Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 13:31

General

  • Target

    b83c9355cd8899c270c7dd4dc0c4b05032ce6f9ab28ff2e23d509a18f224bf6f.exe

  • Size

    828KB

  • MD5

    8188be46f838f8f67a6a01e822a73cba

  • SHA1

    55152ef03bdf05675aa75a1930138dcde63f015d

  • SHA256

    b83c9355cd8899c270c7dd4dc0c4b05032ce6f9ab28ff2e23d509a18f224bf6f

  • SHA512

    a02cc4150823edc78b3d3246fba7c9e554cc65d1ceda136d01f3bde29ce03b29f66ea6eb0a9a094a8c2a8fa9fb49dba8183f2642901deb65068a5df30eb5177d

  • SSDEEP

    12288:/y90gaoacoBvaAOPeCGAbeTAKXsQHOxK51bEwS9K3kGC6z+JzhjiqvP/wcW5:/y/aoacg3CtCV0xuKUpCgc17Zu

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b83c9355cd8899c270c7dd4dc0c4b05032ce6f9ab28ff2e23d509a18f224bf6f.exe
    "C:\Users\Admin\AppData\Local\Temp\b83c9355cd8899c270c7dd4dc0c4b05032ce6f9ab28ff2e23d509a18f224bf6f.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zitK8494.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zitK8494.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwS8433.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwS8433.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3964
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it761873.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it761873.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4820
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr700239.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr700239.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4176
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:3560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zitK8494.exe

    Filesize

    568KB

    MD5

    ed88251c866eec185a13335f77b0bb4d

    SHA1

    c893b503ef27b705caa412c7b6638f5d351c685d

    SHA256

    38b3779b54be28dcb1d3507199de56e52cb5e91bf90268eb497b71898b7d68a8

    SHA512

    fe6c626ddb37e97a5814de2493f8a42319898a1f58eec6c3306775ed21985d124f99c6825ce0cf885814ae3147909cefdc4334817973bb1d33e0fed5fdf2c6b8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwS8433.exe

    Filesize

    414KB

    MD5

    2f991ec9f83d0027323888e343a74ffd

    SHA1

    4bfe2e77f8def86d9d5f27e4e74a72c3aa420d45

    SHA256

    7fb9a974c2baab0ec9a8249e561a1934b4b4c8bff60331392a8de886e08fb800

    SHA512

    1a65c83835a94e67c9221e19bca5ab5c2a5234bda8504886d2c78edf88a54e9863baaed44550c5c404c8f629532257c72b5862a820dbe03d480f8fb6e36a27d3

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it761873.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr700239.exe

    Filesize

    360KB

    MD5

    8e4d60ab53d5ea6e7bc5bb1cba1a2ac3

    SHA1

    bc6e714b77cdd15103388e8e3c75b6a35b4fb5e9

    SHA256

    3f4cc75c6e668e9207773d384bf2767231fbe2040d89e3b2edc3f94f0b6453e3

    SHA512

    74197bb41780fdae817f0c8d6dbb4e0ab59cb20ee423d2875a9bd5822d5515ee1841f8cc06c96c8feab69b9ae5da10fa236016cb9a9f50518bacef6f8cae311a

  • memory/4176-69-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-29-0x0000000004C30000-0x0000000004C6C000-memory.dmp

    Filesize

    240KB

  • memory/4176-828-0x0000000006DB0000-0x0000000006DFC000-memory.dmp

    Filesize

    304KB

  • memory/4176-67-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-30-0x0000000007380000-0x0000000007924000-memory.dmp

    Filesize

    5.6MB

  • memory/4176-31-0x00000000072D0000-0x000000000730A000-memory.dmp

    Filesize

    232KB

  • memory/4176-39-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-43-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-95-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-93-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-827-0x000000000A5C0000-0x000000000A5FC000-memory.dmp

    Filesize

    240KB

  • memory/4176-89-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-65-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-85-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-83-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-81-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-79-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-77-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-73-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-71-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-91-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-826-0x000000000A4A0000-0x000000000A5AA000-memory.dmp

    Filesize

    1.0MB

  • memory/4176-88-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-63-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-61-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-59-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-57-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-55-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-53-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-51-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-47-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-41-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-75-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-49-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-45-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-37-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-35-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-33-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-32-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/4176-824-0x0000000009DF0000-0x000000000A408000-memory.dmp

    Filesize

    6.1MB

  • memory/4176-825-0x000000000A480000-0x000000000A492000-memory.dmp

    Filesize

    72KB

  • memory/4820-23-0x00007FFF17643000-0x00007FFF17645000-memory.dmp

    Filesize

    8KB

  • memory/4820-21-0x00007FFF17643000-0x00007FFF17645000-memory.dmp

    Filesize

    8KB

  • memory/4820-22-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

    Filesize

    40KB