Analysis
- max time kernel
145s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/11/2024, 15:37
General
- Target 7ffcf57e94d7a6268d2bc80b53b00af1be83a28683020971f8fe6b264a4e3266.exe
- Size 707KB
- Sample241104-s2wlpssfpn
- SHA256 7ffcf57e94d7a6268d2bc80b53b00af1be83a28683020971f8fe6b264a4e3266
Malware Config
Signatures
- Detects Healer an antivirus disabler dropper 17 IoCs
- Healer
Healer an antivirus disabler dropper.
- Healer family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 20 IoCs
- Redline family
- Executes dropped EXE 3 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ffcf57e94d7a6268d2bc80b53b00af1be83a28683020971f8fe6b264a4e3266.exe"C:\Users\Admin\AppData\Local\Temp\7ffcf57e94d7a6268d2bc80b53b00af1be83a28683020971f8fe6b264a4e3266.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un305002.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un305002.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr343641.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr343641.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 10804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu568970.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu568970.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4732 -ip 47321⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
un305002.exe
pr343641.exe
qu568970.exe
memory/3048-78-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-853-0x0000000009F80000-0x000000000A598000-memory.dmp
memory/3048-74-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-86-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-854-0x0000000004FA0000-0x0000000004FB2000-memory.dmp
memory/3048-94-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-62-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-64-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-66-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-76-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-856-0x0000000007360000-0x000000000739C000-memory.dmp
memory/3048-857-0x00000000047B0000-0x00000000047FC000-memory.dmp
memory/3048-80-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-855-0x000000000A5A0000-0x000000000A6AA000-memory.dmp
memory/3048-82-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-84-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-88-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-90-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-92-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-68-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-61-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-70-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-72-0x0000000004D70000-0x0000000004DA5000-memory.dmp
memory/3048-60-0x0000000004D70000-0x0000000004DAA000-memory.dmp
memory/3048-59-0x0000000004AB0000-0x0000000004AEC000-memory.dmp
memory/4732-38-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-54-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4732-53-0x0000000000400000-0x0000000002BAF000-memory.dmp
memory/4732-51-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4732-49-0x0000000000400000-0x0000000002BAF000-memory.dmp
memory/4732-50-0x0000000002DD0000-0x0000000002ED0000-memory.dmp
memory/4732-48-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-22-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-21-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-24-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-26-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-30-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-32-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-35-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-36-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-40-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-42-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-44-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-47-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-28-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/4732-20-0x0000000000400000-0x0000000002BAF000-memory.dmp
memory/4732-19-0x0000000004AF0000-0x0000000004B08000-memory.dmp
memory/4732-18-0x00000000071D0000-0x0000000007774000-memory.dmp
memory/4732-17-0x0000000004930000-0x000000000494A000-memory.dmp
memory/4732-16-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4732-15-0x0000000002DD0000-0x0000000002ED0000-memory.dmp