Analysis

  • max time kernel
    138s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 20:49

General

  • Target

    279ff7cd2ef63e54796de0517a75d41cc014737b0dce9890bde418a0db4eb382.exe

  • Size

    376KB

  • MD5

    a68d4e17fa6702d08b3a623f01838ef2

  • SHA1

    f3e14bb5b6cde3d40f06b0e027bad67f342a6055

  • SHA256

    279ff7cd2ef63e54796de0517a75d41cc014737b0dce9890bde418a0db4eb382

  • SHA512

    fd5178f3b3c0a3ca8f809ce7d209c088daf1c648bf43eaff90b5631965d3da691509f317bae9d101a8815f63c2f3d60d0131cc1751a8a63e3f521be6128aa986

  • SSDEEP

    6144:Key+bnr+0p0yN90QE2sKge3NDeLjkPJpB/MirK3g4fgdm2iY+3wKKo5CfcC:6Mrcy90gXEL4pB/MlJui93wKKMUcC

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\279ff7cd2ef63e54796de0517a75d41cc014737b0dce9890bde418a0db4eb382.exe
    "C:\Users\Admin\AppData\Local\Temp\279ff7cd2ef63e54796de0517a75d41cc014737b0dce9890bde418a0db4eb382.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7379746.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7379746.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4347909.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4347909.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3000
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1944804.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1944804.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7379746.exe

    Filesize

    204KB

    MD5

    b6a51f19826dd4c9ae370d375a13efc5

    SHA1

    a546ca9a89da991d6c73f1df9bfdb7f0ae1cf7da

    SHA256

    0c035ecbf5a3c843a88114c03c912b6e2fdfb437260cdaa18e4dfcdaa38a85fc

    SHA512

    e8bd89b47baae4e42577b8fe796b9c8e2ce36e233f1b261439f55d581c6de0de147605ed686fad93d8e5ddb748da9f7b3510c52e4c2a6f3ea83a5d4ad6497532

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4347909.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1944804.exe

    Filesize

    136KB

    MD5

    d36edae6cd076cc8c20a6f0e89bc92f0

    SHA1

    530b76ae285a2e2d5003fea6065ddf7ad3d95400

    SHA256

    24769d551c80ea75c02e9c569145c47f156c460951de1e89279aa29cbb328024

    SHA512

    a1dd602ebf73bd29fd9adfbe01eaaa15d95b9cdbcd2cc2d717862142337a1940506d1151627c0be8947d691036c00cd9eb728a53744f329575946cc2ff61215c

  • memory/2160-21-0x0000000000D80000-0x0000000000DA8000-memory.dmp

    Filesize

    160KB

  • memory/2160-22-0x0000000008080000-0x0000000008698000-memory.dmp

    Filesize

    6.1MB

  • memory/2160-23-0x0000000007AE0000-0x0000000007AF2000-memory.dmp

    Filesize

    72KB

  • memory/2160-24-0x0000000007C10000-0x0000000007D1A000-memory.dmp

    Filesize

    1.0MB

  • memory/2160-25-0x0000000007B40000-0x0000000007B7C000-memory.dmp

    Filesize

    240KB

  • memory/2160-26-0x0000000002FB0000-0x0000000002FFC000-memory.dmp

    Filesize

    304KB

  • memory/3000-14-0x00007FFF26383000-0x00007FFF26385000-memory.dmp

    Filesize

    8KB

  • memory/3000-15-0x0000000000A00000-0x0000000000A0A000-memory.dmp

    Filesize

    40KB

  • memory/3000-16-0x00007FFF26383000-0x00007FFF26385000-memory.dmp

    Filesize

    8KB