memory/3416-61-0x0000000000400000-0x0000000002BAF000-memory.dmp

      Filesize

      39.7MB

    • memory/3416-26-0x00000000048F0000-0x000000000490A000-memory.dmp

      Filesize

      104KB

    • memory/3416-63-0x0000000000400000-0x0000000002BAF000-memory.dmp

      Filesize

      39.7MB

    • memory/4316-85-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-83-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-73-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-68-0x0000000007120000-0x000000000715C000-memory.dmp

      Filesize

      240KB

    • memory/4316-103-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-101-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-99-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-97-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-95-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-93-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-91-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-89-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-87-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-69-0x0000000007760000-0x000000000779A000-memory.dmp

      Filesize

      232KB

    • memory/4316-81-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-79-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-77-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-75-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-71-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-70-0x0000000007760000-0x0000000007795000-memory.dmp

      Filesize

      212KB

    • memory/4316-862-0x0000000009C90000-0x000000000A2A8000-memory.dmp

      Filesize

      6.1MB

    • memory/4316-863-0x000000000A350000-0x000000000A362000-memory.dmp

      Filesize

      72KB

    • memory/4316-864-0x000000000A370000-0x000000000A47A000-memory.dmp

      Filesize

      1.0MB

    • memory/4316-865-0x000000000A490000-0x000000000A4CC000-memory.dmp

      Filesize

      240KB

    • memory/4316-866-0x0000000006C10000-0x0000000006C5C000-memory.dmp

      Filesize

      304KB